{"investigation":{"slug":"futureswap","entity_name":"FutureSwap","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Futureswap is a decentralized perpetual futures exchange built on Arbitrum and Avalanche that raised $12 million in 2021 but has been effectively dormant since 2023. The protocol suffered three separate exploits between December 2025 and January 2026, resulting in cumulative losses exceeding $1.3 million, while the team made no public response to any incident. ZachXBT flagged the entity as a risk, and the protocol's last known audit dates to 2021.","sections":[{"content":"Futureswap is an automated market maker (AMM)-based decentralized perpetual futures exchange that allows traders to open leveraged positions of up to 30x on cryptocurrency pairs. The protocol launched its first version in 2020, followed by V2 in 2021 and V4 in early 2022 on Arbitrum, a Layer-2 Ethereum scaling network. In April 2022, Futureswap expanded to Avalanche with Trader Joe as its underlying AMM. The protocol integrates Chainlink price feeds for live oracle pricing and routes liquidity through Uniswap V3 pools rather than maintaining separate liquidity pools. Governance is conducted on-chain through the FST (Futureswap Token), a non-transferable token distributed weekly to traders, liquidity providers, and referrers. Submitting a governance proposal requires locking 100 FST for the duration of a 48-hour vote window. The protocol was audited by OpenZeppelin and Trail of Bits prior to its V2 release in January 2021. As of early 2026, Futureswap's total value locked (TVL) on DefiLlama stands at approximately $11, annualized fees are $0, and the FST token market cap is approximately $6,900, indicating the protocol is functionally inactive.","heading":"Protocol Overview","sources":[{"url":"https://defipulse.com/blog/futureswap-v2/","name":"defipulse.com","type":"other","credibility":3},{"url":"https://medium.com/futureswap/announcing-futureswap-v2-on-chain-perpetuals-with-live-pricing-e6a440939033","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/futureswap/launching-futureswap-v4-1-on-avalanche-fa5a24de093a","name":"medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/futureswap","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In March 2020, Framework Ventures made an initial $400,000 investment in Futureswap. On October 11, 2021, CoinDesk reported that Futureswap closed a $12 million funding round led by Framework Ventures, with participation from Ribbit Capital, Placeholder.vc, and True Ventures. The raise coincided with the announcement of Futureswap V4, which introduced AMM-based perpetuals with up to 30x leverage on Arbitrum. Co-founder and CEO Derek Alia described the V4 architecture as capable of exceeding dYdX trading volumes by leveraging the existing DeFi ecosystem liquidity. No further funding rounds have been publicly disclosed since October 2021.","heading":"Funding and Investors","sources":[{"url":"https://www.coindesk.com/tech/2021/10/11/defi-perpetuals-exchange-futureswap-launches-new-version-after-12m-raise","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.crowdfundinsider.com/2020/03/158602-framework-ventures-invests-400000-in-futureswap-a-decentralized-futures-exchange-and-500000-in-commonwealth-labs/","name":"crowdfundinsider.com","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/futureswap","name":"crunchbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Futureswap's V2 contracts were audited by OpenZeppelin Security over four weeks, with an audit report published on January 3, 2021. The audit identified no critical vulnerabilities but surfaced three high-severity issues: frontrunning of instant withdrawals, incorrect liquidity reward calculations, and a MessageProcessor frontrunning vulnerability that allowed attackers to intercept transactions and claim sender rewards. Eight medium-severity issues were also identified. The audit noted the system's reliance on oracle honesty and key security as material trust assumptions. Futureswap is also reported to have engaged Trail of Bits for code review of the V2 contracts. No public audit has been identified for V4 contracts deployed on Arbitrum in early 2022 or for the Avalanche V4.1 deployment. The protocol's last audit is reported to date from 2021. The absence of updated audits for deployed V4 contracts represents a significant gap that preceded the 2025-2026 exploits.","heading":"Security Audits and Known Vulnerabilities","sources":[{"url":"https://www.openzeppelin.com/news/futureswap-v2-audit","name":"openzeppelin.com","type":"other","credibility":3},{"url":"https://defipulse.com/blog/futureswap-v2/","name":"defipulse.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Futureswap suffered three separate exploit incidents over approximately one month, resulting in alleged cumulative losses exceeding $1.3 million. The first incident occurred in December 2025, when an attacker exploited a governance vulnerability in the FST token's snapshot mechanism. The attacker allegedly borrowed approximately 3.6 million FST tokens via flash loan, temporarily inflating their voting power sufficiently to pass a malicious governance proposal that transferred funds from the protocol treasury. Reported losses from this governance attack are approximately $830,000. The second incident was reported on January 10, 2026, when blockchain security firm BlockSec flagged an alleged exploit draining approximately $395,000 in USDC from the Arbitrum-deployed V4 contracts. BlockSec's analysis stated that the incident 'may be related to unexpected stableBalance accounting changes during earlier position updates, which later allowed USDC to be released when removing collateral.' The attacker used Aave V3 flash loans requesting 500 billion USDC units to execute a sequence of changePosition operations. BlockSec stated it attempted to contact the Futureswap team but received no response. A third incident occurred on January 14, 2026, when an attacker exploited a reentrancy vulnerability in a contract that had already been targeted four days prior. The attacker called function 0x5308fcb1 to re-enter the contract, artificially inflated LP token balances, and then waited out a mandatory three-day cooldown period before redeeming the inflated tokens for approximately $74,000 in collateral. BlockSec noted this represented a 'new attack surface' on the same contract. The protocol's contract code is reportedly not open-sourced, which hampered independent root cause analysis.","heading":"Exploit Incidents (December 2025 — January 2026)","sources":[{"url":"https://bitcoinethereumnews.com/finance/arbitrum-based-futureswap-loses-400k-in-suspected-hack/","name":"bitcoinethereumnews.com","type":"other","credibility":3},{"url":"https://letstalkbitco.in/futureswap-hacked-again-74000-lost-in-reentrancy-exploit-defi-risks-exposed/","name":"letstalkbitco.in","type":"other","credibility":3},{"url":"https://blockchainreporter.net/futureswap-exploit-drains-395k-in-usdc-on-arbitrum","name":"blockchainreporter.net","type":"other","credibility":3},{"url":"https://www.mexc.co/news/477110","name":"mexc.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Futureswap's official X (formerly Twitter) account last posted in 2022 or 2023, with multiple reporting sources noting the team has made no public communications in the period since. No team statement has been issued in response to any of the three exploits that occurred between December 2025 and January 2026. BlockSec's disclosure noted it could not reach the team following the January 10, 2026 exploit. As of early 2026, DefiLlama reports Futureswap's TVL at approximately $11, with $0 in annualized fees and $370 in cumulative lifetime fees, indicating the protocol is not generating economic activity. The FST governance token trades at approximately $0.0002, down from an all-time high of $22.66. The combination of team silence, absence of post-2021 security audits, closed-source contracts, and near-zero TVL indicates the protocol meets the characteristics of an abandoned DeFi deployment that continues to hold some user assets without active maintenance.","heading":"Protocol Abandonment and Team Silence","sources":[{"url":"https://bitcoinethereumnews.com/finance/arbitrum-based-futureswap-loses-400k-in-suspected-hack/","name":"bitcoinethereumnews.com","type":"other","credibility":3},{"url":"https://letstalkbitco.in/futureswap-hacked-again-74000-lost-in-reentrancy-exploit-defi-risks-exposed/","name":"letstalkbitco.in","type":"other","credibility":3},{"url":"https://defillama.com/protocol/futureswap","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, an independent on-chain investigator with a documented track record of flagging compromised and fraudulent crypto entities, flagged Futureswap as a risk entity. The specific details and date of the ZachXBT flag have not been independently verified via a primary source in available search results. The protocol's repeated exploitation, team silence, and abandonment profile are consistent with entities that community-level investigators identify as elevated risk. Users with outstanding positions or stored assets in Futureswap contracts should be aware that the protocol has no active development team responding to vulnerabilities as of the time of this investigation.","heading":"ZachXBT Flag and Community Risk Signals","sources":[{"url":"https://bitcoinethereumnews.com/finance/arbitrum-based-futureswap-loses-400k-in-suspected-hack/","name":"bitcoinethereumnews.com","type":"other","credibility":3},{"url":"https://letstalkbitco.in/futureswap-hacked-again-74000-lost-in-reentrancy-exploit-defi-risks-exposed/","name":"letstalkbitco.in","type":"other","credibility":3}],"severity":"medium"},{"content":"The December 2025 governance attack highlights a structural vulnerability in Futureswap's on-chain governance design. The FST token's snapshot mechanism, which determines voting power at a fixed block height, was alleged to have been exploitable via flash loan in a single transaction block. The attacker borrowed approximately 3.6 million FST tokens, captured a governance snapshot at that inflated balance, and used the resulting voting power to pass a malicious proposal. The 48-hour vote window and 100 FST proposal lockup requirement, which were intended as spam prevention, did not prevent the flash loan attack because the voting power snapshot was taken before those mechanisms could provide meaningful deterrence. This attack vector is documented in broader DeFi governance literature and is a known risk for protocols that do not implement time-weighted voting power or lockup periods extending beyond a single block.","heading":"Governance Mechanism Risk","sources":[{"url":"https://letstalkbitco.in/futureswap-hacked-again-74000-lost-in-reentrancy-exploit-defi-risks-exposed/","name":"letstalkbitco.in","type":"other","credibility":3},{"url":"https://blog.verichains.io/p/governance-attack-flashloan-vote","name":"blog.verichains.io","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-03","event":"Framework Ventures invests $400,000 in Futureswap, an early decentralized futures exchange.","source":"","date_original":"2020-03-01"},{"date":"2020","event":"Futureswap V1 launches on Ethereum mainnet offering perpetual futures with leveraged trading.","source":"","date_original":"2020-01-01"},{"date":"2021-01-03","event":"OpenZeppelin publishes Futureswap V2 audit report, identifying three high-severity and eight medium-severity issues; no critical issues found.","source":""},{"date":"2021-10-11","event":"Futureswap closes $12 million Series A funding round led by Framework Ventures, with Ribbit Capital, Placeholder.vc, and True Ventures participating. V4 announced simultaneously.","source":""},{"date":"2022","event":"Futureswap V4 mainnet beta launches on Arbitrum, offering up to 30x leverage via Uniswap V3 liquidity pools and Chainlink price feeds.","source":"","date_original":"2022-01-01"},{"date":"2022-04","event":"Futureswap V4.1 launches on Avalanche with Trader Joe as the underlying AMM, supporting JOE-USDC and AVAX-USDC pairs.","source":"","date_original":"2022-04-01"},{"date":"2023","event":"Futureswap's official X account posts its last known public update. Team communication effectively ceases.","source":"","date_original":"2023-01-01"},{"date":"2025-12-14","event":"Alleged governance attack exploits FST token snapshot mechanism via flash loan, allowing attacker to borrow approximately 3.6 million FST tokens and pass a malicious proposal. Estimated loss: $830,000.","source":""},{"date":"2026-01-10","event":"BlockSec flags a suspected exploit draining approximately $395,000 in USDC from Futureswap V4 contracts on Arbitrum. Exploit alleged to involve stableBalance accounting manipulation via flash loan and changePosition operations. BlockSec states it cannot reach the team.","source":""},{"date":"2026-01-14","event":"A second attacker exploits a reentrancy vulnerability in the same Futureswap V4 contract, minting inflated LP tokens and redeeming them after a three-day cooldown for approximately $74,000 in collateral.","source":""}],"sources_used":[{"url":"https://defipulse.com/blog/futureswap-v2/","name":"defipulse.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://medium.com/futureswap/announcing-futureswap-v2-on-chain-perpetuals-with-live-pricing-e6a440939033","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20251208101428/https://medium.com/futureswap/announcing-futureswap-v2-on-chain-perpetuals-with-live-pricing-e6a440939033","credibility":3,"archive_timestamp":"2025-12-08T10:14:28+00:00"},{"url":"https://medium.com/futureswap/launching-futureswap-v4-1-on-avalanche-fa5a24de093a","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/futureswap","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250912232502/https://defillama.com/protocol/futureswap","credibility":3,"archive_timestamp":"2025-09-12T23:25:02+00:00"},{"url":"https://www.coindesk.com/tech/2021/10/11/defi-perpetuals-exchange-futureswap-launches-new-version-after-12m-raise","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20250905120716/https://www.coindesk.com/tech/2021/10/11/defi-perpetuals-exchange-futureswap-launches-new-version-after-12m-raise","credibility":3,"archive_timestamp":"2025-09-05T12:07:16+00:00"},{"url":"https://www.crowdfundinsider.com/2020/03/158602-framework-ventures-invests-400000-in-futureswap-a-decentralized-futures-exchange-and-500000-in-commonwealth-labs/","name":"crowdfundinsider.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.crunchbase.com/organization/futureswap","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.openzeppelin.com/news/futureswap-v2-audit","name":"openzeppelin.com","type":"other","archive_url":"http://web.archive.org/web/20260222111941/https://www.openzeppelin.com/news/futureswap-v2-audit","credibility":3,"archive_timestamp":"2026-02-22T11:19:41+00:00"},{"url":"https://bitcoinethereumnews.com/finance/arbitrum-based-futureswap-loses-400k-in-suspected-hack/","name":"bitcoinethereumnews.com","type":"other","archive_url":"https://web.archive.org/web/20260829073234/https://bitcoinethereumnews.com/finance/arbitrum-based-futureswap-loses-400k-in-suspected-hack/","credibility":3,"archive_timestamp":"2026-08-29T07:32:34+00:00"},{"url":"https://letstalkbitco.in/futureswap-hacked-again-74000-lost-in-reentrancy-exploit-defi-risks-exposed/","name":"letstalkbitco.in","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://blockchainreporter.net/futureswap-exploit-drains-395k-in-usdc-on-arbitrum","name":"blockchainreporter.net","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.mexc.co/news/477110","name":"mexc.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.verichains.io/p/governance-attack-flashloan-vote","name":"blog.verichains.io","type":"other","archive_url":"http://web.archive.org/web/20260419214952/https://blog.verichains.io/p/governance-attack-flashloan-vote","credibility":3,"archive_timestamp":"2026-04-19T21:49:52+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:14.42931+00:00","updated_at":"2026-08-29T23:26:10.754186+00:00"}}