Juicebox V3
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 40 → 63. Problems weighed by who is responsible: concerns that are not fraud −16, problems around the subject, caused by others −1.6; legitimacy credit long-running +8, audits +8; fact-check adjustments (−8) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -16 |
| Problems around it, caused by others | -1.6 |
| Long-running | +8 |
| Audited | +8 |
| Sum | 63 |
Score: 63/100 (kept between 0 and 100)
How scoring works →Summary
Juicebox is an Ethereum-based programmable treasury and crowdfunding protocol first launched in July 2021 by a pseudonymous developer known as Jango, enabling projects to raise ETH, issue contributor tokens, and manage on-chain treasuries without intermediaries. V3 is the third major iteration of the core contracts, deployed in September 2022, and subsequently patched through versions 3.1, 3.1.1, and 3.1.2 to address a series of high-severity and critical accounting vulnerabilities. A protocol logic exploit in April 2026 resulted in an alleged $52,000 loss via a borrowFrom spoof attack, and the platform's permissionless architecture has enabled misuse by bad actors operating fraudulent fundraising projects.
Connected Entities
6 entities · 60 linked investigations- ZachXBT→mentioned with→Ethereum(70%)
- Juicebox V3→mentioned with→ZachXBT(70%)
- Juicebox V3→mentioned with→Ethereum(80%)
- Juicebox V3→mentioned with→Bitget(60%)
- Juicebox V3→mentioned with→Uniswap(65%)
- Uniswap→mentioned with→Ethereum(80%)
- Cointelegraph→mentioned with→ZachXBT(70%)
- Cointelegraph→mentioned with→Ethereum(60%)
- Juicebox V3→mentioned with→Cointelegraph(60%)
- Bitget→mentioned with→ZachXBT(70%)
Timeline(16 events)
July 2021
Juicebox protocol V1 launched on Ethereum mainnet by pseudonymous developer Jango.
18 August 2021
Low-severity bug discovered in V1 affecting reserved rate calculations for projects that received payments with a reserved rate of 0% before later reconfiguring to a non-zero reserved rate.
18 November 2021
ConstitutionDAO raises approximately $46 million in ETH through Juicebox to bid on a copy of the U.S. Constitution at Sotheby's; bid is unsuccessful.
February 2022
AssangeDAO raises approximately 17,423 ETH (then roughly $53 million) via Juicebox, becoming the largest DAO fundraiser on the platform at the time.
9 April 2022
AssangeDAO multi-signature wallet transfers 583.755 ETH without community approval, triggering fraud allegations and calls for legal action against the founding team.
29 March 2022
Certik publishes security assessment of Juicebox V2 contracts, flagging project owner's ability to send ETH to arbitrary addresses and recommending multi-sig and timelock controls.
24 May 2022
Medium-severity bug in JBFundingCycleStore triggered by successive reconfigurations in rolled-over funding cycles; contracts redeployed May 25 and project migration completed by May 28.
July 2022
Code4rena V2 audit identifies honeypot vulnerability allowing project owners to trap contributor funds.
20 September 2022
Juicebox V3 deployed to Ethereum mainnet following audits by PeckShield, Certik, and Code4rena.
23 October 2022
Code4rena competitive audit of Juicebox V3 closes; 13 unique vulnerabilities identified including 5 HIGH severity findings covering fund loss, reserve token underflow, honeypot exploitability, and NFT redemption weight miscalculation.
17 February 2023
JuiceboxDAO approves JBP-341 to address high-severity bug discovered during V3 JBX migration contract deployment.
21 February 2023
Juicebox V3.1 deployed to Ethereum mainnet with JBETHPaymentTerminal3_1 and JBController3_1 to address the high-severity migration bug and additional security risks.
22 May 2023
Code4rena audit of Juicebox Buyback Delegate closes; 3 medium-severity issues found including partial Uniswap V3 swap execution and slippage protection gaps.
30 June 2023
Juicebox V3.1.1 deployed, fixing low-severity payout revert bug and adding gas optimizations.
15 August 2023
Juicebox V3.1.2 deployed, fixing critical fee accounting error where protocol miscalculated expected deposit amounts after payout returns, leaving projects financially underfunded.
20 April 2026
Juicebox V3 suffers alleged $52,000 loss via a borrowFrom spoof attack on Ethereum, classified by DeFiLlama as a Protocol Logic exploit.
Decision Log
- slot 457846778 · hash 52vwWaNgnDigE5k987tFnob9JVECxe31kvATRVwyEfdd
- slot 455366733 · hash 3guoDPUb4Su4U63L86N2ZfTh3spkDuspfLXGh41ckwhP
- slot 424043684 · hash J7PhxdWvDpyJ6fZikHcWHuZ6dhFhSsgQYDB6i1jA1KqK
- slot 424043680 · hash E6aZnQ8rzEcE64JZHPYFVTyxfo482Q7fk9GvEhSAFGTi
- slot 422851207 · hash 4htsUf2W8hVwfXgcb3viPVC9Xio53qqvFak72R33wTSB
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 17 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:11 AM
last updated: 10/10/2026, 6:46:55 PM
6 viewsavoid.net — verified advice for a post-truth world