Futureswap Contract on Arbitrum Faces Reentrancy Attack

According to Foresight News, BlockSec Phalcon has reported that the Futureswap contract on Arbitrum has been attacked again, resulting in an estimated loss of approximately $74,000. Although the financial impact is relatively minor, the incident has highlighted a new vulnerability: a reentrancy flaw. The attacker exploited this flaw through a two-step process involving a three-day cooling period to steal funds from the protocol. In the first step, during the minting phase, the attacker took advantage of the reentrancy vulnerability by re-entering the 0x5308fcb1 function before the contract could update its internal records. This allowed the attacker to mint a large number of LP tokens disproportionate to the actual assets deposited. In the second step, after the mandatory three-day withdrawal cooling period, the attacker executed a withdrawal, burning the illegally minted LP tokens to redeem the underlying collateral. This effectively enabled the attacker to extract assets from the protocol and secure a profit.