JB exploit analysis

An unverified "JB helper" used the live JB/USDT Pancake pair balance to drive a sell/burn/sync cycle. The attacker funded the cycle with a flash of WBNB, which it deposited into Venus as collateral and used the borrowed USDT as cycle input. Each cycle drained a slice of the JB/USDT pair's USDT balance; the cycles were repeated until the pair was emptied, and the resulting USDT was forwarded.

The attacker at 0xd99e1abfc5dd5034d7ff63828d16c5e945d1b856 ran roughly 13 cycle iterations of the JB helper, with Venus repaid and a 1 BNB builder fee retained.

DeFiHackLabs reports a total loss of about 49,958.06 USDT. The drain is in 0x54e120b8d62a9d7cef94bf51f1f5b8aa13565d76d8797a79afeeb25ed0e1dc25 on BscScan. The JB helper 0x1b5732eb98911c25acf7bdfaffb9409782cae6d7 is unverified; the description reads the on-chain behaviour rather than source.

What would have prevented it: the JB helper is unverified, so any fix has to be at the JB/USDT pair or at the JB token's transfer hook - rejecting sync() and skim() from public callers, or excluding the JB/USDT pair from any sell-side tax on transfers.