Incident
Incident,
5M.
Source: De.Fi incident database.
- Audits before it
- 1.
- Audits since
- 5, the latest dated 27 Sep 2023.
Bancor security record
As of 1 Nov 2026, Bancor has 6 audit reports by 4 security firms on Trustblock; the latest is by ChainSecurity, dated 27 Sep 2023. Those reports list no open critical findings. It also holds 2 incidents (latest 17 Jun 2020).
Critical findings
No open critical findings
Across the 6 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it. See the findings
Incident
Incident 17 Jun 2020
Source: De.Fi incident database. 5 audits have been published since. See the incidents
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Bancor V3 | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Bancor Carbon | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Bancor Compounding Rewards Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Bancor Liquidity | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Bancor Governence | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Bancor V2 AMM Security Audit | Security firm: Consensys | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · diligence.security |
Findings77
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 9 |
| Medium | 4 | 2 | 3 |
| Low | 22 | 5 | 31 |
MediumcalcExpDecayRewards is at risk of overflow reversionsBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportMediumLack of validationBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportMediumweightedAverage calculation might overflowBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportMediumUse of external calls with a fixed amount of gasBancor V2 AMM Security Audit · Consensys · 1 Jun 2020Open
The report gives no description here.
Open the reportLowGas SavingsBancor V3 · ChainSecurity · 27 Sep 2023Open
The report gives no description here.
Open the reportLowInconsistent Reentrancy ProtectionBancor V3 · ChainSecurity · 27 Sep 2023Open
The report gives no description here.
Open the reportLowDuplicated codeBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportLowenableProgram is overloadedBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportLowLack of event emissions after updating stateBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportLowuint32 times can overflow in the futureBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportShow 10 more
LowUnbounded number of programs could result in errorsBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Open
The report gives no description here.
Open the reportLowcheck-effect-patterns not followed when sending eBancor Liquidity · CertiK · 9 Oct 2020Open
`transfer` or `safeTransferFrom` is done before storage variables are updated.
Open the reportLowExternal calls inside a loopBancor Liquidity · CertiK · 9 Oct 2020Open
External calls in the loop may lead to issues with GAS costs of a transaction.
Open the reportLowInefficient greater-than comparison w/ zeroBancor Liquidity · CertiK · 9 Oct 2020Open
Within Solidity, unsigned integers are restricted to the non-negative range. As such, greater-than comparisons with the literal 0 are inefficient gas-wise.
Open the reportLowmaxSystemNetworkTokenAmount limit is mutable.Bancor Liquidity · CertiK · 9 Oct 2020Open
According to the documentation, `The system holdings cannot exceed 500K BNT worth of pool tokens in a pool`. In contrast, `maxSystemNetworkTokenAmount` is not a constant value and can be changed using `setSystemNetworkTokenLimits()` function.
Open the reportLowOld implementation of Ownable functionalityBancor Liquidity · CertiK · 9 Oct 2020Open
Implementation of Owned.sol comes from OpenZeppelin version 1.12.0, which is from 2018 and is no longer valid.
Open the reportLowUnneccessary if statementBancor Liquidity · CertiK · 9 Oct 2020Open
If statements can be simplified as `_newConverter.addReserve(ETH_RESERVE_ADDRESS, weight);` is repeated in both cases.
Open the reportLowUsage of `syncReserveBalances` in the beginning oBancor Liquidity · CertiK · 9 Oct 2020Open
`syncReserveBalances` is called at the start of many functions.
Open the reportLowUsage of uint16 in for loopsBancor Liquidity · CertiK · 9 Oct 2020Open
`uint16` is not optimal use for `for loop`.
Open the reportLowUse of an assertBancor Liquidity · CertiK · 9 Oct 2020Open
assert() uses all gas available in the transaction. The assert() function should only be used to test for internal errors and check invariants. Within Solidity, unsigned integers are restricted to the non-negative range. As such, greater-than comparisons with the literal 0 are inefficient gas-wise.
Open the reportShow 6 more
LowUse of transfer() for sending ETHBancor Liquidity · CertiK · 9 Oct 2020Open
After EIP 1884 was included in the Istanbul hard fork, it's not recommended to use .transfer() and .send() as this function's a hard dependency on gas costs make them obsolete as they are forwarding a fixed amount of gas 2300 . This can cause some issues when sending ether to a contract. send and transfer do not longer protect from reentrancies in case of gas price changes.
Open the reportLowUse of two arrays instead of a mappingBancor Liquidity · CertiK · 9 Oct 2020Open
As the `addLiquidity` , `removeLiquidity` and `verifyLiquidityInput` functions all accept an array of token addresses and an array of amounts that are associated with each other, it makes code harder to review and read.
Open the reportLowCustom implementation of access control logicBancor Governence · CertiK · 9 Oct 2020Open
`Owned.sol` contract seems to implement it's own logic for access control instead of relying on openzeppelin's `Ownable.sol` contract
Open the reportLowIncorrect version of solidityBancor Governence · CertiK · 9 Oct 2020Open
The linked contracts necessitate a version too recent to be trusted. Consider deploying with 0.6.11. We do not recommend using any latest version for deployment, specially if changes were made in the optimizer or the language semantic. Version 0.6.12 made changes to optimiser that's why we do not recommend using this version.
Open the reportLowInefficient greater-than comparison w/ zeroBancor Governence · CertiK · 9 Oct 2020Open
Within Solidity, unsigined integers are restricted to the non-negative range. As such, greater-than comparisons with the literal 0 are inefficient gas-wise
Open the reportLowVariable tight packingBancor Governence · CertiK · 9 Oct 2020Open
Variables in the `struct` Proposal can be tightpacked
Open the reportIncidents2
Attached through a shared contract address. Our incident data ends in Oct 2026.
Incident
Incident,
5M.
Source: De.Fi incident database.
- Audits before it
- 0.
- Audits since
- 6, the latest dated 27 Sep 2023.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="bancor"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us