futureswap

The blockchain security agency BlockSec stated that the FutureSwap protocol deployed on Arbitrum was attacked again by hackers exploiting a reentrancy vulnerability, just four days after its first attack, resulting in a loss of approximately $74,000.The attacker first over-minted LP tokens using the reentrancy function 0x5308fcb1 three days ago, and after the cooldown period ended, redeemed the excess collateral to realize profits.

According to BlockSec monitoring, a suspicious transaction occurred on the Arbitrum chain involving the FutureSwapX contract, with an estimated loss of approximately $395,000.BlockSec stated that they have attempted to contact the team but have not yet received a response. It appears that the attacker stole funds through multiple changePosition operations, ultimately withdrawing USDC. Since the contract is not open source, the exact root cause still requires further investigation. Based on on-chain behavior, it is suspected that this incident may be related to unexpected fluctuations in stable balances during early position updates, which led to the release of USDC when positions were reduced or closed.

Slow Fog posted on platform X that potential suspicious activity related to Futureswap has been detected. The root cause is that an attacker created a malicious proposal and used a flash loan to vote, ultimately granting the attack contract permission to transfer tokens from other users. Please remain vigilant.