Balancer has released a Vulnerability Disclosure Report: Bulk Exchange Trade Rounding Logic Error Exploited

BlockBeats News, November 6th, according to official sources, Balancer has released a preliminary report on the exploit incident. The report indicates that Balancer V2's Composable Stable Pool was attacked on November 4th across multiple chains (including Ethereum, BSC, Avalanche, Polygon, Arbitrum, etc.). The exploit originated from a rounding error in the EXACT_OUT transaction logic during batchSwap, allowing the attacker to manipulate the pool balances and withdraw assets. This incident only affected Balancer V2's Composable Stable Pool, with Balancer V3 and other pool types remaining unaffected.

The Balancer team swiftly collaborated with security partners and white-hat teams to take action. Through measures such as automatic pause via Hypernative, asset freezing, and white-hat interventions under the SEAL framework, they successfully contained the attack and recovered some assets. StakeWise has recovered approximately 73.5% of the stolen osETH, while teams like BitFinding and Base MEV bot assisted in the recovery of some funds.

Currently, Balancer is working with security partners such as SEAL and zeroShadow to conduct cross-chain tracking and fund recovery. The final assessment of losses and recovery data will be disclosed in a comprehensive technical retrospective report. Users are reminded to only trust information confirmed through official Balancer channels, as V3 and non-stable pool operations remain secure.