Leaderboard
1224All-time rank
J
JokInTheBox
Jun 10, 2024
$34K
Lost
$34K
Recovered
$0
Net loss
$34K
Unrecovered0% recovered
JokInTheBox staking contract had an unstaking vulnerability where the state variable was not properly checked, allowing attackers to unstake multiple times from the same balance. Exploiter continuously withdrew funds, draining ~$34K from affected users.
How the exploit worked
View reproducible PoCbusiness logic flaw.
Lost: ~9.2 ETH
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Withdrawal Logic Flaw
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jun 10, 2024Exploit executed — $34K drained via withdrawal logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)