TrustPad Hack

Reported loss $155K
BNB Chain
Other

What happened

On November 6, 2023, an attacker drained TPAD reward tokens from TrustPad's 1095-day IDO staking pool on BNB Smart Chain. The pool's receiveUpPool() function did not check who was calling it, so the attacker's contract could pose as an upstream pool, register deposits and control the lock start time. By cycling deposits and withdrawals, the attacker piled up pending rewards, converted them to stake and withdrew millions of TPAD, then sold them on PancakeSwap.

TrustPad put the loss at about $155,000 in TPAD liquidity, and the TPAD price collapsed. The team warned users not to trade, removed liquidity, secured the other staking contracts and later migrated holders to a new TPAD 2.0 token.

How it happened

  1. The attacker deployed a helper contract that implemented the callbacks the staking contract expects from a trusted pool, such as isLocked and depositLockStart.
  2. The helper called receiveUpPool() on LaunchpadLockableStaking. Because msg.sender was never verified, the call was accepted, and the attacker-supplied lock start made the deposit look already unlocked.
  3. The attacker repeatedly called receiveUpPool() and withdraw() in a loop, accruing pending rewards each cycle without keeping funds locked.
  4. stakePendingRewards() converted the accumulated rewards into staked balance, and a final withdraw() pulled out the inflated TPAD amount.
  5. The attacker sold the TPAD on PancakeSwap and later moved proceeds to Tornado Cash.

Protocol details

Classification Other / Access Control
Protocol Type Exploit/Other
Affected asset / contract TPAD
Implementation language Solidity
Protocol links Website @TrustPad

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
Arbitrum Predy finance $464K lost Ethereum MEV Bot $2.0M lost BNB Chain BiSwap $865K lost BNB Chain SNOOKER $198K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes