Briefing
A sophisticated economic exploit successfully drained Balancer V2’s Composable Stable Pools by weaponizing a subtle arithmetic precision flaw within the core invariant logic. This critical vulnerability allowed the attacker to artificially suppress the Balancer Pool Token (BPT) price, directly compromising the integrity of the protocol’s liquidity. The consequence was a rapid, multi-chain asset drain, resulting in a total loss of approximately $128.64 million in staked Ether derivatives and other assets across six separate blockchain networks.
Context
The protocol’s architecture, utilizing a centralized Vault contract to hold all liquidity, created a single point of failure where a bug in the pool logic could compromise all connected assets simultaneously. Despite Balancer V2 being considered battle-tested and having undergone multiple audits by top-tier security firms, the extreme complexity of its stable pool mathematics and the shared liquidity model left a subtle, yet catastrophic, attack surface open. The incident underscores the persistent risk posed by logic flaws in highly complex, unaudited mathematical functions.
Analysis
The attack vector leveraged a compounding rounding error in the _upscaleArray function, which handles token balance scaling during invariant computation. The attacker executed a single, atomic batchSwap transaction containing over 65 micro-swaps designed to push token balances to specific, microscopic (8-9 wei) rounding boundaries. This sequence amplified negligible precision losses caused by Solidity’s integer division, artificially underestimating the pool’s invariant (D value). By manipulating the invariant, the attacker suppressed the BPT price, allowing them to purchase undervalued BPT and immediately redeem it for full-value underlying assets, systematically extracting liquidity.
Parameters
- Total Loss Value → $128.64 Million (The total value of assets drained from affected pools across all chains.)
- Affected Component → ComposableStablePools (The specific Balancer V2 pool type containing the arithmetic logic flaw.)
- Attack Vector Root Cause → Arithmetic Precision Loss (A rounding error in the _upscaleArray function’s integer division.)
- Affected Chains → Six (Ethereum, Arbitrum, Base, Sonic, Optimism, and Polygon were impacted by the multi-chain exploit.)
Outlook
Immediate mitigation requires all protocols forked from or integrating Balancer V2’s Composable Stable Pool logic to halt operations and execute an emergency patch or migration, as demonstrated by the contagion risk to BEX and Beets. The industry must pivot from point-in-time code audits to continuous security validation and advanced economic attack modeling that specifically tests for the cumulative effect of micro-operations. This event establishes a new baseline → mathematical precision flaws, once deemed minor, must now be treated as critical, high-impact vulnerabilities.
