Balancer V1 pool exploited for $234k via a rounding flaw that allowed an attacker to mint cheap BPT tokens.
Security & Exploits ·
A Balancer V1 liquidity pool lost approximately $234,000 through an exploitation of a rounding vulnerability in its token-minting logic. The attack leveraged the joinswapPoolAmountOut function, which allows callers to specify desired BPT output while the protocol reverse-computes the required token input using fixed-point math. After the attacker artificially compressed WBTC reserves to negligible levels via public swaps, the input calculation rounded down to just 1 satoshi of WBTC, yet the full BPT amount was still minted to the attacker's address.
The vulnerability stemmed from missing safeguards: no minimum effective input threshold, no minimum pool balance check, and no relative-error validation. The protocol only enforced a MIN_BALANCE constant during initial pool binding and rebinding operations. The attacker deployed nested flash loans from Spark, Aave, Morpho, and Uniswap V3 to fund the WBTC reserve compression phase, then minted approximately 4,408.8 BPT tokens at the artificially depressed rate before exiting proportionally to drain DPI, USDC, WETH, and WBTC from the pool.
The attack was executed by address 0x338c7ec9befbb451d66fd8a468c32184f5689a41 using a dedicated contract at 0x9caa8d0e44b22f50057d2f4ce0d1446529e11be3 against the vulnerable pool at 0x2257aaac34bcb27900291f7b84ee2565a6cbac57. No statement on remediation or user compensation has been detailed.