SlowMist warned that two attackers on BSC have replicated a vulnerability pattern associated with Notional Finance and have already created malicious fCash positions, setting up a potential exploit that has not yet been fully executed.

According to SlowMist, the attackers have completed preliminary preparations and used the same vulnerability pattern to create malicious fCash positions on BSC. The security firm said the attack sequence is not complete yet because the positions are still awaiting expiration.

SlowMist said the risk comes after expiration, when the attackers may be able to settle the positions and withdraw assets from the affected protocol. The warning did not name the targeted project or disclose the size of any potential loss. It also did not provide a public expiration time for the positions.

The alert matters because it is a pre-execution warning rather than a post-incident report. That leaves room for defensive action, but it also means the final outcome remains uncertain until the positions either expire and are settled or the affected systems are patched and secured.

SlowMist urged affected projects to take immediate mitigation measures before the positions expire. With limited public technical detail so far, the focus is on whether protocols using similar accounting or settlement mechanics can identify exposure and close it before attackers reach the withdrawal stage.

Why It Matters

This is the kind of security event that can test how quickly DeFi projects respond when exploit preparation is visible on-chain before funds are removed. For users and operators, the issue is not only the possible loss itself but whether protocols have effective controls to pause, patch, or isolate risk during the narrow period between detection and execution.

The warning also highlights a broader structural issue in crypto security: once an exploit method is known, it can be adapted to other environments that share similar contract design or settlement logic. That can turn a single vulnerability pattern into a wider cross-protocol risk, especially on chains with active DeFi deployment.