Briefing
The Balancer V2 Composable Stable Pools protocol suffered a critical exploit stemming from a faulty access control mechanism within its core vault architecture. This systemic vulnerability allowed a threat actor to execute unauthorized internal withdrawal commands, resulting in the immediate and irreversible drain of user-deposited assets across multiple chains. The cross-chain attack has led to an estimated total loss of approximately $128 million, making it one of the largest DeFi security incidents of 2025.
Context
The Balancer V2 Vault was considered a hardened system, having undergone at least eleven extensive security audits by multiple top-tier firms over its lifecycle. Despite this rigorous review, the underlying complexity of composable finance architectures maintained a subtle attack surface where intricate, multi-step contract logic could mask a simple but devastating access control flaw.
Analysis
The attack vector leveraged a logic check failure in the V2 Vault’s manageUserBalance function, which incorrectly validated the identity of the user initiating a transaction. By manipulating the check between msg.sender and a user-supplied op.sender , the attacker effectively impersonated authorized liquidity providers. This allowed the perpetrator to execute the WITHDRAW_INTERNAL operation, bypassing all permissions to quietly empty the internal balances of multiple Composable Stable Pools across seven different blockchain networks.
Parameters
- Total Funds Drained → $128 Million (The estimated total value of assets stolen across all affected chains.)
- Vulnerability Type → Faulty Access Control (A logic error in the manageUserBalance function allowing unauthorized withdrawals.)
- Affected Contracts → V2 Composable Stable Pools (The specific pool type targeted; V3 pools were unaffected.)
- Partial Recovery → $19.3 Million (The amount of osETH recovered by StakeWise DAO using emergency contract calls.)
Outlook
Protocols utilizing the Balancer V2 codebase or similar complex vault architectures must immediately halt vulnerable pools and conduct a comprehensive review of all access control and internal balance management functions. This incident establishes a new security mandate → that even multi-audited codebases require continuous, adversarial formal verification, particularly around state-changing functions. The event will accelerate the industry’s shift toward more resilient, pause-enabled V3-style designs and increase scrutiny on the security limits of composable DeFi.
Verdict
This exploit serves as a definitive validation that audit quantity does not equal security, underscoring the critical need for formal verification of complex access control logic in all high-value DeFi vaults.
