Cointime

Cointime

Download App
iOS & Android

SharkTeam: Analysis of Jimbos Protocol Lightning Loan Attack Principle

On May 28, 2023, Beijing time, Jimbos protocol fell victim to a lightning loan attack, with the attacker profiting approximately $7.5 million. SharkTeam promptly conducted a technical analysis of this incident and summarized security measures, hoping that future projects can learn from it and strengthen the security defenses of the blockchain industry.

1. Incident analysis

Attacker address: 0x102be4bccc2696c35fd5f5bfe54c1dfba416a741

Attack contract: 0xd4002233b59f7edd726fc6f14303980841306973

Attacked contract: 0x271944d9D8CA831F7c0dBCb20C4ee482376d6DE7

Attack transactions: 0x44a0f5650a038ab522087c02f734b80e6c748afb207995e757ed67ca037a5eda

Attack process:

1. The attacker (0x102be4bc) borrows 10,000 ETH through flash loan.

2. Then exchange a large amount of Jimbo in the trading pool with ETH.

3. The attacker (0x102be4bc) transferred 100 JIMBO tokens to the attacked contract (0x271944d9)

4. Call the shift function of the attacked contract (0x271944d9).

5. Loop the above operation several times:

6. Finally, convert Jimbo to ETH and return the flash loan, and leave the market with a profit

Vulnerability analysis:

This attack takes advantage of the vulnerability in the JimboController (0x271944d9) contract. The shift function in it will allow the contract to perform the operations of removing liquidity and adding liquidity. When adding liquidity, the JimboController (0x271944d9) contract will send all the weth to add fluidity.

The attacker (0x102be4bc) used a large amount of weth to exchange a large amount of Jimbo coins in the liquidity pool in the second step, making the price of Jimbo in the pool very high, and then called the shift function in the JimboController (0x271944d9) contract to add liquidity Sexual operation will send all the weth in the contract to the liquidity pool (including the original weth in the contract). At this time, the number of weth in the pool increases but the price of Jimbo is still high, and the attacker (0x102be4bc) will second himself The Jimbo coins swapped out in the first step can be exchanged for weth, and the pool’s own weth and the weth sent by the JimboController (0x271944d9) contract can be swapped out together.

Summary of the incident:

The reason for this incident is that there is a loophole in the shift function of the JimboController (0x271944d9) contract. Anyone can call this function to make the contract add liquidity to the pool, and all the weth in the contract will be sent to add liquidity, regardless of No matter how the price is manipulated, the contract can be used to receive orders.

2. Security Recommendations

In light of this attack incident, we should adhere to the following considerations during the development process:

1. Exercise greater caution regarding the risk of price manipulation when developing functions related to liquidity addition and removal.

2. Prior to project deployment, it is essential to engage a third-party professional auditing team for smart contract audits.

About us

SharkTeam’s vision is to comprehensively protect the security of the Web3 world. The team is composed of experienced security professionals and senior researchers from all over the world. They are proficient in the underlying theory of blockchain and smart contracts, and provide services including smart contract auditing, on-chain analysis, and emergency response. It has established long-term cooperative relationships with key players in various fields of the blockchain ecosystem, such as Polkadot, Moonbeam, polygon, OKC, Huobi Global, imToken, ChainIDE, etc.Official website: https://www.sharkteam.org/Twitter: https://twitter.com/sharkteamorgDiscord: https://discord.gg/jGH9xXCjDZTelegram: https://t.me/sharkteamorg

SharkTeam Web3
Comments

All Comments

Recommended for you

  • Modular Data Layer for Gaming and AI, Carv, Raises $10M in Series A Funding

    Santa Clara-based Carv has secured $10m in Series A funding led by Tribe Capital and IOSG Ventures, with participation from Consensys, Fenbushi Capital, and other investors. The company plans to use the funds to expand its operations and development efforts. Carv specializes in providing gaming and AI development with high-quality data enhanced with human feedback in a regulatory-compliant, trustless manner. Its solution includes the CARV Protocol, CARV Play, and CARV's AI Agent, CARA. The company is also preparing to launch its node sale to enhance decentralization and bolster trustworthiness.

  • The US GDP seasonally adjusted annualized rate in the first quarter was 1.6%

    The seasonally adjusted annualized initial value of US GDP for the first quarter was 1.6%, estimated at 2.5%, and the previous value was 3.4%.

  • The main culprit of China's 43 billion yuan illegal money laundering case was arrested in the UK, involved in the UK's largest Bitcoin money laundering case

    Local time in the UK, Qian Zhimin appeared in Westminster Magistrates' Court for the first time under the identity of Yadi Zhang. She was accused of obtaining, using or possessing cryptocurrency as criminal property from October 1, 2017 to this Tuesday in London and other parts of the UK. Currently, Qian Zhimin is charged with two counts of illegally holding cryptocurrency. Qian Zhimin is the main suspect in the Blue Sky Gerui illegal public deposit-taking case investigated by the Chinese police in 2017, involving a fund of 43 billion yuan and 126,000 Chinese investors. After the case was exposed, Qian Zhimin fled abroad with a fake passport and held a large amount of bitcoin overseas. According to the above Financial Times report, Qian Zhimin denied the charges of the Royal Prosecution Service in the UK, stating that she would not plead guilty or apply for bail.

  • Nigeria’s Central Bank Denies Call to Freeze Crypto Exchange Users’ Bank Accounts

    In response to the news that "the Central Bank of Nigeria has issued a ban on cryptocurrency trading and requested financial institutions to freeze the accounts of users related to Bybit, KuCoin, OKX, and Binance exchanges," the Central Bank of Nigeria (CBN) stated in a document that the CBN has not officially issued such a notice, and the public should check the official website for the latest information to ensure the reliability of the news. According to a screenshot reported by Cointelegraph yesterday, the Central Bank of Nigeria has requested all banks and financial institutions to identify individuals or entities trading with cryptocurrency exchanges and set these accounts to "Post-No-Debit" (PND) status within six months. This means that account holders will not be able to withdraw funds or make payments from these accounts. According to the screenshot, the Central Bank of Nigeria has listed cryptocurrency exchanges that have not obtained operating licenses in Nigeria, including Bybit, KuCoin, OKX, and Binance. The Central Bank of Nigeria will crack down on the illegal purchase and sale of stablecoin USDT on these platforms, especially those using peer-to-peer (P2P) transactions. In addition, the Central Bank of Nigeria pointed out that financial institutions are prohibited from engaging in cryptocurrency transactions or providing payment services to cryptocurrency exchanges.

  • Universal verification layer Aligned Layer completes $20 million Series A financing

    Ethereum's universal verification layer Aligned Layer has completed a $20 million Series A financing round, led by Hack VC, with participation from dao5, L2IV, Nomad Capital, and others. The Aligned Layer mainnet is scheduled to launch in the second quarter of 2024. As the EigenLayer AVS, Aligned Layer provides Ethereum with a new infrastructure for obtaining economically viable zero-knowledge proof verification for all proof systems.

  • The total open interest of Bitcoin contracts on the entire network reached 31.41 billion US dollars

    According to Coinglass data, the total open position of Bitcoin futures contracts on the entire network is 487,500 BTC (approximately 31.41 billion US dollars).Among them, the open position of CME Bitcoin contracts is 143,600 BTC (approximately 9.23 billion US dollars), ranking first;The open position of Binance Bitcoin contracts is 109,400 BTC (approximately 7.07 billion US dollars), ranking second.

  • Bitcoin mining difficulty increased by 1.99% to 88.1T yesterday, a record high

    According to BTC.com data reported by Jinse Finance, the mining difficulty of Bitcoin has increased by 1.99% to 88.1T at block height 840,672 (22:51:52 on April 24), reaching a new historical high. Currently, the average network computing power is 642.78EH/s.

  • US Stablecoin Bill Could Be Ready Soon, Says Top Democrat on House Financial Services Committee

    The top Democrat on the U.S. House Financial Services Committee, Maxine Waters, has stated that a stablecoin bill may be ready soon, indicating progress towards a new stablecoin law in the U.S. before the elections. Waters has previously criticized a version of the stablecoin bill, but emphasized the importance of protecting investors and ensuring that stablecoins are backed by assets. Congressional movement on stablecoin legislation has recently picked up pace, with input from the U.S. Federal Reserve, Treasury Department, and White House in crafting the bill. The stablecoin bill could potentially be tied to a must-pass Federal Aviation Administration reauthorization due next month, and may also be paired with a marijuana banking bill.

  • Crypto mining company Argo mined 1,760 bitcoins last year and earned $50.6 million

    Crypto mining company Argo Blockchain has released its 2023 financial year performance report, which includes:

  • Crypto VC market hits 12-month high in March, with total investment exceeding $1 billion

    According to data from Cointelegraph, the cryptocurrency venture capital market continued to recover in March and April 2024. In March, 161 individual transactions were completed, setting a record in the past 12 months, with a total investment of more than $1 billion, an increase of 52% from the previous month. Although April has not yet ended, as of now, 90 transactions have been completed, attracting more than $820 million in investment.

Daily Must-Read

Popular Activities

Delysium $AGI & AI Private Yacht Party

Delysium $AGI & AI Private Yacht Party

March 27 - March 27
Seoul

Popular Tags

Cointime
News
Contents
RSS
Company