FutureSwap on Arbitrum suffers re-entrancy attack again, losing $74,000 in funds

【Blockchain Rhythm】The decentralized trading protocol FutureSwap on the Arbitrum chain has been attacked again. According to monitoring by security research institutions, the damage caused by this incident amounts to approximately $74,000.

This time, the attacker used a classic reentrancy vulnerability, but the execution was quite sophisticated—divided into two stages. First, three days ago, the attacker exploited a loophole when providing liquidity, using reentrant calls to mint far more LP tokens than normal. Then, they waited—an entire 3 days. This time gap was crucial, likely to bypass certain protective mechanisms or wait for on-chain state changes.

The second stage was the harvest—the attacker used these illegally minted LP tokens to burn and redeem, directly withdrawing the underlying collateral assets. From the protocol’s perspective, it had no idea how these LP tokens were generated and was simply drained of real assets.

This is not the first time FutureSwap has had security issues. Similar reentrancy vulnerabilities are actually common Achilles’ heels for DeFi protocols, and many projects have fallen victim to them. For users, this is also a reminder—no matter how tempting the yields from liquidity mining are, you must first check the protocol’s security audit reports.