Transaction browser Phalcon posted on the X platform that TrustPad was attacked due to several design flaws in the staking logic, namely manipulating the locking period through untrusted external calls to obtain pending rewards. In the receiveUpPool function of the LaunchpadLockableStake contract, if the account is not locked, the depositLockStart time will be set. The attacker then manipulates it into making immediate deposits (via the receiveUpPool function) and withdrawals to accumulate pending rewards.
Additionally, another function, stakePendingRewards, allows an attacker to convert accumulated pending rewards into staking amounts, allowing the attacker to withdraw staking rewards in the form of TPAD tokens in future transactions and sell the tokens for a profit.