$26.44 Million Stolen: Truebit Protocol Smart Contract Vulnerability Analysis
Background
On January 8, 2026, the decentralized offline computation protocol Truebit Protocol was attacked. By exploiting a vulnerability in the smart contract, the attacker made a profit of approximately 8,535 ETH (about USD 26.44 million). The following is a detailed analysis of this incident by the SlowMist security team.
Root Cause
Due to a lack of overflow protection in an integer addition operation, the Purchase contract of Truebit Protocol produced an incorrect result when calculating the amount of ETH required to mint TRU tokens. As a result, the price calculation was erroneously reduced to zero, allowing the attacker to mint a large number of tokens at nearly no cost and drain the contract’s reserves.
Prerequisite Knowledge
Truebit Protocol is a decentralized off-chain computation marketplace designed to move complex computational tasks away from the blockchain mainnet and execute them off-chain, while ensuring the correctness of results through economic incentive mechanisms. The protocol introduces a native token, TRU, which adopts an algorithmic elastic supply model. The real-time price of TRU is dynamically determined by a ratio function of the ETH reserves held in the contract and the circulating supply of TRU. The minting and burning of TRU are fully managed automatically by on-chain smart contracts:
- Minting: Users deposit ETH into the Purchase contract and mint TRU at the algorithmic price.
- Burning: Users burn the TRU they hold and withdraw ETH from the contract at the algorithmic price.
Attack Analysis
Attacker Address: 0x6C8EC8f14bE7C01672d31CFa5f2CEfeAB2562b50
Attack Contract: 0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2
Related Attack Transaction:
0xcd4755645595094a8ab984d0db7e3b4aabde72a5c87c4f176a030629c47fb014
1. The attacker first called the getPurchasePrice function of the Purchase contract to query the amount of ETH required to mint 240,442,509,453,545,333,947,284,131 TRU tokens. Because this value was carefully crafted, an integer overflow occurred during the price calculation, causing the function to return 0.
2. The attacker then invoked the minting function of the Purchase contract (0xa0296215), passing in the above token amount. Since the required ETH price was calculated as zero, the attacker paid no ETH and successfully minted 240,442,509,453,545,333,947,284,131 TRU tokens.
3. The attacker immediately called the 0xc471b10b function (the burn function) of the Purchase contract, burned all the newly minted TRU tokens, and redeemed 5,105.069 ETH from the contract’s reserves.
4. The attacker repeatedly executed the above “mint → burn” cycle. As the total TRU supply (S) increased, subsequent minting required a small amount of ETH, but the value of the minted tokens still far exceeded the cost paid, leaving a significant arbitrage opportunity. The attacker continued this process until the contract’s ETH reserves were completely drained.
Attack Mechanism Analysis
1. Price Calculation Formula
Through reverse engineering of the Purchase contract, we identified the core price calculation function:
This function is used to calculate the amount of ETH required to mint a specified number of tokens. The formula is as follows:
Price = (100 * A² * R + 200 * A * R * S) / ((100 — T) * S²)
Where:
- A (AmountIn): The number of tokens the user intends to mint
- R (Reserve): The current ETH reserve held by the contract
- S (Supply): The current total supply of the token
- T (THETA): A contract parameter, fixed at 75
2. Root Cause of the Vulnerability
The contract was compiled with Solidity ^0.6.10. In versions prior to Solidity 0.8.0, arithmetic operators (+, -, *) do not include built-in overflow checks. When a calculation exceeds the maximum value of uint256 (²²⁵⁶ − 1), a silent overflow occurs, causing the result to wrap around to a small value near zero.
In the critical section of the price calculation code:
Although the multiplication operations were protected using the SafeMath library, the addition operation in the numerator (v12 + v9) directly used the native + operator without overflow protection. This lack of validation constituted the core vulnerability exploited in this attack.
3. Quantitative Analysis of the Attack
Taking the attacker’s first minting transaction as an example:
Calculation Process:
Overflow Determination:
Since the result of v12 + v9 exceeded the maximum value of uint256, an overflow occurred and wrapped around. The numerator became an extremely small value after the overflow, and after integer division, the final calculated Price = 0.
4. Impact of the Attack
By carefully crafting the AmountIn parameter, the attacker ensured that:
- All multiplication operations passed the SafeMath checks (no revert was triggered);
2. The addition operation overflowed, causing the numerator to wrap around to an extremely small value;
3. The integer division result became 0.
As a result, the attacker was able to mint a massive amount of tokens without paying any ETH.
MistTrack Analysis
According to on-chain tracking and the anti-money laundering tool MistTrack, the attacker profited approximately 8,535 ETH (about USD 26.44 million) in this incident.
The stolen 8,535 ETH was first transferred to three newly created addresses and eventually all funneled into Tornado Cash.
On-chain records show that the attacker’s address had prior transactions on 2025/11/20, 2025/12/06, and 2025/12/27, with the main activities as follows:
- 2025/11/20: Obtained funds on Avalanche via Drain and bridged them to BNB Chain through Rhino.fi.
- 2025/12/06: On BNB Chain, bridged the received funds to Ethereum via Rhino.fi.
- 2025/12/27: On Ethereum, obtained 4.98 ETH via RUN, suspected to be from a previous attack initiated by the attacker, and a total of 5 ETH was transferred into Tornado Cash.
MistTrack has currently flagged the relevant addresses.
Conclusion
The root cause of this attack was that the addition operation in the numerator of the Purchase contract’s price calculation did not use the SafeMath library for overflow protection. Since the contract was compiled with Solidity 0.6.10, the native + operator does not include overflow checks. By crafting a specific minting amount, the attacker caused the addition operation to exceed the maximum value of uint256 and wrap around, resulting in a Price = 0, thereby enabling near-zero-cost token minting and arbitrage.
The SlowMist security team recommends that for contracts compiled with Solidity versions below 0.8.0, developers should ensure that all arithmetic operations are protected using the SafeMath library to prevent logic vulnerabilities caused by integer overflows.
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
