Incident
Incident,
5M.
Source: De.Fi incident database.
- Audits before it
- 1.
- Audits since
- 5, the latest dated 27 Sep 2023.
Bancor security record
As of 2 Nov 2026, Bancor has 6 audit reports by 4 security firms on Trustblock; the latest is by ChainSecurity, dated 27 Sep 2023. Those reports list no open critical findings. It also holds 2 incidents (latest 17 Jun 2020).
Critical findings
No open critical findings
Across the 6 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it. See the findings
Incident
Incident 17 Jun 2020
Source: De.Fi incident database. 5 audits have been published since. See the incidents
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Bancor V3 | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Bancor Carbon | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Bancor Compounding Rewards Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Bancor Liquidity | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Bancor Governence | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Bancor V2 AMM Security Audit | Security firm: Consensys | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · diligence.security |
Findings77
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 9 |
| Medium | 4 | 2 | 3 |
| Low | 22 | 5 | 31 |
CriticalOracle updates can be manipulated to perform atomic front-running attackBancor V2 AMM Security Audit · Consensys · 1 Jun 2020Fixed
The report gives no description here.
Open the reportHighOracle ManipulationBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportHighOverflow Might DOS the AppBancor Carbon · ChainSecurity · 10 Apr 2023Fixed
The report gives no description here.
Open the reportHighPrice Precision Very Low for Some TokensBancor Carbon · ChainSecurity · 10 Apr 2023Fixed
The report gives no description here.
Open the reportHighreducedFraction does not reduce in the mathematical senseBancor Compounding Rewards Audit · OpenZeppelin · 6 Sep 2022Fixed
The report gives no description here.
Open the reportHighFront-running Attack VectorBancor Governence · CertiK · 9 Oct 2020Fixed
`tallyVotes` function (L390 - L405) which is executed in the `execute` function (L370 - L383) is marked as a public function. During the `execute` function, `tallyVotes` changes the `proposals[_id].open` property from `true` to `false`. This param is used in the `proposalEnded` modifier, leading to an `ERR_NOT_OPEN` throw if the proposal is closed and reverting the transaction. `tallyVotes` can be called by anyone who knows the `id` of the proposal to close it and thus stoping further execution of the proposal. This attack vector is especially exploitable via a front-running attack whereby one inspects the transaction mempool of Ethereum, detects an `execute` contract call and invokes `tallyVotes` beforehand with a higher gas fee.
Open the reportHighVote ManipulationBancor Governence · CertiK · 9 Oct 2020Fixed
The `unstake` and `revokeVotes` functions affect the `totalVotes` variable of the contract, however they do not adjust already-voted-on proposals. This leads to proposals reporting invalid quorums and total votes available as they are re-set on each vote. This is especially exploitable in case a proposal's expiration is before the vote lock mechanism, meaning a double-vote can occur without losing balance. To replicate this issue, simply `stake` some new tokens for 2 different accounts. Have account A vote for a proposal and then instantly revoke his votes and have account B vote against a proposal. The `totalVotesAvailable` and `quorum` variables of the proposal will be incorrect, leading to invalid calculations on all functions relating to a proposal's acceptance.
Open the reportHighLoss of the liquidity pool is not equally distributedBancor V2 AMM Security Audit · Consensys · 1 Jun 2020Fixed
The report gives no description here.
Open the reportHighOracle front-running could deplete reserves over timeBancor V2 AMM Security Audit · Consensys · 1 Jun 2020Fixed
The report gives no description here.
Open the reportHighSlippage and fees can be manipulated by a traderBancor V2 AMM Security Audit · Consensys · 1 Jun 2020Fixed
The report gives no description here.
Open the reportShow 10 more
MediumBNT Burned TwiceBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportMediumLocked vBNTBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportMediumPool Denial of ServiceBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowAutoCompoundingRewards Can Burn More Pool Tokens Than ExpectedBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowBNT Deposit Allows msg.value > 0Bancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowBNTPool.renounceFunding Fails on Insufficient BNT Pool Token BalanceBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowConsistency Issues Between Implementation, Excel Demonstration and Documentation Regarding the WithdrawalBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowDifferent Programs Can Share the Same RewardBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowEmission of Events With Arbitrary AmountsBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowERC20Permit HandlingBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowImpossible to Migrate ETH PositionBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowInconsistent NamingBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowInconsistent Use of ERC20.transferBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowMisleading CommentBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowMisleading Comment in PoolCollection.enableTradingBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowProblematic Loop Continuation During Pool MigrationBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowUndocumented BehaviorBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowUnused Imports / VariablesBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowWrong Function Name in BancorPortalBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportLowWrong InterfaceBancor V3 · ChainSecurity · 27 Sep 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowMissing EventsBancor Carbon · ChainSecurity · 10 Apr 2023Fixed
The report gives no description here.
Open the reportLowNo Function for Fee WithdrawalBancor Carbon · ChainSecurity · 10 Apr 2023Fixed
The report gives no description here.
Open the reportLowRead-only ReentrancyBancor Carbon · ChainSecurity · 10 Apr 2023Fixed
The report gives no description here.
Open the reportLowZero Amount ERC20 TransfersBancor Carbon · ChainSecurity · 10 Apr 2023Fixed
The report gives no description here.
Open the reportLowIncorrect version of solidityBancor Liquidity · CertiK · 9 Oct 2020Fixed
The linked contracts necessitate a version too recent to be trusted. Consider deploying with 0.6.11. We do not recommend using any latest version for deployment, especially if any changes were made in the optimizer or the language semantic. Version 0.6.12 made changes to optimizer that's why we do not recommend using this version.
Open the reportLowLocal variable shadowingBancor Liquidity · CertiK · 9 Oct 2020Fixed
`address owner = liquidity.owner;` shadows `owner` variable from `Owned.sol` which is public one and contract inherits from it.
Open the reportLowUnefficient ReentrancyGuard implementation.Bancor Liquidity · CertiK · 9 Oct 2020Fixed
ReentrancyGuards.sol implementation is un-optimal as booleans are more expensive than uint256 or any type that takes up a full word because each write operation emits an extra SLOAD to first read the slot's contents, replace the bits taken up by the boolean, and then write back.
Open the reportLowUsage of literals instead of constant variablesBancor Liquidity · CertiK · 9 Oct 2020Fixed
Literals with many digits are difficult to read and are hard to maintain in terms of code changes.
Open the reportLowUse of safemath is required in arithmetic operatBancor Liquidity · CertiK · 9 Oct 2020Fixed
SafeMath is not used on arithmetic operations. This can lead to potential overflow/underflow. `LiquidityPoolV1Converter.sol` and `LiquidityProtection.sol` does many math operations on uint256 but is not using SafeMath.
Open the reportLowVariable from function param used on it's ownBancor Liquidity · CertiK · 9 Oct 2020Fixed
`_version` variable from param is used on its own.
Open the reportShow 4 more
LowComparison to a boolean constantBancor Governence · CertiK · 9 Oct 2020Fixed
The `onlyVoter()` modifier uses a boolean value to compare with a boolean literal.
Open the reportLowDuplication of the codeBancor Governence · CertiK · 9 Oct 2020Fixed
modifiers `proposalNotEnded` and `proposalEnded` share the same code in the first `require` which could be put into its own modifier code. This can cause some confusion and potential issues when one code block is updated and other one not.
Open the reportLowMark external calls safe / no safeBancor Governence · CertiK · 9 Oct 2020Fixed
`IExecutor(proposals[_id].executor).execute(_id, forRatio, againstRatio, quorumRatio)` function call is an external function call. While re-entrancy is not possible for the `execute` function of the `BancorGovernance` contract, other unintended re-entrancy interactions may occur by the external contract should the quorum of Bancor not have vetted its code properly.
Open the reportLowUse of assert statement for input validationBancor V2 AMM Security Audit · Consensys · 1 Jun 2020Fixed
The report gives no description here.
Open the reportIncidents2
Attached through a shared contract address. Our incident data ends in Oct 2026.
Incident
Incident,
5M.
Source: De.Fi incident database.
- Audits before it
- 0.
- Audits since
- 6, the latest dated 27 Sep 2023.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="bancor"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us