Bancor Network v0.6 smart contract lacked authentication on the 'from' address parameter, allowing anyone to use stored token approvals to steal user funds. The Bancor team conducted a self-exploit withdrawing $409,656, but front-runners capitalized on the same vulnerability extracting an additional $135,229 before patch deployment.