Phuture security record
As of 21 Oct 2026, Phuture has 3 audit reports by 2 security firms on Trustblock; the latest is by CertiK, dated 15 Dec 2022. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Phuture.Finance (Audit #2) | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Phuture FRPVault audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Phuture audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings16
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 2 | 0 | 4 |
| Low | 0 | 3 | 5 |
MediumUnlimited Staking Token ApprovalPhuture.Finance (Audit #2) · CertiK · 15 Dec 2022Fixed
Function `withdrawAndSwap()` allows the caller to specify an external token-swap contract, to swap their share of staking token in this contract to reward token. On line 191, all staking token within this contract is temporarily approved to the target contract. Since the target contract can be arbitrarily set by the caller, it would be possible for an attacker to deploy a contract and use it as target contract to be called from `IndexBetting`. As a result, the approval statement on line 191 could give the attacker temporary access to all the staking token in this contract. ```solidity=191 STAKING_TOKEN.safeApprove(_swapTarget, type(uint256).max); _fillQuote(_swapTarget, _assetQuote); uint256 balanceOfIndexAfter = REWARD_TOKEN.balanceOf(address(this)); require(balanceOfIndexAfter - balanceOfIndexBefore >= _minBuyAmount, "IndexBetting: MIN"); uint256 assetBalanceAfter = STAKING_TOKEN.balanceOf(address(this)); require(assetBalanceBefore - assetBalanceAfter == assets, "IndexBetting: MAX"); STAKING_TOKEN.safeApprove(_swapTarget, 0); ```
Open the reportMediumIncorrect Deposit Share DistributionPhuture FRPVault audit · PeckShield · 25 Aug 2022Fixed
The report gives no description here.
Open the reportMediumIncorrect Redeem Share DistributionPhuture FRPVault audit · PeckShield · 25 Aug 2022Fixed
The report gives no description here.
Open the reportMediumPotential DoS in IndexRouter::mintSwap()Phuture audit · PeckShield · 20 Jul 2022Fixed
The report gives no description here.
Open the reportLowFunction `startBettingChallenge()` can be used foPhuture.Finance (Audit #2) · CertiK · 15 Dec 2022Fixed
Function `startBettingChallenge()` allows the contract owner to set the betting start time and end time. It can be called multiple times by the owner to make updates, as long as `PDIRewardRate` is not set yet. This makes it possible to "restart" the betting before it ends, and end the betting early.
Open the reportLowMissing Emit EventsPhuture.Finance (Audit #2) · CertiK · 15 Dec 2022Fixed
There should always be events emitted in the sensitive functions that are controlled by centralization roles. Contract `IndexBetting`: - `startBettingChallenge()`
Open the reportLowUsage on Withdrawal Functions Not DifferentiatedPhuture.Finance (Audit #2) · CertiK · 15 Dec 2022Fixed
Functions `withdraw()`, `withdrawAndMint()` and `withdrawAndSwap()` handles staking token withdrawal and transfers reward token to holders, after betting ends. The reward rate is 5% for victory and 2% for defeat. Function `withdraw()` calculates reward only with defeat rate, and the other two functions covers the case of victory. However, all the three functions could be called in either betting results. In the case of victory, a user could call `withdraw()` and miss the reward. In case of defeat, the other two functions could be called to calculate the reward with victory rate, as long as the external call is successful.
Open the reportLowImproved Logic in Orderer::externalSwap()Phuture audit · PeckShield · 20 Jul 2022Fixed
The report gives no description here.
Open the reportLowRevisited creator Field in OrderDetailsPhuture audit · PeckShield · 20 Jul 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="phuture"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us