{"investigation":{"slug":"fusion-by-ipor","entity_name":"Fusion by IPOR","trust_score":42,"severity_base":null,"score_modifier":-10,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Fusion by IPOR is a modular on-chain vault infrastructure product developed by IPOR Labs AG (Zug, Switzerland), designed to automate DeFi yield strategies across multiple chains without requiring Solidity expertise. On January 6, 2026, a legacy Fusion Optimizer Vault on Arbitrum was exploited for $336,000 USDC via a combination of missing fuse validation in the instantWithdraw method and an EIP-7702 delegation vulnerability on an administrator account. The IPOR DAO committed to fully compensating all affected depositors from treasury reserves, and the incident was flagged by blockchain investigator ZachXBT.","sections":[{"content":"Fusion by IPOR is the primary product of IPOR Labs AG, a company incorporated in Zug, Switzerland in June 2021 by co-founders Darren Camas and Dimitar Dinev. The protocol describes itself as a 'meta DeFi aggregation, execution, and intelligence engine' that enables digital asset managers to deploy composable yield strategies without writing Solidity. Fusion vaults are ERC-4626 compliant and use a modular 'fuse' system — logic modules that execute within the vault context — to route liquidity across DeFi protocols such as Aave, Compound, and others. The protocol operates on multiple chains including Ethereum, Arbitrum, and Base. As of mid-2025, Fusion reported approximately $11.7 million in total value locked (TVL) and $60 million in total value managed (TVM) when accounting for leveraged looping positions. IPOR Labs has raised $5.55 million across three funding rounds at an approximate average valuation of $46 million. Fusion is the successor product to IPOR Protocol, which also offers interest rate derivatives and generated approximately $4.7 billion in lifetime derivatives volume. In early 2025, governance proposal IIP-35 approved a rebranding of the native IPOR token to FUSN at a 1:1 ratio, with a snapshot taken on May 9, 2025 at Ethereum block 22446433.","heading":"Protocol Overview","sources":[{"url":"https://ipor.io/","name":"ipor.io","type":"other","credibility":3},{"url":"https://blog.impossible.finance/ipor-fusion-research-report/","name":"blog.impossible.finance","type":"other","credibility":3},{"url":"https://docs.ipor.io/ipor-faq/fusn-snapshot-22446433","name":"docs.ipor.io","type":"other","credibility":3},{"url":"https://www.moneyhouse.ch/en/company/ipor-labs-ag-4046606191","name":"moneyhouse.ch","type":"other","credibility":3},{"url":"https://www.ipor.io/ipor-labs-team","name":"ipor.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 6, 2026, a legacy IPOR USDC Fusion Optimizer Vault deployed on the Arbitrum network was exploited, resulting in a confirmed loss of approximately $336,000 USDC. The IPOR team was alerted by security monitoring firms Hexagate and Blockaid, who identified the malicious transaction. The exploit combined two distinct vulnerabilities. First, the affected vault — deployed approximately 490 days prior to the incident — contained a missing validation check in its instantWithdraw method, which failed to authenticate 'fuses' (modular logic components) before executing them. This allowed unauthorized fuses to execute arbitrary code within the vault context. Second, an administrator account for the vault had utilized EIP-7702, a delegation mechanism introduced as part of Ethereum's Pectra upgrade, to delegate execution to a contract that permitted arbitrary external calls. An attacker exploited this delegation setup to hijack the administrator's identity, deploy a malicious fuse contract seconds before the withdrawal, and redirect vault assets to an external wallet (partially identified as address prefix 0x9b1b). The stolen assets were subsequently bridged from Arbitrum to Ethereum and deposited into Tornado Cash for obfuscation. IPOR confirmed that only a small subset of legacy vaults predating stricter fuse validation requirements were affected. Newer Fusion vaults require explicit authorization and validation for any fuse execution and were not impacted. Blockchain investigator ZachXBT flagged the incident in connection with the entity. Security firm SEAL was engaged to assist in forensic tracking and potential fund recovery efforts.","heading":"January 2026 Exploit — EIP-7702 PlasmaVault Drain","sources":[{"url":"https://x.com/ipor_io/status/2008728627190321480","name":"x.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/ipor-labs-loses-336k-arbitrum-130853308.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://www.coingabbar.com/en/crypto-currency-news/ipor-fusion-vault-hack-arbitrum-full-depositor-refund-confirmed","name":"coingabbar.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/security-flaw-in-ipors-fusion-allows-exploit-of-plasma-vault-51824","name":"phemex.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the January 6, 2026 exploit, IPOR DAO publicly confirmed it would fully compensate all depositors affected by the vault drain using funds from the DAO treasury. The protocol stated that the $336,000 loss represented less than 1% of the total funds secured across the Fusion platform, and that no other vaults were impacted. IPOR engaged security firms Hexagate, Blockaid, and SEAL to monitor the attacker's address and pursue forensic recovery options, including potential coordination with centralized exchanges to flag the stolen funds. IPOR committed to publishing a detailed post-mortem report covering the root cause, exploit mechanics, and remediation steps being implemented across the platform. The affected legacy vault was identified as lacking the stricter validation controls that had been applied to all subsequent vault deployments. The incident response, while reactive rather than preventive, was broadly seen by industry observers as responsible: full user compensation was pledged promptly, communication was transparent, and the scope was contained.","heading":"Incident Response and User Compensation","sources":[{"url":"https://x.com/ipor_io/status/2008728627190321480","name":"x.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://www.hokanews.com/2026/01/ipor-fusion-vault-attacked-in-arbitrum.html","name":"hokanews.com","type":"other","credibility":3},{"url":"https://www.coingabbar.com/en/crypto-currency-news/ipor-fusion-vault-hack-arbitrum-full-depositor-refund-confirmed","name":"coingabbar.com","type":"other","credibility":3}],"severity":"medium"},{"content":"IPOR Labs states that its smart contracts undergo rigorous audits prior to new product and feature releases. The protocol reports having completed more than ten security audits with firms including Ackee Blockchain, Blocsec, Protofire, and Zokyo. In 2023, Ackee Blockchain conducted a 59 engineering-day review of the IPOR Protocol core, identifying 39 findings ranging from informational to critical severity. Ackee noted high overall code quality and comprehensive documentation. Fusion vaults are designed using OpenZeppelin's Access Manager standard and the ERC-4626 vault standard, and the team advertises that the modular fuse isolation architecture prevents cascading failures across vaults. The protocol also partnered with Immunefi for a bug bounty program with no KYC requirements for payouts. However, the January 2026 exploit demonstrated that audit coverage and modular design did not prevent an unpatched legacy vault from being drained. The vulnerability in the instantWithdraw function had not been identified despite multiple prior audits, and the EIP-7702 delegation risk had not been mitigated on older administrator accounts. The protocol's own post-incident statements acknowledged that the exploited vault predated stricter validation policies, raising questions about legacy code retirement and ongoing maintenance practices.","heading":"Security Posture and Audit History","sources":[{"url":"https://ackee.xyz/blog/ipor-protocol-core-audit-summary/","name":"ackee.xyz","type":"other","credibility":3},{"url":"https://blog.impossible.finance/ipor-fusion-research-report/","name":"blog.impossible.finance","type":"other","credibility":3},{"url":"https://github.com/IPOR-Labs/ipor-audit-reports","name":"github.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"IPOR Labs issued 100 million IPOR tokens at inception, with no additional minting or burning capability. The token distribution allocates 30% to the DAO treasury, with remaining allocations to builders, investors, and ecosystem participants. Governance is conducted through Power IPOR (pwIPOR) tokens, which are exchangeable with IPOR at a 1:1 ratio and required for DAO voting. In April 2025, IPOR DAO passed governance proposal IIP-35, which approved a strategic rebranding of the protocol to 'Fusion' and a migration of the IPOR token to a new token named FUSN at a 1:1 ratio. The proposal also included plans to raise additional capital via a SAFT agreement and transition the existing IPOR DAO to a new Fusion DAO. A snapshot for the token migration was taken on May 9, 2025 at Ethereum block 22446433. The FUSN token launch date remained contingent on protocol traction and market conditions as of the snapshot date. The token migration and rebranding have been interpreted by some observers as an attempt to rebuild momentum and attract new institutional capital after the protocol's TVL growth underperformed earlier projections.","heading":"Token and Governance","sources":[{"url":"https://docs.ipor.io/tokenomics/ipor-token","name":"docs.ipor.io","type":"other","credibility":3},{"url":"https://docs.ipor.io/ipor-faq/fusn-snapshot-22446433","name":"docs.ipor.io","type":"other","credibility":3},{"url":"https://x.com/ipor_io/status/1912460801815765372","name":"x.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/ipor/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://blog.impossible.finance/ipor-fusion-research-report/","name":"blog.impossible.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"Several risk factors are relevant to evaluating Fusion by IPOR as of mid-2026. First, the January 2026 exploit demonstrated that the protocol's legacy vault management processes were insufficient to proactively identify and remediate an unpatched contract that had been live for approximately 490 days. The fact that this vulnerability persisted across multiple audit cycles raises questions about the thoroughness of ongoing security reviews versus only reviewing new deployments. Second, stolen funds (approximately $267,000 of the $336,000 total) were routed through Tornado Cash, complicating recovery. No confirmed fund recovery had been publicly reported at the time of this investigation. Third, ZachXBT's flag of this entity adds reputational context, though the nature and specific basis of the flag (beyond the exploit itself) is not independently detailed in available public sources. Fourth, the IIP-35 token migration from IPOR to FUSN, combined with a new SAFT capital raise, represents a significant protocol reset that introduces uncertainty for existing token holders and may signal that prior growth targets were not met. Fifth, Fusion's TVL of approximately $12-24 million (figures vary across reporting periods) remains modest relative to the protocol's infrastructure maturity claims and competitive positioning. The protocol's 20+ pipeline integrations, as described in research coverage, had not yet launched as of mid-2025 reporting, representing speculative future value.","heading":"Risk Factors and Ongoing Concerns","sources":[{"url":"https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://blog.impossible.finance/ipor-fusion-research-report/","name":"blog.impossible.finance","type":"other","credibility":3},{"url":"https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://x.com/ipor_io/status/1912460801815765372","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Fusion by IPOR competes in the on-chain asset management and yield aggregation space alongside protocols such as Yearn Finance, Pendle, and Spectra. The protocol's primary differentiators include its Python-based SDK (ipor-fusion), which eliminates Solidity expertise requirements for vault managers, and an off-chain alpha execution layer that allows strategy operators to protect proprietary yield strategies while maintaining on-chain guardrails. Fusion's modular fuse architecture is also positioned as more flexible than monolithic vault designs. The protocol's lifetime derivatives volume of approximately $4.7 billion (as reported in mid-2025) reflects meaningful usage of the IPOR interest rate derivatives product, which predates Fusion. IPOR Labs is backed by SOSV and had raised approximately $5.55 million at an average valuation of approximately $46 million. The company operates a team of approximately 12 employees from its Zug, Switzerland headquarters. The protocol's documentation, code quality, and multi-audit history reflect a technically mature team, though the January 2026 security incident has introduced lasting reputational and operational questions.","heading":"Competitive Landscape and Protocol Context","sources":[{"url":"https://blog.impossible.finance/ipor-fusion-research-report/","name":"blog.impossible.finance","type":"other","credibility":3},{"url":"https://sosv.com/company/ipor-labs/","name":"sosv.com","type":"other","credibility":3},{"url":"https://www.cbinsights.com/company/ipor","name":"cbinsights.com","type":"other","credibility":3},{"url":"https://github.com/IPOR-Labs/ipor-fusion","name":"github.com","type":"other","credibility":3},{"url":"https://pypi.org/project/ipor-fusion/","name":"pypi.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-06-14","event":"IPOR Labs AG incorporated in Zug, Switzerland by co-founders Darren Camas and Dimitar Dinev.","source":""},{"date":"2023-07-28","event":"Ackee Blockchain completes 59 engineering-day security review of IPOR Protocol core, identifying 39 findings. Review concludes with high code quality rating.","source":""},{"date":"2024","event":"Legacy Fusion Optimizer Vault deployed on Arbitrum (approximately 490 days before the January 2026 exploit), predating stricter fuse validation requirements.","source":"","date_original":"2024-01-01"},{"date":"2025-05-09","event":"Governance proposal IIP-35 snapshot taken at Ethereum block 22446433 for IPOR-to-FUSN token migration at 1:1 ratio, marking a strategic rebranding of the protocol.","source":""},{"date":"2026-01-06","event":"Legacy Fusion USDC Optimizer Vault on Arbitrum exploited for $336,000 USDC via missing instantWithdraw validation and EIP-7702 admin delegation flaw. Hexagate and Blockaid alert the IPOR team. Stolen funds (approx. $267K) bridged to Ethereum and deposited into Tornado Cash.","source":""},{"date":"2026-01-07","event":"IPOR DAO publicly confirms full compensation of all affected depositors from DAO treasury. Protocol engages SEAL for forensic recovery. Post-mortem publication committed. Incident widely covered by crypto media.","source":""}],"sources_used":[{"url":"https://ipor.io/","name":"ipor.io","type":"other","archive_url":"http://web.archive.org/web/20260715042143/https://ipor.io/","credibility":3,"archive_timestamp":"2026-07-15T04:21:43+00:00"},{"url":"https://blog.impossible.finance/ipor-fusion-research-report/","name":"blog.impossible.finance","type":"other","archive_url":"http://web.archive.org/web/20260217170404/https://blog.impossible.finance/ipor-fusion-research-report/","credibility":3,"archive_timestamp":"2026-02-17T17:04:04+00:00"},{"url":"https://docs.ipor.io/ipor-faq/fusn-snapshot-22446433","name":"docs.ipor.io","type":"other","archive_url":"http://web.archive.org/web/20260109065849/https://docs.ipor.io/ipor-faq/fusn-snapshot-22446433","credibility":3,"archive_timestamp":"2026-01-09T06:58:49+00:00"},{"url":"https://www.moneyhouse.ch/en/company/ipor-labs-ag-4046606191","name":"moneyhouse.ch","type":"other","archive_url":"https://web.archive.org/web/20260829051329/https://www.moneyhouse.ch/en/company/ipor-labs-ag-4046606191","credibility":3,"archive_timestamp":"2026-08-29T05:13:29+00:00"},{"url":"https://www.ipor.io/ipor-labs-team","name":"ipor.io","type":"other","archive_url":"http://web.archive.org/web/20260109183134/https://www.ipor.io/ipor-labs-team","credibility":3,"archive_timestamp":"2026-01-09T18:31:34+00:00"},{"url":"https://x.com/ipor_io/status/2008728627190321480","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20260107171503/https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","credibility":3,"archive_timestamp":"2026-01-07T17:15:03+00:00"},{"url":"https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","name":"cryptonews.com","type":"other","archive_url":"http://web.archive.org/web/20260107132617/https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","credibility":3,"archive_timestamp":"2026-01-07T13:26:17+00:00"},{"url":"https://finance.yahoo.com/news/ipor-labs-loses-336k-arbitrum-130853308.html","name":"finance.yahoo.com","type":"other","archive_url":"http://web.archive.org/web/20260109025356/https://finance.yahoo.com/news/ipor-labs-loses-336k-arbitrum-130853308.html","credibility":3,"archive_timestamp":"2026-01-09T02:53:56+00:00"},{"url":"https://www.coingabbar.com/en/crypto-currency-news/ipor-fusion-vault-hack-arbitrum-full-depositor-refund-confirmed","name":"coingabbar.com","type":"other","archive_url":"http://web.archive.org/web/20260108202142/https://www.coingabbar.com/en/crypto-currency-news/ipor-fusion-vault-hack-arbitrum-full-depositor-refund-confirmed","credibility":3,"archive_timestamp":"2026-01-08T20:21:42+00:00"},{"url":"https://phemex.com/news/article/security-flaw-in-ipors-fusion-allows-exploit-of-plasma-vault-51824","name":"phemex.com","type":"other","archive_url":"https://web.archive.org/web/20260829230537/https://phemex.com/news/article/security-flaw-in-ipors-fusion-allows-exploit-of-plasma-vault-51824","credibility":3,"archive_timestamp":"2026-08-29T23:05:37+00:00"},{"url":"https://www.hokanews.com/2026/01/ipor-fusion-vault-attacked-in-arbitrum.html","name":"hokanews.com","type":"other","archive_url":"http://web.archive.org/web/20260107193947/https://www.hokanews.com/2026/01/ipor-fusion-vault-attacked-in-arbitrum.html","credibility":3,"archive_timestamp":"2026-01-07T19:39:47+00:00"},{"url":"https://ackee.xyz/blog/ipor-protocol-core-audit-summary/","name":"ackee.xyz","type":"other","archive_url":"https://web.archive.org/web/20260829072809/https://ackee.xyz/blog/ipor-protocol-core-audit-summary/","credibility":3,"archive_timestamp":"2026-08-29T07:28:09+00:00"},{"url":"https://github.com/IPOR-Labs/ipor-audit-reports","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260804131808/https://github.com/IPOR-Labs/ipor-audit-reports","credibility":3,"archive_timestamp":"2026-08-04T13:18:08+00:00"},{"url":"https://docs.ipor.io/tokenomics/ipor-token","name":"docs.ipor.io","type":"other","archive_url":"http://web.archive.org/web/20260418034712/https://docs.ipor.io/tokenomics/ipor-token","credibility":3,"archive_timestamp":"2026-04-18T03:47:12+00:00"},{"url":"https://x.com/ipor_io/status/1912460801815765372","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/ipor/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20251216155305/https://coinmarketcap.com/currencies/ipor/","credibility":3,"archive_timestamp":"2025-12-16T15:53:05+00:00"},{"url":"https://sosv.com/company/ipor-labs/","name":"sosv.com","type":"other","archive_url":"http://web.archive.org/web/20260413015542/https://sosv.com/company/ipor-labs/","credibility":3,"archive_timestamp":"2026-04-13T01:55:42+00:00"},{"url":"https://www.cbinsights.com/company/ipor","name":"cbinsights.com","type":"other","archive_url":"http://web.archive.org/web/20260829084203/https://www.cbinsights.com/company/ipor","credibility":3,"archive_timestamp":"2026-08-29T08:42:03+00:00"},{"url":"https://github.com/IPOR-Labs/ipor-fusion","name":"github.com","type":"other","archive_url":"https://web.archive.org/web/20260829033225/https://github.com/IPOR-Labs/ipor-fusion","credibility":3,"archive_timestamp":"2026-08-29T03:32:25+00:00"},{"url":"https://pypi.org/project/ipor-fusion/","name":"pypi.org","type":"other","archive_url":"http://web.archive.org/web/20260829040748/https://pypi.org/project/ipor-fusion/","credibility":3,"archive_timestamp":"2026-08-29T04:07:48+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:14.220532+00:00","updated_at":"2026-08-29T23:26:10.591926+00:00"}}