Feb 2022 - FutureSwap Credential Disclosure - $798k (Global)
"The Future of Perpetuals Is Here. Leverage on any tokens with a protocol trusted with billions for its price execution, super low fees and reliability." "Take full control of your crypto. Built on Ethereum, our non-custodial perpetuals exchange focuses on one thing: being the best execution environment for trades."
"Futureswap is a decentralized non-custodial perpetual protocol where users can gain leveraged exposure on assets. Liquidity providers (LPs) deposit liquidity in order to earn passive income from trading fees and FST incentives. This liquidity is utilized by the Futureswap protocol and other automated market makers (AMMs) under the hood to create leveraged exposure. Realistically, Futureswap operates as a lending protocol as no leverage contracts are being created but only LPs lending funds while holding collateral."
"Take full advantage of everything Layer 2 has to offer. Say goodbye to eye-watering gas fees. Get your money in an instant with superfast withdrawals. Stay completely secure with optimistic rollups. Execute your trades instantly. Trade from any device. Gain leveraged exposure on limitless assets."
"We have all been in this industry too long not to make the security of your funds our absolute top priority. That’s why, so far, we’ve spent upwards of $450k on audits from Open Zeppelin and Trail of Bits, as well as code reviews from white hats."
"The credentials for [a FutureSwap] account were compromised by human error, and the attacker was able to gain access on Arbitrum and transfer the available reward FST to himself."
"Decentralized derivatives trading platform FutureSwap tweeted that an account with around 300,000 FST reward reserves (0.3% of supply) was compromised yesterday." "Last night, an account with access to a reserve of ~300,000 FST for rewards (0.3% of the supply) was compromised."
"We took action to remove control of the compromised FST by migrating the FST contract on Arbitrum." "Mainnet FST is unaffected. Arbitrum FST has been redeployed to the state before the withdrawal using a new contract." "Currently Arbitrum FST has used the new contract to take control of the compromised FST, the FST Arbitrum bridge is currently disabled and is scheduled to be restored within 24 to 48 hours."
"The new Arbitrum FST contract [has been deployed]. The old one is no longer valuable and should not be traded."
Further Analysis
FutureSwap is a decentralized exchange that operates on Arbitrum, a layer 2 solution to scale ethereum. One of the users who held over 300,000 FST (valued ~$798k USD) suffered an account breach and their funds were stolen. Details of the specific breach method were not located. The protocol apparently paused the smart contract, bringing their system offline for 24-48 hours, in order to restore the funds.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
Squiggles NFT Suspicious Launch Activity > > < < Dego Finance Key Compromised
Sources/Further Reading
SlowMist Hacked - SlowMist Zone (Jun 26)
Futureswap (Mar 12)
Futureswap Docs - Futureswap Docs (Mar 12)
https://coinmarketcap.com/currencies/futureswap/ (Mar 12)
@futureswapx Twitter (Mar 12)
@futureswapx Twitter (Mar 12)
Futureswap Token (FST) Token Tracker | Arbiscan (Mar 12)
Contract Address 0x488cc08935458403a0458e45e20c0159c8ab2c92 | Arbiscan (Mar 12)
https://coinmarketcap.com/currencies/futureswap/historical-data/ (Mar 12)
Futureswap price, FST chart, and market cap | CoinGecko (Mar 12)
Decentralized exchange Futureswap raises $12 million (Mar 12)
https://blog.insurace.io/security-incidents-in-february-9ba66f4bd0a3 (Mar 10)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|