Leaderboard
751All-time rank
Bancor V3
Jun 18, 2020
$545K
Lost
$545K
Recovered
$0
Net loss
$545K
Unrecovered0% recovered
6 smart contract lacked authentication on the 'from' address parameter, allowing anyone to use stored token approvals to steal user funds. The Bancor team conducted a self-exploit withdrawing $409,656, but front-runners capitalized on the same vulnerability extracting an additional $135,229 before patch deployment.
How the exploit worked
View reproducible PoCAccess Control.
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jun 18, 2020Exploit executed — $545K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)