The Rounding-Error Exploit
The attack targeted a pool built on Balancer's original V1 architecture. Slowmist, a blockchain security firm, traced the exploit to a rounding error in the pool's calculation logic. That flaw allowed the attacker to withdraw more funds than the pool's balance should have permitted. The exact method hasn't been disclosed, but the firm linked it to the same bug class that hit Balancer's V2 pools months earlier.
A Familiar Bug
In November of the previous year, Balancer's V2 pools lost $116 million to a similar rounding-error vulnerability. That incident was one of the largest DeFi exploits of the year. Slowmist's analysis now points to the same underlying issue resurfacing in a V1-style pool. The recurrence suggests the fix applied to V2 may not have covered all versions of Balancer's code, or that older pools remain vulnerable.
What This Means for Balancer Users
The latest loss is small compared to the November drain, but it's a reminder that older DeFi infrastructure can carry unpatched risks. Balancer has not yet publicly commented on this specific incident. For users with funds in V1-style pools, the exploit raises a practical question: are those pools still safe to use? Until Balancer addresses the underlying rounding issue across all its versions, the answer isn't clear.
The attack also highlights the difficulty of securing complex financial protocols. A rounding error might seem minor, but in a system handling millions of dollars, even a tiny miscalculation can be turned into a profitable exploit. Slowmist's identification of the bug as a repeat of a known issue suggests that lessons from the November attack haven't fully translated into protection for every pool.
As of now, the $234,000 loss stands as the latest in a series of security incidents for Balancer. The team has not announced a timeline for patching V1-style pools, and the exploit remains unresolved. For those watching the protocol, the next step is to see whether Balancer will extend its security fixes to cover all legacy versions.
