Recent Exploit of Balancer V1 Liquidity Pool
On August 31, a Balancer V1 liquidity pool fell victim to an exploit that saw approximately $234,000 drained due to a rounding error within the protocol. This incident has drawn parallels to a much larger exploit from last November, where Balancer faced a significant loss of $116 million across its V2 pools, stemming from similar vulnerabilities.
Details of the Attack
The recent breach was highlighted by the blockchain security firm Slowmist, which noted that this attack, while financially less severe than last year’s, showcases the recurring nature of these flaws. The exploit specifically targeted the pool’s joinswapPoolAmountOut function, which allows users to determine how many Balancer Pool Tokens (BPT) to receive, requiring the protocol to compute the necessary input tokens.
The calculation process, managed by the function calcSingleInGivenPoolOut, employs an 18-decimal fixed-point arithmetic. The attacker managed to significantly deplete the pool’s WBTC (Wrapped Bitcoin) reserves through a series of public swaps. As the reserves dwindled, the calculation inadvertently rounded the required input down to just 1 satoshi of WBTC—equivalent to a minuscule fraction of a cent—despite the contract still minting the whole BPT amount requested by the attacker.
Security Oversights
Slowmist pointed out that the pool lacked essential protective measures that could have prevented the hack. These included:
- A minimum effective input requirement
- A minimum pool balance
- Checks for relative error validation during swaps
Alarmingly, it was noted that the MIN_BALANCE condition was enforced only during the bind and rebind processes, and not during standard trading operations. In its report, Slowmist released both the wallet address controlled by the attacker and the contract address leveraged in the exploit.
Impact on Balancer Labs
Earlier this year, in March, Balancer Labs, responsible for the protocol, announced its decision to dissolve as a corporate entity. This move came in response to increasing legal pressures following the November incident, which drastically reduced the protocol’s total locked value from approximately $775 million to about $300 million. Co-founder Fernando Martinelli indicated that operations would shift to a more streamlined DAO framework, aiming to move past the liabilities linked to previous security breaches. Notably, the wallet associated with the earlier hack has remained active, with a transaction of 1,100 ETH occurring five months post-exploit.
Broader Implications in DeFi
The recent exploit involving the V1 pool affected WBTC, a tokenized form of Bitcoin. This serves as a reminder that while Bitcoin’s market price hovers around $78,000, its wrapped versions utilized in decentralized finance (DeFi) platforms introduce a distinct array of risks. In a related context, the metaverse platform The Sandbox recently reported an incident involving an exploited bridge, which permitted an attacker to create unsupported SAND tokens on both Base and BNB chains, further illustrating the vulnerabilities present in the DeFi ecosystem.
