Trail of Blocks

The @futureswapx' contract on #Arbitrum, which we reported was attacked four days ago, was exploited again, with an estimated loss of about $74K. While the loss is not large, the interesting part is that a new attack surface appeared: a reentrancy vulnerability. Specifically, the attacker leveraged a two-step process involving a 3-day cooldown period to siphon funds from the protocol. Step 1: Minting phase (3 days ago) In Tx1, the attacker exploited a reentrancy bug during liquidity provision. By re-entering the 0x5308fcb1 function before the contract updated its internal accounting, the attacker minted an excessive amount of LP tokens relative to the assets actually deposited. Tx 1 (exploit): app.blocksec.com/explorer/tx… Step 2: Withdrawal phase (after cooldown) After waiting out the mandatory 3-day withdrawal cooldown, the attacker executed Tx2. They burned the illicitly minted LP tokens to redeem the underlying collateral, effectively siphoning assets from the protocol and realizing the profit. Tx 2 (profit realization): app.blocksec.com/explorer/tx…