# FutureSwap: fee unit mismatch drains USDC.e and WETH

FutureSwap computed fees in token units but FeeManager read them as basis points, letting an attacker inflate fee weight and drain ~395K USDC.e plus WETH.

- Payout: Real-world hack
- Severity: critical
- Program: FutureSwap
- Credited: DeFiHackLabs
- Disclosed: 2026-01-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-01/futureswap_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260110-futureswap
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation vuln:precision-loss

**Target:** DeFi position/fee accounting contract (proxy 0xf7ca...80bc) on Arbitrum
**Root cause:** Victim computes fee as abs(delta)*feeRateWad/1e18 in token units, then passes it to FeeManager.addFee which interprets the value as feeBasisPoints (bps/weight/share), allowing absurd bps values.
**Steps:**
1. Flash loan 500,000 USDC.e via Aave flashLoanSimple.
2. Open a position via victim changePosition(0.1e18, 1000e6, 0) to establish state.
3. Call victim changePosition(0, -894_992_852_305, 0) so the computed token-unit fee is forwarded as a huge bps value to FeeManager.
4. Victim transfers 894,992.852305 USDC.e to the drainer contract.
5. Sweep drained USDC.e and remaining WETH to attacker EOA; repay flash loan.
**How found:** Observed that the victim's fee computation returns token units while the downstream FeeManager expects basis points, a unit mismatch enabling inflated fee weight.
**Exploitation:** Attacker flash-borrows 500K USDC.e, opens a position, then triggers a large negative stable delta so the token-unit fee is misinterpreted as basis points by FeeManager, causing the victim to transfer ~895K USDC.e to the attacker contract; attacker repays loan and keeps ~394.7K USDC.e plus 67.57 WETH from victim inventory.
**Insight:** When a contract forwards a computed fee into a shared FeeManager, check the unit contract of each side (token amount vs bps vs WAD); a mismatch lets you mint fee weight from a small delta.