This cluster of exploits shows how fragile DeFi systems remain under pressure. Jimbos lost $7.5M because it couldn’t handle price distortion during liquidity events. El Dorado’s oracle contract was wide open to manipulation , intentionally. CS Token turned token burns into a pump machine. Local Traders lacked basic permission checks. Sell Token handed out rewards to anyone who asked. These are not edge-case exploits; they’re failures to validate inputs, restrict control, and design for adversarial environments.
On May 30, an exploit took place on the El Dorado Exchange (EDE) on the Arbitrum chain, resulting in a loss of $580K. The attack happened because the price oracle was manipulated. The attacker used the 0x147d9322() function in EDE’s oracle contract to manipulate token prices. The attacker claimed to be a white hat and accused EDE of having a backdoor to manipulate the prices and steal user funds. EDE acknowledged the ability to manipulate prices but stated that it was intended to blacklist the exploiters. The attacker returned the funds and received a 10% bounty fee
Decompiled Exploit Contract (on Arbitrum Chain): 0xD067e4B0144841bc79153874d385671Ea4c4e4DF
Transaction Hash: 0x72574fc0f85ed3c6fb78907fc938ce4d407817b1275bbd8b1ddc6de190550bf0
On May 28, the Jimbos Protocol exploit on the Arbitrum chain resulted in a loss of $7.5M. The attack occurred because the JimbosController contract, responsible for balancing $JIMBO and WETH amounts by adding or removing liquidity, lacked a mechanism to prevent additions and removals during distorted token prices. The attacker used a flash loan to borrow WETH and swapped it for $JIMBO tokens. The attacker then transferred 100 $JIMBO tokens to the JimboController contract, which removed excess $JIMBO liquidity, increasing its price. Taking advantage of the inflated price, the attacker sold the overpriced $JIMBO tokens and profited from the exploit.
Exploit Contract (on Arbitrum Chain): 0x271944d9D8CA831F7c0dBCb20C4ee482376d6DE7
Transaction Hash: 0x44a0f5650a038ab522087c02f734b80e6c748afb207995e757ed67ca037a5eda
On May 24, the CS Token exploit on BNB chain resulted in a loss of $714K. The attacker manipulated the price of the $CS token by burning tokens, which reduced the token supply. The attacker used flash loans to borrow $80M worth of $BUSD from the PancakeSwap contract. Then, the attacker repeatedly exchanged $BUSD for $CS tokens using the CS contract. For each swap, the CS contract burned a portion of the tokens, gradually reducing the supply. This decreased supply increased the value of the $CS tokens, allowing the attacker to profit from the exploit.
Exploit Contract (on BNB Chain): 0x8BC6Ce23E5e2c4f0A96429E3C9d482d74171215e
Transaction Hash: 0x906394b2ee093720955a7d55bff1666f6cf6239e46bea8af99d6352b9687baa4
On May 23, the Local Traders Finance exploit on the BNB chain resulted in a loss of $111K. The attack occurred due to the absence of a permission check, which allowed the attacker to become the owner of the Local Traders’ contract. Initially, the attacker set themselves as the contract owner. The attacker then triggered the private getTokenPrice() function and purchased $SLC tokens at an artificially low price. The getTokenPrice() function returned a low token price because the contract owner had previously manipulated the value of stor_3. The attacker then sold the $SLC tokens at the market rate and made a profit.
Decompiled Exploit Contract (on BNB Chain): 0x312DC37075646c7e0DBA21DF5BdFe69E76475fdc
Transaction Hash: 0x49a3038622bf6dc3672b1b7366382a2c513d713e06cb7c91ebb8e256ee300dfb
On May 13, the Sell Token exploit on BNB chain resulted in a loss of $87K. The attack occurred due to improper input validation. The claim() function in Sell Token’s StakingRewards contract was missing input parameter checks. This vulnerability enabled the attacker to leverage a fake token named TokenA instead of USDT to collect $SELLC rewards. To prevent such attacks, the claim() function should have included input parameter validation to verify if TokenA was an authorized token. Subsequently, the attacker exchanged the accumulated $SELLC tokens for 408 WBNB on PancakeSwap.
Exploit Contract (on BNB Chain): 0xeaF83465025b4Bf9020fdF9ea5fB6e71dC8a0779
Transaction Hash: 0xfe80df5d689137810df01e83b4bb51409f13c865e37b23059ecc6b3d32347136