On April 20, 2026, Juicebox V3 REVLoans was exploited for 21.77 ETH (~$52,000). Attacker exploited unvalidated source struct in borrowFrom to forge accounting context; by matching forged and destination currencies, attacker bypassed oracle and priced loan against inflated share price using attacker-controlled decimals.

Juicebox V3 (via its REVLoans borrowing extension) was exploited through a borrowFrom Spoof Attack. The vulnerability stemmed from insufficient validation in the borrowFrom function, particularly the caller-supplied "source" parameter (a REVLoanSource struct with .terminal and .token). This allowed forging an accounting context; when currency matched the destination, the protocol skipped the oracle and used attacker-controlled decimals/balances, enabling borrowing at an inflated share price. The attack used two transactions (one to seed fake accounting, one to drain against a legitimate terminal), draining approximately 21.77 ETH (worth ~$52,000).