# JB helper cycle drains JB/USDT pair for 49.9k USDT

JB helper's repeated sell/burn/sync cycle against the JB/USDT pair released USDT, letting an attacker net ~49,958 USDT via flash-loaned Venus collateral.

- Payout: Real-world hack
- Severity: high
- Program: JB
- Credited: audit_911
- Disclosed: 2026-06-18
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/JB_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260618-jb
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** BSC JB gateway/helper contract and JB/USDT AMM pair
**Root cause:** The unverified JB helper (gateway 0x1B57...E6d7) exposes selectors 0xd680aabd and 0x53a9fcbc that sell/burn/sync JB against the JB/USDT pair using the live JB balance, letting repeated partial-balance cycles release USDT from the pair without proportional input.
**Steps:**
1. Flash-borrow all WBNB from lender 0x8F73...5D8C
2. Approve and mint WBNB into Venus vWBNB, enterMarkets
3. Borrow 70M USDT from vUSDT
4. Approve USDT and JB to JB_GATEWAY 0x1B57...E6d7
5. Call gateway selector `0xd680aabd` with borrowAmount to bootstrap
6. Loop 15x: call `0x53a9fcbc` with `JB.balanceOf(this)/50`, then once with full JB balance
7. Repay 70M USDT to Venus, redeemUnderlying WBNB, approve lender to pull flash loan
8. Transfer remaining USDT profit to attacker
**How found:** Attacker identified unverified helper selectors on the JB gateway and observed that repeated partial-balance cycles against the live JB/USDT pair released USDT; PoC harness additionally shows the helper's owner/parent binding could be reassigned to a fresh contract.
**Exploitation:** Flash loan WBNB -> Venus collateral -> borrow 70M USDT -> feed USDT into unverified JB helper -> repeated sell/burn/sync cycles against JB/USDT pair release USDT -> repay Venus and flash loan, keep ~49,958 USDT.
**Insight:** Unverified helper/gateway contracts with opaque selectors that touch an AMM pair are prime targets: replay the selector with small fractions of the live token balance in a loop and watch pair reserves, since sell/burn/sync logic often misprices partial amounts.