Briefing
The Balancer V2 protocol suffered a sophisticated, multi-chain exploit targeting its Composable Stable Pools, resulting in a catastrophic loss of user liquidity and a systemic depeg of integrated assets. The attack weaponized a subtle, asymmetric rounding error in the pool’s scaling logic, allowing the attacker to systematically erode the pool’s invariant without triggering standard safeguards. This precision-engineered vulnerability, executed via atomic batchSwap transactions, led to a total asset drain of approximately $128.64 million across nine different blockchain networks.
Context
Balancer V2’s architecture, which utilizes a centralized Vault to separate token storage from pool logic, was designed for capital efficiency but introduced a single point of failure for core pool math. The prevailing risk in stable-asset AMMs remains the exploitation of low-liquidity states, where seemingly negligible precision errors in integer arithmetic can be amplified into catastrophic invariant manipulation. This incident demonstrates that even well-audited protocols are vulnerable to compound logic flaws that span multiple system components.
Analysis
The compromise centered on a mathematical flaw → an asymmetric rounding bias in the _upscale function within the Composable Stable Pool contract. The attacker first positioned the pool into an extremely low-liquidity state by swapping tokens to a wei-level rounding cliff. Next, they executed a carefully calibrated batchSwap sequence that repeatedly exploited the rounding down behavior, which under-calculated the required input amount for a given output.
This systematic precision loss compounded over dozens of micro-swaps, enabling the attacker to silently siphon value from the pool’s internal balance before a final withdrawal. The attack was atomic, leveraging the batchSwap function’s deferred settlement to bypass single-swap guards.
Parameters
- Total Funds Drained → $128.64 million – The cumulative value lost across all affected Composable Stable Pools.
- Vulnerability Type → Arithmetic Precision Loss – A subtle rounding error in the pool’s scaling function.
- Affected Chains → Nine – The total number of networks where the vulnerable V2 pools were deployed, including Ethereum, Arbitrum, and Base.
- Attack Method → Batched Micro-Swaps – The technique used to repeatedly compound the rounding error in a single, atomic transaction.
Outlook
Immediate mitigation requires all protocols leveraging Balancer V2’s Composable Stable Pool logic to halt and migrate funds to patched contracts, regardless of their pause window status. The primary second-order effect is a heightened contagion risk for all AMMs that utilize rate-augmented or complex integer arithmetic in their invariant calculations. This event will establish a new security best practice mandating formal verification specifically focused on boundary conditions and precision loss in low-liquidity, multi-component swap logic.
Verdict
This $128 million exploit confirms that the most critical vulnerabilities in DeFi are no longer simple reentrancy attacks, but complex, systemic logic flaws at the intersection of integer math, pool design, and multi-chain deployment.
