{"investigation":{"slug":"juicebox-v3","entity_name":"Juicebox V3","trust_score":40,"severity_base":null,"score_modifier":-8,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Juicebox is an Ethereum-based programmable treasury and crowdfunding protocol first launched in July 2021 by a pseudonymous developer known as Jango, enabling projects to raise ETH, issue contributor tokens, and manage on-chain treasuries without intermediaries. V3 is the third major iteration of the core contracts, deployed in September 2022, and subsequently patched through versions 3.1, 3.1.1, and 3.1.2 to address a series of high-severity and critical accounting vulnerabilities. A protocol logic exploit in April 2026 resulted in an alleged $52,000 loss via a borrowFrom spoof attack, and the platform's permissionless architecture has enabled misuse by bad actors operating fraudulent fundraising projects.","sections":[{"content":"Juicebox V3 is an open-source, Ethereum-native smart contract system that allows any individual or organization to configure a programmable on-chain treasury. Participants contribute ETH; the protocol mints project-specific tokens to contributors at a configurable rate and distributes a reserved portion to designated beneficiaries such as the founding team. The protocol applies a 2.5% membership fee on payout withdrawals, which is used to buy back JBX, the governance token of JuiceboxDAO, the decentralized autonomous organization that governs the protocol. V3 was deployed to Ethereum mainnet on September 20, 2022, following audits by PeckShield, Certik, and a Code4rena competitive audit contest. The protocol is fully permissionless: any wallet can deploy a project without identity verification or vetting by JuiceboxDAO. High-profile projects that used earlier Juicebox versions include ConstitutionDAO (approximately $46 million raised in November 2021) and AssangeDAO (approximately 17,423 ETH raised in February 2022). Juicebox V3 TVL as of early 2026 is approximately $132,000, down from a peak of several million dollars, reflecting migration of activity to later protocol versions and general DAO treasury decline.","heading":"Protocol Overview and Architecture","sources":[{"url":"https://docs.juicebox.money/dev/v3/resources/versioning/","name":"docs.juicebox.money","type":"other","credibility":3},{"url":"https://defillama.com/protocol/juicebox-v3","name":"defillama.com","type":"other","credibility":3},{"url":"https://juicebox.money/","name":"juicebox.money","type":"other","credibility":3},{"url":"https://cryptoslate.com/has-decentralized-crowdfunding-for-daos-finally-arrived-with-juicebox/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Code4rena competitive audit of Juicebox V3 contracts conducted between October 18 and October 23, 2022, identified 13 unique vulnerabilities: 5 rated HIGH severity and 8 rated MEDIUM severity. Among the high-severity findings were: (1) a payment path using the '_dontMint' flag that caused contributor funds to be permanently lost rather than credited; (2) a reserve token underflow bug triggered when fully minted tiers had reserve tokens burned, which permanently broke both minting and redemption functions for affected tiers; (3) an incorrect redemption weight calculation that caused participants to receive less than their fair share of overflow funds; (4) a honeypot attack vector in which the rounding mechanism for reserve tokens allowed malicious project creators to mint reserve tokens across multiple tiers immediately after receiving initial contributions and then redeem those tokens to steal most of a victim's deposit; and (5) a tiered NFT redemption weight miscalculation that used reserve data from incorrect tier IDs. Medium-severity findings included unsafe downcasting of tier configuration parameters, unbounded tier iteration creating gas exhaustion risk, and a vulnerability allowing deactivated tiers to still mint reserve tokens. A separate Code4rena audit of the Juicebox Buyback Delegate in May 2023 found 3 medium-severity issues including partial swap execution risk in Uniswap V3 and slippage protection inconsistencies. The Certik security assessment from March 2022 flagged the project owner's unrestricted ability to send ETH to arbitrary addresses as a risk, and recommended multi-signature and timelock controls.","heading":"Security Vulnerabilities and Audit Findings","sources":[{"url":"https://code4rena.com/reports/2022-10-juicebox","name":"code4rena.com","type":"other","credibility":3},{"url":"https://code4rena.com/reports/2023-05-juicebox","name":"code4rena.com","type":"other","credibility":3},{"url":"https://docs.juicebox.money/assets/files/certik-audit-report-12b48328d22ac38207dad74162cac1db.pdf/","name":"docs.juicebox.money","type":"other","credibility":3},{"url":"https://github.com/code-423n4/2022-10-juicebox-findings/issues/193","name":"github.com","type":"other","credibility":3},{"url":"https://github.com/code-423n4/2023-05-juicebox-findings/issues/236","name":"github.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Juicebox V3 deployment history reflects a pattern of post-launch vulnerability discovery requiring emergency contract replacements. In May 2022, prior to V3, a medium-severity bug in the JBFundingCycleStore contract was triggered by two successive reconfigurations during a rolled-over funding cycle; the root cause was a missing OR condition in an if-statement, and resolution required redeploying JBDirectory, JBController, and payment terminal contracts along with project migration. In early 2023, a high-severity bug was discovered during the deployment of the V3 JBX migration contracts. The initial mitigation adopted JBController3_0_1 as an interim fix; DAO governance approved JBP-341 on February 17, 2023, and a more comprehensive fix was deployed on February 21, 2023 as Juicebox V3.1, introducing JBETHPaymentTerminal3_1 and JBController3_1. Version 3.1.1 was deployed on June 30, 2023, resolving a low-severity bug where payouts could revert if a recipient project lacked a configured terminal, along with gas optimizations. Version 3.1.2 was deployed on August 15, 2023, addressing a critical accounting error in fee calculations: the protocol miscalculated the expected deposit amount when funds were returned after payouts, using the pre-fee amount rather than the post-fee amount actually held by the recipient, leaving affected projects underfunded. The fix relocated fee calculation logic into a dedicated library. On April 20, 2026, Juicebox V3 suffered an alleged protocol logic exploit described by DeFiLlama as a borrowFrom spoof attack on Ethereum, resulting in an alleged loss of approximately $52,000.","heading":"V3 Protocol Logic Incidents and Patch History","sources":[{"url":"https://docs.juicebox.money/dev/v3/resources/versioning/","name":"docs.juicebox.money","type":"other","credibility":3},{"url":"https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/main/security/postmortem/5.24.2022.md","name":"github.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/juicebox","name":"defillama.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/juicebox-v3","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Juicebox operates as a fully permissionless protocol with no identity verification, no KYC requirements, and no vetting of project creators or their stated intentions. Any Ethereum wallet can deploy a Juicebox project and begin soliciting contributor funds. JuiceboxDAO's own documentation acknowledges this risk, advising contributors to conduct their own research before funding any project. The platform's design means that project owners retain control of funds through a Project NFT; if that NFT wallet is compromised or the owner acts maliciously, the protocol offers no recourse. AssangeDAO, one of the largest projects launched on Juicebox, became the subject of community fraud allegations in 2022 after unexplained ETH transfers of 583.755 ETH from the multi-signature treasury address without community approval on April 9 and 10, 2022. Community members proposed legal action against the founding team, and CoinTelegraph analysts urged caution given suspicious on-chain activity. The Code4rena V2 audit also identified a specific vulnerability permitting project owners to construct honeypots against contributors. While Juicebox's protocol-level safeguards such as configurable funding cycle locks and time-delayed reconfigurations can reduce rug-pull risk for properly configured projects, these protections are optional and not enforced by default.","heading":"Permissionless Architecture and Fundraising Abuse Risk","sources":[{"url":"https://cryptoslate.com/has-decentralized-crowdfunding-for-daos-finally-arrived-with-juicebox/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/assange-dao-crypto-activities-suspicious-caution","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://watcher.guru/news/assangedao-to-rug-pull-community-reacts-to-unexplained-eth-transfers","name":"watcher.guru","type":"other","credibility":3},{"url":"https://github.com/code-423n4/2022-07-juicebox-findings/issues/170","name":"github.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/assangedao-accusations-highlight-danger-of-mixing-activism-investing-9e5e7e44b6c8","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"JBX is the governance token of JuiceboxDAO and accrues value through a 2.5% membership fee applied to all payout withdrawals on the Juicebox protocol, with fees used to buy back JBX from the market. JuiceboxDAO sets no maximum supply cap on JBX; tokens are minted continuously to contributors, with issuance declining by 10% per ETH every two weeks. Approximately 35% of JBX tokens are reserved for designated team and contributor addresses, with 65% distributed to contributors. JuiceboxDAO is governed entirely by JBX token holders with no board of directors, no CEO, and no formal corporate entity. The absence of a supply cap introduces ongoing dilution risk for JBX holders. The protocol's own fee structure allows JBX holders to vote to increase the membership fee from 2.5% up to 5%, giving token holders indirect power over the economic terms imposed on all projects using the platform. Coinbase, MEXC, and Bitget list JBX, though liquidity and market capitalization are limited. The permissionless issuance of project tokens by any Juicebox project also creates a secondary risk: unvetted project tokens may be marketed as investment instruments without regulatory compliance.","heading":"Governance Token (JBX) and Tokenomics Risks","sources":[{"url":"https://docs.juicebox.money/dao/","name":"docs.juicebox.money","type":"other","credibility":3},{"url":"https://www.mexc.com/price/juicebox/tokenomics","name":"mexc.com","type":"other","credibility":3},{"url":"https://blog.juicebox.money/juicebox-protocol-tokenomics/","name":"blog.juicebox.money","type":"other","credibility":3},{"url":"https://www.coinbase.com/price/juicebox","name":"coinbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, a pseudonymous blockchain investigator with a documented track record of exposing fraud and protocol exploits, has flagged Juicebox V3 as a notable risk entity. The precise basis for ZachXBT's flag has not been publicly elaborated in a dedicated published investigation thread as of the date of this report, and the specific claims remain unverified at Tier 1 or Tier 2 credibility. The April 2026 borrowFrom spoof attack — resulting in an alleged $52,000 loss on Ethereum — is consistent with the type of protocol logic exploitation that ZachXBT has historically investigated and flagged. DeFiLlama independently recorded the April 20, 2026 incident under its tracked hacks database, classifying it as a Protocol Logic attack. The combination of a 2026 exploit, an extended history of high-severity audit findings, permissionless fundraising misuse, and the ZachXBT flag collectively supports a materially elevated risk assessment relative to audited, well-governed DeFi protocols.","heading":"ZachXBT Flag and On-Chain Risk Signals","sources":[{"url":"https://defillama.com/protocol/juicebox-v3","name":"defillama.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/juicebox","name":"defillama.com","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Juicebox V3 has not been the subject of any publicly documented SEC, CFTC, DOJ, or OFAC enforcement action as of this report. However, the protocol's design presents potential regulatory exposure vectors that have not been publicly adjudicated. The issuance of project tokens to contributors in exchange for ETH may constitute the offering of unregistered securities under certain jurisdictional frameworks, depending on project-specific facts. The CFTC has previously taken action against DeFi protocols where developers retained control over smart contracts, treating such entities as liable for trading activities occurring on their platforms. JuiceboxDAO's lack of formal corporate structure and pseudonymous leadership makes any such enforcement action procedurally complex but does not eliminate regulatory risk. The protocol's use in fundraising for causes such as AssangeDAO, which involved politically sensitive activity and transnational fund flows, may attract additional scrutiny. No specific regulatory proceedings have been identified against JuiceboxDAO or Jango as of this report.","heading":"Regulatory Environment and Compliance Considerations","sources":[{"url":"https://docs.juicebox.money/dev/v3/resources/versioning/","name":"docs.juicebox.money","type":"other","credibility":3},{"url":"https://cryptoslate.com/has-decentralized-crowdfunding-for-daos-finally-arrived-with-juicebox/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/assangedao-accusations-highlight-danger-of-mixing-activism-investing-9e5e7e44b6c8","name":"medium.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-07","event":"Juicebox protocol V1 launched on Ethereum mainnet by pseudonymous developer Jango.","source":"","date_original":"2021-07-01"},{"date":"2021-08-18","event":"Low-severity bug discovered in V1 affecting reserved rate calculations for projects that received payments with a reserved rate of 0% before later reconfiguring to a non-zero reserved rate.","source":""},{"date":"2021-11-18","event":"ConstitutionDAO raises approximately $46 million in ETH through Juicebox to bid on a copy of the U.S. Constitution at Sotheby's; bid is unsuccessful.","source":""},{"date":"2022-02","event":"AssangeDAO raises approximately 17,423 ETH (then roughly $53 million) via Juicebox, becoming the largest DAO fundraiser on the platform at the time.","source":"","date_original":"2022-02-01"},{"date":"2022-04-09","event":"AssangeDAO multi-signature wallet transfers 583.755 ETH without community approval, triggering fraud allegations and calls for legal action against the founding team.","source":""},{"date":"2022-03-29","event":"Certik publishes security assessment of Juicebox V2 contracts, flagging project owner's ability to send ETH to arbitrary addresses and recommending multi-sig and timelock controls.","source":""},{"date":"2022-05-24","event":"Medium-severity bug in JBFundingCycleStore triggered by successive reconfigurations in rolled-over funding cycles; contracts redeployed May 25 and project migration completed by May 28.","source":""},{"date":"2022-07","event":"Code4rena V2 audit identifies honeypot vulnerability allowing project owners to trap contributor funds.","source":"","date_original":"2022-07-01"},{"date":"2022-09-20","event":"Juicebox V3 deployed to Ethereum mainnet following audits by PeckShield, Certik, and Code4rena.","source":""},{"date":"2022-10-23","event":"Code4rena competitive audit of Juicebox V3 closes; 13 unique vulnerabilities identified including 5 HIGH severity findings covering fund loss, reserve token underflow, honeypot exploitability, and NFT redemption weight miscalculation.","source":""},{"date":"2023-02-17","event":"JuiceboxDAO approves JBP-341 to address high-severity bug discovered during V3 JBX migration contract deployment.","source":""},{"date":"2023-02-21","event":"Juicebox V3.1 deployed to Ethereum mainnet with JBETHPaymentTerminal3_1 and JBController3_1 to address the high-severity migration bug and additional security risks.","source":""},{"date":"2023-05-22","event":"Code4rena audit of Juicebox Buyback Delegate closes; 3 medium-severity issues found including partial Uniswap V3 swap execution and slippage protection gaps.","source":""},{"date":"2023-06-30","event":"Juicebox V3.1.1 deployed, fixing low-severity payout revert bug and adding gas optimizations.","source":""},{"date":"2023-08-15","event":"Juicebox V3.1.2 deployed, fixing critical fee accounting error where protocol miscalculated expected deposit amounts after payout returns, leaving projects financially underfunded.","source":""},{"date":"2026-04-20","event":"Juicebox V3 suffers alleged $52,000 loss via a borrowFrom spoof attack on Ethereum, classified by DeFiLlama as a Protocol Logic exploit.","source":""}],"sources_used":[{"url":"https://docs.juicebox.money/dev/v3/resources/versioning/","name":"docs.juicebox.money","type":"other","archive_url":"http://web.archive.org/web/20260613083533/https://docs.juicebox.money/dev/v3/resources/versioning/","credibility":3,"archive_timestamp":"2026-06-13T08:35:33+00:00"},{"url":"https://defillama.com/protocol/juicebox-v3","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250914205447/https://defillama.com/protocol/juicebox-v3","credibility":3,"archive_timestamp":"2025-09-14T20:54:47+00:00"},{"url":"https://juicebox.money/","name":"juicebox.money","type":"other","archive_url":"http://web.archive.org/web/20260609080603/https://juicebox.money/","credibility":3,"archive_timestamp":"2026-06-09T08:06:03+00:00"},{"url":"https://cryptoslate.com/has-decentralized-crowdfunding-for-daos-finally-arrived-with-juicebox/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260415200455/https://cryptoslate.com/has-decentralized-crowdfunding-for-daos-finally-arrived-with-juicebox/","credibility":3,"archive_timestamp":"2026-04-15T20:04:55+00:00"},{"url":"https://code4rena.com/reports/2022-10-juicebox","name":"code4rena.com","type":"other","archive_url":"http://web.archive.org/web/20260613054624/https://code4rena.com/reports/2022-10-juicebox","credibility":3,"archive_timestamp":"2026-06-13T05:46:24+00:00"},{"url":"https://code4rena.com/reports/2023-05-juicebox","name":"code4rena.com","type":"other","archive_url":"http://web.archive.org/web/20260219092544/https://code4rena.com/reports/2023-05-juicebox","credibility":3,"archive_timestamp":"2026-02-19T09:25:44+00:00"},{"url":"https://docs.juicebox.money/assets/files/certik-audit-report-12b48328d22ac38207dad74162cac1db.pdf/","name":"docs.juicebox.money","type":"other","archive_url":"http://web.archive.org/web/20260528020416/https://docs.juicebox.money/assets/files/certik-audit-report-12b48328d22ac38207dad74162cac1db.pdf","credibility":3,"archive_timestamp":"2026-05-28T02:04:16+00:00"},{"url":"https://github.com/code-423n4/2022-10-juicebox-findings/issues/193","name":"github.com","type":"other","archive_url":"https://web.archive.org/web/20260829075840/https://github.com/code-423n4/2022-10-juicebox-findings/issues/193","credibility":3,"archive_timestamp":"2026-08-29T07:58:40+00:00"},{"url":"https://github.com/code-423n4/2023-05-juicebox-findings/issues/236","name":"github.com","type":"other","archive_url":"https://web.archive.org/web/20260829075936/https://github.com/code-423n4/2023-05-juicebox-findings/issues/236","credibility":3,"archive_timestamp":"2026-08-29T07:59:36+00:00"},{"url":"https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/main/security/postmortem/5.24.2022.md","name":"github.com","type":"other","archive_url":"https://web.archive.org/web/20260829080139/https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/main/security/postmortem/5.24.2022.md","credibility":3,"archive_timestamp":"2026-08-29T08:01:39+00:00"},{"url":"https://defillama.com/protocol/juicebox","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250911021728/https://defillama.com/protocol/juicebox","credibility":3,"archive_timestamp":"2025-09-11T02:17:28+00:00"},{"url":"https://cointelegraph.com/news/assange-dao-crypto-activities-suspicious-caution","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260310031939/https://cointelegraph.com/news/assange-dao-crypto-activities-suspicious-caution","credibility":3,"archive_timestamp":"2026-03-10T03:19:39+00:00"},{"url":"https://watcher.guru/news/assangedao-to-rug-pull-community-reacts-to-unexplained-eth-transfers","name":"watcher.guru","type":"other","archive_url":"http://web.archive.org/web/20260414210446/https://watcher.guru/news/assangedao-to-rug-pull-community-reacts-to-unexplained-eth-transfers","credibility":3,"archive_timestamp":"2026-04-14T21:04:46+00:00"},{"url":"https://github.com/code-423n4/2022-07-juicebox-findings/issues/170","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260829080005/https://github.com/code-423n4/2022-07-juicebox-findings/issues/170","credibility":3,"archive_timestamp":"2026-08-29T08:00:05+00:00"},{"url":"https://medium.com/coinmonks/assangedao-accusations-highlight-danger-of-mixing-activism-investing-9e5e7e44b6c8","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://docs.juicebox.money/dao/","name":"docs.juicebox.money","type":"other","archive_url":"http://web.archive.org/web/20260511113257/https://docs.juicebox.money/dao/","credibility":3,"archive_timestamp":"2026-05-11T11:32:57+00:00"},{"url":"https://www.mexc.com/price/juicebox/tokenomics","name":"mexc.com","type":"other","archive_url":"https://web.archive.org/web/20260829051001/https://www.mexc.com/price/juicebox/tokenomics#juicebox-information","credibility":3,"archive_timestamp":"2026-08-29T05:10:01+00:00"},{"url":"https://blog.juicebox.money/juicebox-protocol-tokenomics/","name":"blog.juicebox.money","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coinbase.com/price/juicebox","name":"coinbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:11.643038+00:00","updated_at":"2026-08-30T20:07:19.374496+00:00"}}