What happened
Beginning May 27, 2023 UTC, an attacker drained about 4,048 ETH (about $7.5 million) from Jimbo V2's Arbitrum JIMBO/ETH liquidity. The attacker manipulated the active liquidity bin to an artificially high price, invoked the liquidity-rebalancing shift, then sold JIMBO back into the exposed ETH liquidity; the sequence was repeated to drain most of the pool.
How it happened
- The attacker created an external JIMBO liquidity bin far above the protocol's normal range.
- A 10,000 ETH flash loan bought JIMBO until that malicious bin became the active price bin.
- Calling
shift()then placed ETH anchor-bin liquidity just below that manipulated price. - The attacker sold JIMBO into those anchor bins, reset the liquidity distribution, and repeated the cycle.
Protocol details
Classification
Ecosystem / Other / Oracle Manipulation
Protocol Type
Exploit/Other
Affected asset / contract
JIMBO
Implementation language
Solidity
Protocol links
Website
@jimbosprotocol
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert twitter.com
- report Twitter/X Alert twitter.com
- report @peckshield incident report twitter.com
- report @DeDotFiSecurity incident report twitter.com
- report @peckshield incident report twitter.com
- report JIMBO V2 Exploit Post-Mortem paragraph.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
