Joe Agent exploit analysis
Joe Agent's `removeLiquidityViaContract(liquidity, ...)` accepted any caller-supplied `liquidity` value, including one owned by another user. DeFiHackLabs reconstructs about $45K USD drained (62.5 BNB plus 1.2M JOE).
- Reported loss
- ~$45K USD (62.5 BNB + ~1.196M JOE), per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-27: Reentrancy In Removeliquidityviacontract on Joe Agent”.
Analysis1 min read
Joe Agent lets a user park an LP inside the token contract (through zapNativeForLP and addLiquidityViaContract), tracked per-user in lpInfo[user].lpAmount. The removeLiquidityViaContract(liquidity, ...) reads its liquidity argument directly from the caller without re-checking against lpInfo[user].lpAmount, so the attacker supplied a liquidity of someone else's recorded balance and redeemed it out.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; total loss is approximately $45K USD (62.5 BNB plus 1,195,918 JOE).
What would have prevented it: a removeLiquidityViaContract that first checks msg.sender == lpInfo[liquidity].owner and rejects liquidity amounts whose owner is not the caller.
Other exploits
- YSDAO exploit analysis 29 May 2026
- DxSale exploit proof of concept 28 May 2026
- LegendaryMoneyMonNft exploit analysis 28 May 2026
- SKP Token exploit analysis 26 May 2026
- New Market Trading exploit analysis 25 May 2026
- SquidRouterModule exploit analysis 25 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
