Cointime

Cointime

Download App
iOS & Android

SharkTeam: Analysis of Jimbos Protocol Lightning Loan Attack Principle

On May 28, 2023, Beijing time, Jimbos protocol fell victim to a lightning loan attack, with the attacker profiting approximately $7.5 million. SharkTeam promptly conducted a technical analysis of this incident and summarized security measures, hoping that future projects can learn from it and strengthen the security defenses of the blockchain industry.

1. Incident analysis

Attacker address: 0x102be4bccc2696c35fd5f5bfe54c1dfba416a741

Attack contract: 0xd4002233b59f7edd726fc6f14303980841306973

Attacked contract: 0x271944d9D8CA831F7c0dBCb20C4ee482376d6DE7

Attack transactions: 0x44a0f5650a038ab522087c02f734b80e6c748afb207995e757ed67ca037a5eda

Attack process:

1. The attacker (0x102be4bc) borrows 10,000 ETH through flash loan.

2. Then exchange a large amount of Jimbo in the trading pool with ETH.

3. The attacker (0x102be4bc) transferred 100 JIMBO tokens to the attacked contract (0x271944d9)

4. Call the shift function of the attacked contract (0x271944d9).

5. Loop the above operation several times:

6. Finally, convert Jimbo to ETH and return the flash loan, and leave the market with a profit

Vulnerability analysis:

This attack takes advantage of the vulnerability in the JimboController (0x271944d9) contract. The shift function in it will allow the contract to perform the operations of removing liquidity and adding liquidity. When adding liquidity, the JimboController (0x271944d9) contract will send all the weth to add fluidity.

The attacker (0x102be4bc) used a large amount of weth to exchange a large amount of Jimbo coins in the liquidity pool in the second step, making the price of Jimbo in the pool very high, and then called the shift function in the JimboController (0x271944d9) contract to add liquidity Sexual operation will send all the weth in the contract to the liquidity pool (including the original weth in the contract). At this time, the number of weth in the pool increases but the price of Jimbo is still high, and the attacker (0x102be4bc) will second himself The Jimbo coins swapped out in the first step can be exchanged for weth, and the pool’s own weth and the weth sent by the JimboController (0x271944d9) contract can be swapped out together.

Summary of the incident:

The reason for this incident is that there is a loophole in the shift function of the JimboController (0x271944d9) contract. Anyone can call this function to make the contract add liquidity to the pool, and all the weth in the contract will be sent to add liquidity, regardless of No matter how the price is manipulated, the contract can be used to receive orders.

2. Security Recommendations

In light of this attack incident, we should adhere to the following considerations during the development process:

1. Exercise greater caution regarding the risk of price manipulation when developing functions related to liquidity addition and removal.

2. Prior to project deployment, it is essential to engage a third-party professional auditing team for smart contract audits.

About us

SharkTeam’s vision is to comprehensively protect the security of the Web3 world. The team is composed of experienced security professionals and senior researchers from all over the world. They are proficient in the underlying theory of blockchain and smart contracts, and provide services including smart contract auditing, on-chain analysis, and emergency response. It has established long-term cooperative relationships with key players in various fields of the blockchain ecosystem, such as Polkadot, Moonbeam, polygon, OKC, Huobi Global, imToken, ChainIDE, etc.Official website: https://www.sharkteam.org/Twitter: https://twitter.com/sharkteamorgDiscord: https://discord.gg/jGH9xXCjDZTelegram: https://t.me/sharkteamorg

SharkTeam Web3
Comments

All Comments

Recommended for you

  • ETH Surpasses $2700

    Market data shows that ETH has surpassed $2700, currently priced at $2703.38, with a 24-hour increase of 0.37%. The market is experiencing significant volatility, so please ensure proper risk management.

  • BTC Surpasses $84,500

    Market data shows that BTC has surpassed $84,500, currently priced at $84,517.06, with a 24-hour increase of 0.57%. The market is experiencing significant fluctuations, so please ensure proper risk management.

  • Economic Daily: 'Patience' is Becoming the Most Scarce and Urgent Demand in the Market

    On September 27, Economic Daily published an article stating that patience is not only a friend of time but also the soil for innovation. Technological innovation inherently features high investment, high risk, and long cycles. Who has the capability to support this expedition in scientific innovation? Tian Xuan, Dean of the Guanghua School of Management at Peking University, provides the answer in his book 'Patient Capital: Building a New Ecology of Long-term Investment'—patient capital. The characteristic of patient capital lies in its pursuit of long-term investment horizons and strategic stability, rather than short-term financial returns. As global economic uncertainty rises and China’s economy stands at a critical juncture of transitioning from factor-driven to innovation-driven growth, the concept of 'patience' is becoming the most scarce and urgent demand in the market. At the macro level, patient capital can effectively smooth short-term market fluctuations and enhance overall market confidence and resilience through long-term asset holding and rational decision-making, while creating a stable financial environment for the implementation of medium- to long-term economic and industrial policies by the state. At the micro level, patient capital can cover the entire development cycle of technological innovation, providing a tolerant space for trial and error in technology, and shifting resources from short-term market projects to long-term innovation projects. Furthermore, the participation of patient capital can send positive signals to the outside world, reduce information asymmetry between market investors and upstream and downstream companies, and alleviate financing difficulties for enterprises. Beyond financial support, it can also promote knowledge transfer and market resource integration through its own network, enhancing the success rate of innovation and research and development in invested companies, and driving the development of new productive forces and the upgrading of economic structure. Strengthening patient capital means not only extending the investment horizon but also respecting the laws of technological iteration, trusting in the long-term evolution of industries, and building a consensus on long-term value. Its deep binding with the real economy will become another important force supporting the stable and long-term development of the Chinese economy.

  • Iranian Military: Pursuit of Trump and Netanyahu Will Continue After War

    On September 27, senior spokesman for the Iranian armed forces, Shekarchi, stated that even after the war ends, the Iranian military will continue to pursue U.S. President Trump and Israeli Prime Minister Netanyahu, labeling them as "murderers" who will inevitably face punishment. "Even if the war ends, we will not spare Trump, Netanyahu, and their accomplices. Regardless of whether they remain in power, they must pay the price for their actions," Shekarchi said. He emphasized that Tehran will never allow the U.S. to regain its former status in the emerging world order. The only safe path for U.S. troops is to withdraw from the Middle East, and the faster they leave, the fewer losses they will incur. "Americans can dream of intervening in the Strait of Hormuz. But if they dare to meddle in the Strait of Hormuz, they will receive a hard slap in the face."

  • Iranian Foreign Minister: Opening of Strait of Hormuz Depends on Iran's Conditions Being Met

    On September 27, Iranian Foreign Minister Zarif stated that Iran will not make concessions to the United States on established conditions. The opening of the Strait of Hormuz depends on whether Iran's proposed conditions are met, and any progress regarding the opening of the Strait will depend on the implementation of these conditions. Iran will never compromise on these issues. Zarif mentioned that Iran has been informed of the U.S. initial response to the proposal for reopening the Strait of Hormuz but has not yet received any specific information conveyed by the mediators. Iran is waiting for the mediators to communicate the final position, and will make decisions based on that. U.S. President Trump stated on the 26th that he rejected Iran's proposal to reopen the Strait of Hormuz. (CCTV News)

  • US to Lower Fuel Economy Standards, Fuel Consumption and Emissions May Rise

    On September 27, US officials announced on Saturday that the Department of Transportation will finalize regulations to significantly lower fuel economy standards for cars on Monday, applicable until 2031. This means the US will reverse the policies promoted during the Biden administration that encouraged automakers to produce more electric vehicles. Former President Trump stated that he has approved new fuel economy standards for cars and trucks, claiming that the new regulations will reduce the prices of new vehicles. US Transportation Secretary Duffy remarked, 'American auto workers will celebrate a major victory on Monday.' According to estimates from the Department of Transportation, the new standards will lower the cost of new cars, but fuel consumption and carbon dioxide emissions will increase over the coming decades.

  • U.S. Spot Bitcoin ETF Sees $2.39 Billion Net Inflow in a Week, Highest Since 2026

    On September 26, BeInCrypto reported that the U.S. spot Bitcoin ETF experienced a net inflow of $2.39 billion this week, marking the largest single-week net inflow since 2026. According to SoSoValue data, the week started with an inflow of $998.95 million on September 21, but subsequently declined daily to $134.47 million by Friday, approximately 87% lower than Monday. Nonetheless, funds continued to flow in for the seventh consecutive trading day. The significant inflow on Monday followed a 6.7% surge in Bitcoin, which led to about $262 million in short positions being liquidated within an hour. A global business survey by S&P on September 23 indicated that the U.S. economy is growing at its fastest pace since July 2021, with the 10-year U.S. Treasury yield surpassing 5%, causing Bitcoin to drop below $84,000 within an hour. The total assets of the ETF currently stand at $108.42 billion.

  • Riot Repays Coinbase Loan Early and Terminates $200 Million Bitcoin Collateral Credit Line

    On September 26, according to U.S. SEC filings, Bitcoin mining company Riot Platforms (NASDAQ: RIOT) voluntarily repaid all outstanding loans to Coinbase Credit on September 21 and terminated its $200 million credit line, while also releasing the lender's claim on the collateralized Bitcoin. Riot paid the full principal and accrued interest, incurring no early termination fees or penalties, and Coinbase's subsequent lending commitments were also terminated. The credit line, revised in April 2026, carried a fixed annual interest rate of 6.15% with a maturity date extended to April 20, 2027, and Riot had previously fully drawn the amount. At this rate, the annual interest on the $200 million balance is approximately $12.3 million. As of June 30, Riot had pledged 5,821 Bitcoins as collateral, valued at about $340.7 million, which accounted for approximately 51% of its total holdings of 11,380 Bitcoins at that time; the collateral also included USDC and cash held in Coinbase Custody Trust. This credit line was initially established in April 2025 for $100 million with a variable interest rate; it was doubled to $200 million the following month with a one-time fee of $1 million. Since the window for early termination fees specified in the agreement closed on August 21, no fees were required for the repayment in September. Riot is simultaneously expanding its data center operations, having announced in August a 20-year lease agreement with an unnamed AI developer for 191 megawatts of computing power at its Rockdale facility, which is expected to generate approximately $9.1 billion in initial revenue.

  • Trump: 'Super Intelligence' is a More Fitting Term than 'Artificial Intelligence'

    On September 26, U.S. President Trump stated: 'Super Intelligence' is a more fitting name. This name is more accurate because the term 'Artificial' often implies 'false' or 'not real'; however, it (Artificial Intelligence) is not a false entity, but rather an extremely powerful form of intelligence.

  • Web3 data and AI company Validation Cloud completes $10 million in new round of financing

     Web3 data and AI company Validation Cloud announced a $10 million financing round from True Global Ventures. The company plans to use the funds to expand its AI products and achieve seamless access to Web3 data.

Daily Must-Read

Popular Activities

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

April 30 - April 30
Dubai

Popular Tags

Cointime
News
Contents
RSS
Company