Phalcon, a trading browser, claimed on social media X (formerly Twitter) that the TrustPad protocol was attacked due to several design flaws in the staking logic, namely manipulating the locking period through external calls from untrusted sources to obtain pending rewards. In the receiveUpPool function of the LaunchpadLockableStake contract, if an account is not locked, the depositLockStart time will be set. Then the attacker manipulates it to immediately deposit (through the receiveUpPool function) and withdraw to accumulate pending rewards. In addition, another function, stakePendingRewards, allows attackers to convert accumulated pending rewards into staked amounts, allowing them to extract staking rewards in the form of TPAD tokens in future transactions and sell tokens for profit.