# Truebit Exploit -- January 2026

## 1. What Happened

On 8 January 2026, the Truebit Protocol token sale contract on Ethereum was exploited for approximately $26.4M--$26.6M (8,535 ETH + ~71 ETH by a copycat). A second attacker extracted a further ~71 ETH (~$224k) using the same technique shortly after. [1][2][3]

## 2. Root Cause

The `getPurchasePrice()` function computed the ETH price to mint TRU tokens by chaining several multiplications of `totalSupply`, `amount`, and `reserve`. The contract was compiled with Solidity below 0.8.0 and did not use SafeMath; intermediate products in the numerator (`100 * amount^2 * reserve + 200 * totalSupply * amount * reserve`) overflowed past 2^256, wrapped to a small number, and the final integer division rounded the price to zero wei. The attacker called `buyTRU()` with that zero price, minting tokens for free, then immediately sold them for real ETH. [1][2]

## 3. Pattern

**Overflow / Arithmetic Error (Token Accounting)**. The vulnerable shape:

```
price = (100 * amount^2 * reserve + 200 * totalSupply * amount * reserve)
        / (25 * totalSupply^2)
```

With a sufficiently large `amount`, the numerator exceeds `type(uint256).max`, causing unsigned integer overflow in Solidity <0.8.0. The wrapped result divided by the denominator rounds to zero. The contract trusts this price, letting the caller mint tokens for nothing and drain the reserve. [1][2]

## 4. The Check That Would Have Caught It

- **Compiler version / SafeMath**: Compile with Solidity >=0.8.0 (built-in overflow checks) or use OpenZeppelin SafeMath. A deploy-time check that `pragma solidity ^0.8.0` is present on every arithmetic file catches this directly. [1]
- **Fuzz / invariant test**: Fuzz `getPurchasePrice(amount)` with amounts up to `type(uint256).max` against the invariant: "for any non-zero `amount`, the returned price must also be non-zero and must yield `amount` tokens when paid to `buyTRU()`." An overflow would surface immediately.

## 5. Sources

1. CertiK incident analysis: https://www.certik.com/resources/blog/truebit-incident-analysis (amount stated as ~$26.6M, 8,535 ETH)
2. DeFiHackLabs exploit reproduction: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-01/Truebit_exp.sol (test case, addresses, attack flow)
3. DefiLlama hacks database: https://api.llama.fi/hacks (amount stated as $26,400,000)
4. Attacker address: https://etherscan.io/address/0x6C8EC8f14bE7C01672d31CFa5f2CEfeAB2562b50
5. Vulnerable contract: https://etherscan.io/address/0x764C64b2A09b09Acb100B80d8c505Aa6a0302EF2
6. Attack transaction: https://etherscan.io/tx/0xcd4755645595094a8ab984d0db7e3b4aabde72a5c87c4f176a030629c47fb014

Note: DefiLlama records $26.4M while CertiK states ~$26.6M; the difference is attributable to ETH price variation at the time of reporting. No dedicated rekt.news post-mortem was found for this incident.