Verify a decision

{"actor":"system:backfill","investigation_id":"610e5c95-082e-484a-843b-84925eef4194","kind":"publish","page_slug":"fusion-by-ipor","published_at":"2026-05-29T16:07:52.845Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Fusion by IPOR","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ipor.io/","type":"other","url":""},{"credibility":3,"name":"https://blog.impossible.finance/ipor-fusion-research-report/","type":"other","url":""},{"credibility":3,"name":"https://docs.ipor.io/ipor-faq/fusn-snapshot-22446433","type":"other","url":""},{"credibility":3,"name":"https://www.moneyhouse.ch/en/company/ipor-labs-ag-4046606191","type":"other","url":""},{"credibility":3,"name":"https://www.ipor.io/ipor-labs-team","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/ipor_io/status/2008728627190321480","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","type":"other","url":""},{"credibility":3,"name":"https://finance.yahoo.com/news/ipor-labs-loses-336k-arbitrum-130853308.html","type":"other","url":""},{"credibility":3,"name":"https://www.coingabbar.com/en/crypto-currency-news/ipor-fusion-vault-hack-arbitrum-full-depositor-refund-confirmed","type":"other","url":""},{"credibility":3,"name":"https://phemex.com/news/article/security-flaw-in-ipors-fusion-allows-exploit-of-plasma-vault-51824","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/ipor_io/status/2008728627190321480","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","type":"other","url":""},{"credibility":3,"name":"https://www.hokanews.com/2026/01/ipor-fusion-vault-attacked-in-arbitrum.html","type":"other","url":""},{"credibility":3,"name":"https://www.coingabbar.com/en/crypto-currency-news/ipor-fusion-vault-hack-arbitrum-full-depositor-refund-confirmed","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ackee.xyz/blog/ipor-protocol-core-audit-summary/","type":"other","url":""},{"credibility":3,"name":"https://blog.impossible.finance/ipor-fusion-research-report/","type":"other","url":""},{"credibility":3,"name":"https://github.com/IPOR-Labs/ipor-audit-reports","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.ipor.io/tokenomics/ipor-token","type":"other","url":""},{"credibility":3,"name":"https://docs.ipor.io/ipor-faq/fusn-snapshot-22446433","type":"other","url":""},{"credibility":3,"name":"https://x.com/ipor_io/status/1912460801815765372","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/ipor/","type":"other","url":""},{"credibility":3,"name":"https://blog.impossible.finance/ipor-fusion-research-report/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptotimes.io/2026/01/07/ipors-fusion-plasmavault-hit-by-336k-exploit-via-eip-7702-flaw/","type":"other","url":""},{"credibility":3,"name":"https://blog.impossible.finance/ipor-fusion-research-report/","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/ipor-labs-loses-336k-in-arbitrum-vault-exploit-vows-full-refund/","type":"other","url":""},{"credibility":3,"name":"https://x.com/ipor_io/status/1912460801815765372","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.impossible.finance/ipor-fusion-research-report/","type":"other","url":""},{"credibility":3,"name":"https://sosv.com/company/ipor-labs/","type":"other","url":""},{"credibility":3,"name":"https://www.cbinsights.com/company/ipor","type":"other","url":""},{"credibility":3,"name":"https://github.com/IPOR-Labs/ipor-fusion","type":"other","url":""},{"credibility":3,"name":"https://pypi.org/project/ipor-fusion/","type":"other","url":""}]}],"sources_used":[],"summary":"Fusion by IPOR is a modular on-chain vault infrastructure product developed by IPOR Labs AG (Zug, Switzerland), designed to automate DeFi yield strategies across multiple chains without requiring Solidity expertise. On January 6, 2026, a legacy Fusion Optimizer Vault on Arbitrum was exploited for $336,000 USDC via a combination of missing fuse validation in the instantWithdraw method and an EIP-7702 delegation vulnerability on an administrator account. The IPOR DAO committed to fully compensating all affected depositors from treasury reserves, and the incident was flagged by blockchain investigator ZachXBT.","timeline":[{"date":"2021-06-14","event":"IPOR Labs AG incorporated in Zug, Switzerland by co-founders Darren Camas and Dimitar Dinev.","source":""},{"date":"2023-07-28","event":"Ackee Blockchain completes 59 engineering-day security review of IPOR Protocol core, identifying 39 findings. Review concludes with high code quality rating.","source":""},{"date":"2024-01-01","event":"Legacy Fusion Optimizer Vault deployed on Arbitrum (approximately 490 days before the January 2026 exploit), predating stricter fuse validation requirements.","source":""},{"date":"2025-05-09","event":"Governance proposal IIP-35 snapshot taken at Ethereum block 22446433 for IPOR-to-FUSN token migration at 1:1 ratio, marking a strategic rebranding of the protocol.","source":""},{"date":"2026-01-06","event":"Legacy Fusion USDC Optimizer Vault on Arbitrum exploited for $336,000 USDC via missing instantWithdraw validation and EIP-7702 admin delegation flaw. Hexagate and Blockaid alert the IPOR team. Stolen funds (approx. $267K) bridged to Ethereum and deposited into Tornado Cash.","source":""},{"date":"2026-01-07","event":"IPOR DAO publicly confirms full compensation of all affected depositors from DAO treasury. Protocol engages SEAL for forensic recovery. Post-mortem publication committed. Incident widely covered by crypto media.","source":""}]},"v":1}