A vulnerability discovered on Bancor on June 18 would have allowed hackers to simply drain the funds of anyone who interacted with its smart contracts. The exploit relied on the concept of withdrawal authorization, introduced in the ERC-20 standard. This allows various Ethereum (ETH) DApps to automatically withdraw money from users’ wallets.
As Oded Leiba, a research engineer at ZenGo, wrote, the fund withdrawal function on Bancor’s smart contract was mistakenly set so that anyone could call it.