Impermax V3
Summary
Impermax V3 is the third major iteration of Impermax Finance, a DeFi leveraged yield-farming and lending protocol that allows liquidity providers to use Uniswap V3 LP tokens as collateral. The protocol suffered two separate critical exploits in 2025 — a ~$300,000 flash-loan collateral valuation attack in April and a ~$380,000 liquidation logic exploit in November — both on the Base chain, resulting in cumulative losses exceeding $680,000 and leaving lenders with unresolved bad debt. These incidents follow a 2022 private key compromise affecting the IMX token, representing a recurring pattern of security failures across the protocol's history.
Connected Entities
1 entitiesTimeline(10 events)
2020-12
Impermax Finance whitepaper published, outlining leveraged yield farming using LP tokens as collateral.
2021-04-29
IMX token launched via airdrop to approximately 35,000 Uniswap V2 liquidity providers. 14 million tokens distributed at token generation event.
2022-07-16
Private key compromise of several Impermax team wallets. Approximately 9 million IMX tokens and protocol-owned liquidity stolen. Team frontran attacker by selling tokens. IMX migrated to IBEX via pre-incident snapshot distribution.
2025-04
BailSec and Guardian each complete Impermax V3 Core audits prior to launch.
2025-04-26
Flash-loan exploit on Impermax V3 exploiting uncollected Uniswap V3 fee valuation flaw. Approximately $300,000–$400,000 drained from Base and Arbitrum pools. Attacker address: 0xE3223f7E3343c2C8079f261D59ee1e513086C7C3.
2025-04-28
Impermax Finance publishes official post-mortem on Medium. Protocol stabilization measures announced. Lender reimbursement plan based on pre-exploit snapshot committed to, with timeline unspecified.
2025-07
Joint re-audit of updated Impermax V3 Core completed by Guardian, BailSec (Charles Wang), and Cantina (Riley Holtereus).
2025-08
Guardian completes audit of Aerodrome Slipstream integration with Impermax V3.
2025-11-11
Second critical exploit on Impermax V3: liquidation routing logic vulnerability in cbBTC lending vault on Base. Approximately 5.39 cbBTC (~$380,000) drained. Team disables vault connections and advises all users to withdraw funds.
2026
Protocol TVL declines to approximately $98,000. Annual fee and revenue activity reported at effectively zero. Lender reimbursement status for both 2025 exploits remains unconfirmed publicly.
Decision Log
- hash: 5eY1yHi7iBT7aurgq1bdKK8ThhdHduimF7U6g1quV6xL
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:24 AM
last updated: 5/30/2026, 4:05:55 AM
avoid.net — verified advice for a post-truth world