中文
Bridge review

Bungee (Socket) review

Aggregator and intent marketplace — Socket routes through off-chain fillers, solvers and bridges; Bungee is its consumer app

Snapshot Cartoon avatar of Arnold BurnBy Updated Not enough data · 0/5 routes in 7 d

Key findings

Bungee is the consumer app of Socket, a cross-chain routing network. Socket's v3 API sends your order to a marketplace of off-chain fillers, solvers and provers, and in our quotes it also routed through bridges such as Across, Relay, Mayan and Circle CCTP. Socket says it adds no fee for users; the public API endpoint we use embeds a 0.2% integrator fee. In January 2024 a faulty new route in SocketGateway let an attacker drain ≈ $3.3M from wallets with infinite approvals. Our Socket quotes are currently paused pending an API key.

As of 3 Nov 2026, 11:35 UTC (run #540) our packet has no quotes attributed to Bungee (Socket), so there is not enough data for a price assessment. Real-money tests: none yet — planned after launch.

Source: upswap.io snapshot #540 · CC BY 4.0 · Zenodo DOI: Example / pending

How does Bungee (Socket) work?

You request a quote with origin and destination chains. Socket routes the order through a marketplace of off-chain agents — fillers, solvers and provers — that compete to execute it; the winner bridges the asset and delivers it to your receiver address. If the quote includes an approval, you approve the spender before submitting the transaction (Socket docs).

The older Bungee v1 API (returned HTTP 410 in our tests on 19 October 2026) used the SocketGateway router contract, which was the target of the January 2024 exploit.

What are the risks of using Bungee (Socket)?

sources checked 2026-10-24

Each item links to its source (L2Beat, DefiLlama or official docs). Items we could not verify are marked 待核实. No overall score.

  • Approval risk

    On 16 January 2024 a newly added SocketGateway route that did not validate user input let an attacker pull ≈ $3.3M from wallets with infinite approvals; Socket paused the route quickly. Always check the spender in the quote's approval and approve exact amounts.

    HalbornCertiK

  • Solver and bridge risk

    Delivery depends on whichever off-chain agent or underlying bridge wins the route; check that bridge's own risk card.

    Socket

  • Upgrade authority

    The contracts Socket lists today — AllowanceHolder (which receives approvals) and OpenRouter — are verified, not behind proxies and have no owner or admin functions, so they cannot be upgraded. The legacy SocketGateway (Bungee v1, the 2024 exploit target) is different: its owner, a single externally owned account on Ethereum, can add routes instantly with no timelock, so revoke old approvals to it. Socket publishes audit reports.

    SocketBlockscoutBlockscoutBlockscoutSocket

What fees does Bungee (Socket) charge?

Socket fee
Socket says it charges users no additional fee and the API is free; integrators may add their own fee (feeBps). Socket
Underlying costs
On-chain execution costs are included in the quoted fees. Socket

In our tests (19 October 2026) the public endpoint public-backend.socket.tech embedded feeBps = 20 (0.2%) in every quote and did not allow 0; we record it as an integrator fee. Socket quotes on upswap are paused until we have an API key for the dedicated endpoint.

How did its quotes perform in our data?

run #540

No quotes from Socket / Bungee (v3) in run #540. not enough data

Has upswap tested it with real money?

Not yet. Real-money tests are planned after launch; no test wallets or transactions are published yet.

What are the pros and cons?

Pros

  • Routes through many bridges and an off-chain solver marketplace.
  • No Socket fee for users per its docs.
  • Published audit reports.

Cons

  • January 2024 approval exploit of the SocketGateway router.
  • Public endpoint embeds a 0.2% integrator fee.
  • Legacy SocketGateway is controlled by a single key that can add routes instantly.

Who is Bungee (Socket) for?

Useful as a second aggregator to cross-check routes; check the approval spender and prefer exact approvals.

Has it been hacked?

Incident library →

Which official links are verified?

  • Bungee app www.bungee.exchange · checked 2026-10-24
  • Socket docs docs.socket.tech · checked 2026-10-24
  • Fees docs.socket.tech/about/fees-monetization · checked 2026-10-24
  • Audits docs.socket.tech/about/audits · checked 2026-10-24

What is still unverified?

  • 待核实 Ownership of SocketGateway and the current contracts on chains other than Ethereum.
  • 待核实 Socket quotes: paused pending a dedicated-endpoint API key.

Sources

  1. Bridging — Socket · Docs · checked
  2. Fees & Monetization — Socket · Docs · checked
  3. Audits — Socket · Docs · checked
  4. Explained: The Socket Protocol Hack (January 2024) — Halborn · Security firm · checked
  5. Socket Tech Incident Analysis — CertiK · Security firm · checked
  6. Bungee — protocol page — DefiLlama · Database · checked
  7. Contract Addresses — Socket · Docs · checked
  8. AllowanceHolder 0x50c4…5909 — verified contract (Ethereum) — Blockscout · Database · checked
  9. OpenRouter 0x50cF…5c4a — verified contract (Ethereum) — Blockscout · Database · checked
  10. SocketGateway 0x3a23…97a5 — verified contract (Ethereum) — Blockscout · Database · checked

Changelog

  • — Draft review written from Socket docs, Halborn and CertiK; quotes paused pending API key.

How do I cite this page?

Burn, A. / upswap.io (2026). Bungee Exchange and the Socket routing API review. Updated 2026-10-24. https://upswap.io/bridges/bungee-socket#summary. CC BY 4.0. Accessed ____.

Stable anchors: #summary #type #risk #fee-structure #performance #tests #pros-cons #fit #incidents #official #sources #changelog #disclosure #cite