Thetanuts Finance suffered a loss of $2.1 million due to an attack, with about $2 million suspected to have been recovered by white-hat hackers.

According to ChainCatcher, and monitored by SlowMist, the DeFi protocol Thetanuts Finance was attacked, resulting in a loss of approximately 2.1 million US dollars. However, about 2 million US dollars worth of positions seem to have been recovered by a white-hat hacker. The vulnerability was caused by integer division truncation in the mint function: After the claim function depleted the total supply of the vault to nearly zero, the amount parameter in the depositAmount calculation formula made the result zero, which allowed unlimited free minting. In response, Thetanuts Finance stated that preliminary investigations indicate the attack targeted a long-abandoned vault that had been migrated years ago, and has no connection with current contracts or products. The team will publish a post-incident analysis report after obtaining more details.