xToken hack — May 2021

On 12 May 2021 an attacker drained the Bancor and Balancer liquidity pools backing two xToken products, xBNTa and xSNXa, in a single Ethereum transaction. xToken issued wrapped tokens giving holders exposure to yield strategies built on Bancor's BNT and Synthetix's SNX.

Both legs turned on missing validation. The xBNTa contract converted incoming ETH to BNT using a trade path supplied by the caller but never checked that the path ended in BNT. The attacker routed through an unrelated token so the contract credited itself with a BNT contribution it had not received, permitting an effectively unlimited mint. The xSNXa contract valued its holdings without an independent price feed, so the attacker took a flash loan, which The Block put at 61,800 ETH or roughly $270 million at the time, to push the SNX price down and mint xSNXa at a distorted rate. The new tokens were sold into the two pools, which were emptied.

The Block Research's Igor Igamberdiev itemised the attacker's proceeds as about 2,400 ETH, 781,000 BNT and 407,000 SNX, roughly $24.5 million combined, executed for around 5 ETH in gas. Mudit Gupta independently reached comparable figures for the SNX and BNT legs. xToken's own report put the pool losses at about $25 million and said the xSNXa contract itself lost 416 ETH, 7 to 8 percent of its net asset value, with most underlying SNX and BNT remaining in the contracts.

xToken paused all minting, took a pre-exploit snapshot covering token holders and the Bancor and Balancer liquidity providers, and reissued new xBNTa and xSNXa tokens. It hardcoded trade paths and added Chainlink pricing, reviewed by Quantstamp. A separate xToken exploit followed in August 2021.