OAK — OnChain Attack Knowledge

Worked example · 2020-06

Bancor v0.6 BancorNetwork exposed-approval vulnerability — Ethereum — 2020-06-18

Loss
approximately $455K of user funds were at risk and were moved by Bancor in a white-hat rescue; two arbitrage bots front-ran the rescue transactions and captured about $135K [theblock1]. Decrypt reported about $410K rescued by Bancor, about $132K taken by a "friendly" front-runner and just over $3K by another [decrypt1]. Return of the front-runners' funds was unconfirmed at the time of reporting [theblock1][decrypt1].
OAK Techniques observed
OAK-T9.004 (Access-Control Misconfiguration — the v0.6 contracts "mistakenly made a safeTransferFrom function in the BancorNetwork contract public", letting anyone move tokens that users had approved to the contract [theblock1]). OAK-T16.006 (Timelock-Free Protocol Upgrade Execution — retained from the original classification; the cited sources do not describe the upgrade process, so this mapping is unverified).
Attribution
pseudonymous — the actors were Bancor's own rescue team and two automated front-running bots; no malicious exploitation was reported [decrypt1].
Key teaching point
A routine contract upgrade that accidentally exposed a transfer function turned every outstanding token approval to the BancorNetwork contract into a liability; users who had traded in the previous 48 hours were at risk until they revoked approvals. The case also shows that a white-hat rescue is visible in the public mempool and can be front-run by bots.
Corrected 2026-10-11
The original described a reserve-accounting logic bug in BancorConverter drained by an unnamed white-hat researcher who returned $460K (12.5 ETH + ~229K USDT) within 24 hours; sources instead describe a publicly exposed safeTransferFrom in BancorNetwork v0.6 exploiting user approvals, a Bancor-run rescue, and front-running bots. The researcher, v0.6.1 patch, fund-return and 2020-06-20 post-mortem details were removed as unsupported.

Summary

Bancor deployed v0.6 of its BancorNetwork contracts on 2020-06-16. The contracts "mistakenly made a safeTransferFrom function in the BancorNetwork contract public", so anyone could use users' existing token approvals to move their tokens [theblock1]``[decrypt1]. Bancor discovered the problem around midnight GMT into 2020-06-18 and warned its community [decrypt1].

Bancor ran a white-hat operation, moving roughly $410K-$455K of exposed user funds to a safe wallet in batched transactions; two arbitrage bots detected the pending transactions and front-ran them, earning about $135K [theblock1]``[decrypt1]. Bancor deployed a patched network contract and told users who had traded in the previous 48 hours to revoke their approvals to the old contract [theblock1]``[decrypt1]. Bancor contacted the bot owners seeking return of funds in exchange for a bug bounty [theblock1].

This is distinct from the July 2018 Bancor compromise (see examples/2018-07-bancor.md), which was a custody-layer incident.

Timeline (UTC)

When Event OAK ref
2020-06-16 Bancor deploys v0.6 contracts with a publicly callable safeTransferFrom in BancorNetwork T9.004
2020-06-17/18 Bancor discovers the issue (around midnight GMT) and rescues exposed funds in batched transactions; two bots front-run (defender response)
2020-06-18 Patched contract deployed; users told to revoke approvals; Bancor seeks return of the front-run funds (remediation)

Realised extraction

About $135K was captured by two front-running bots per The Block; Decrypt gave about $135K combined ($132K + $3K). Whether it was returned is not established in the cited sources [theblock1]``[decrypt1].

Public references

Techniques demonstrated (2)