DeFi protocol Balancer has confirmed that its V2 version was indeed breached on October 14. The breach incident has drained over $128 million from the protocol, security research firm PeckShield has disclosed.
The attack impacted multiple chains including Base, Sonic, Optimism, and Polygon among others. Staked ETH tokens were also drained from the protocol.
The exploit is being linked to a “rounding error” detected in Balancer V2 liquidity pools, a DeCrypt report said, citing Nansen. The attacker essentially initiated multiple swaps pushing the fund pools towards rounding error. Following this, Balancer’s liquidity pool token was undervalued by the liquidity pool.
Acknowledging the development, Balancer said that the breach had hit the composable stable pools from Balancer’s V2 version. For now, the platform claimed it is working with security researchers to issue and share detailed findings “as soon as possible”.
“Balancer has undergone extensive auditing by top firms, and had bug bounties running for a long time to incentivize independent auditors. We are working closely with our security and legal teams to ensure user safety and are conducting a swift & thorough investigation,” Balancer noted.
Following the attack, liquid staking protocol StakeWise DAO claimed that it has recovered “5,041 osETH (~$19 million) and 13,495 osGNO (~$1.7 million) tokens from the Balancer exploiter”. Balancer reshared StakeWise’s claim without adding any new information on it.
A number of members from the Web3 community have shared their analysis on how the attack could have happened.
“The attack exploited a rounding-down precision loss in Balancer Vault’s swap calculations. Each calculation rounded down, affecting token prices. The batchSwap function amplified this vulnerability, allowing attackers to manipulate prices through crafted parameters,” GoPlus Security posted on X.
Smart contract audits firm Zealynk has called this attack an “architectural inevitability”. It said that when it had audited Balancer in October, it had warned that V2 version’s “cross-contract trust boundary” was vulnerable.
The situation is still unfolding and elaborate details on the situation remains awaited for now.