Rounding Error in Linear Pools Costs Balancer $2.1M Across Three Chains

Balancer, together with its partner protocol Beethoven X, lost a combined $2.1 million from v2 Boosted pools spread across Ethereum, Optimism, and Fantom the previous Sunday.

Timeline of the disclosure and the loss

Balancer first flagged the issue with a public warning, stating that it had received a report of a critical vulnerability affecting a number of V2 pools. The team said emergency mitigation had already secured most of the at-risk TVL, though some funds remained exposed, and urged users to withdraw liquidity from the affected pools immediately.

Publishing the list of vulnerable pools appears to have drawn attention from opportunistic attackers searching for an entry point. A subsequent update from Balancer reported that over 99% of the at-risk TVL had by then been secured, leaving only about $565,000 still exposed. Despite that, $2.1 million ultimately went missing — with the exploits occurring five days after the initial disclosure that had advised withdrawals. Credit for tracking the incident goes to Balancer, Peckshield, and Beosin.

At the time of initial reporting, Balancer had not released a formal post-mortem, and the precise attack vector was being withheld out of concern that remaining funds could still be at risk.

Later updates on root cause

On September 14, 2023, with Balancer's official report still not published, BlockSec released its own detailed incident analysis. BlockSec concluded that the root cause was price manipulation stemming from rounding-down logic within the linear pool, which in turn corrupted the cached token rate relied upon by the corresponding boosted pool. BlockSec explained its decision to publish ahead of Balancer's own report by noting that three weeks had passed since the original disclosure and two weeks since the exploits themselves, adding that the episode highlighted the broader difficulty of notifying every project that had forked the vulnerable code in time.

Roughly four hours after BlockSec's post, also on September 14, 2023, Balancer released its own in-depth technical post-mortem.

Response and mitigation

Balancer's team followed a defined incident-response process aimed at limiting further losses: alongside publishing which pools were at risk, they updated the front-end UI to show users directly whether their deposits were among the affected positions.

Exploiter addresses identified:

• 0xB23711b9D92C0f1c7b211c4E2DC69791c2df38c1 (Ethereum)
• 0xed187f37e5ad87d5b3b2624c01de56c5862b7a9b (Ethereum)
• 0x429313e53a220c4a5693cad1da26ae5045b5762f (Ethereum)
• 0x64E08fa89C2bAE9F123cc8a293775f0E6CC86760 (Fantom)
• 0xBC794F1ff9AD7711A9d2E69Be5b499e290B8fD3c (Optimism)

Balancer has undergone audits from several security firms, but the Boosted pools were not within the scope of any of the published reports.

Historical context

This was not Balancer's first security incident. In 2020, the protocol lost $500,000 in a flashloan attack involving non-standard, deflationary ERC20 tokens — an event that predated rekt.news' coverage. This latest loss marks Balancer's first appearance on rekt.news' incident leaderboard, joining other long-established protocols such as Curve that have also recently suffered exploits, as tracked on the leaderboard.