An attacker exploited an unchecked uint128 cast in Notional V1’s collateral valuation logic. By minting two fCash positions against the same payer with notionals of 1 and 2^128-1, the attacker engineered a debt balance of exactly 2^128. When the free-collateral check converted the debt to ETH, uint128(balance.abs()) truncated 2^128 to zero, making the insolvent payer appear to have no debt. The attacker then settled the fabricated fCash claims and withdrew approximately $1.73M in USDC and DAI from the Escrow