TronBank's invest() function did not validate that msg.tokenId was the legitimate BTT token, allowing attackers to use counterfeit tokens and artificially inflate their BTT balance. Nearly 200M counterfeit BTTs were minted.

Tron Dapp TronBank was attacked by Fake token attack at 1 am, about 170 million BTT were stolen in 1 hour (worth about 850,000 yuan). Monitoring showed that the hacker created a fake token BTTx to initiate the "invest" function to the contract, and the contract did not determine whether the sender's token id was consistent with the BTT real token id1002000.