# Jimbo: bin-shift price manipulation drains protocol liquidity

Jimbo's rebalancing logic let an attacker push the active bin above triggerBin, call shift(), and drain ~$8M via manipulated bin reserves.

- Payout: Real-world hack
- Severity: critical
- Program: Jimbo
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-29
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/Jimbo_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230529-jimbo
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** JimboController / LB pair on Arbitrum
**Root cause:** The controller's shift() rebalancing trusts the pair's active bin position; an attacker can add liquidity in a high bin and swap to push activeId above triggerBin, then trigger shift() to rebalance at a manipulated price.
**Steps:**
1. Flash loan 10,000 WETH from Aave.
2. Swap WETH to Jimbo via LBRouter (binStep 100, V2_1).
3. addLiquidity placing Jimbo liquidity in the max bin `(1<<23)-1` via deltaIds.
4. Swap NATIVE for tokens to push activeId up to triggerBin.
5. Call `controller.shift()` to rebalance at the manipulated bin.
6. Swap remaining balance to buy out all Jimbo bins and repay flash loan.
**How found:** Likely spotted that shift()/triggerBin rely on activeId which is directly movable by swaps, and that liquidity can be placed in arbitrary bins via deltaIds.
**Exploitation:** Attacker flash-borrowed 10k WETH, added Jimbo liquidity at the extreme high bin, swapped to push the active bin above triggerBin, invoked shift() so the protocol rebalanced against the skewed reserves, then bought out the cheap bins and repaid the loan, netting ~$8M.
**Escalation:** Single-transaction flash-loan-funded manipulation; no multi-step chaining beyond the shift() trigger.
**Insight:** When a protocol's rebalancing trigger reads the AMM's active bin, check whether an attacker can cheaply move activeId past the trigger and place liquidity in extreme bins to skew the rebalance price.