What happened
Balancer V2's Boosted Pools were exploited through manipulation of the rates assigned to nested Linear Pool tokens. Attackers inflated a constituent token's rate, traded it for other pool assets, then reset the rate to repay their flash-swapped position cheaply.
Technical Root Cause
Linear Pool rate calculations combined exploitable precision and rounding behavior with a rate reset when virtual supply reached zero. Nested pools trusted the manipulated rate, enabling profitable trades followed by discounted repayment.
Case & protocol details
Classification
Protocol Logic / Oracle Manipulation
Protocol Type
DEX
Implementation language
Solidity
Official Website
balancer.fi/
Protocol Twitter/X
@Balancer
How it happened
- The attacker obtained Linear Pool BPT through a Balancer Vault batch swap that settled at the end.
- Carefully chosen swaps manipulated balances and supply, exploiting precision and rounding behavior to raise the BPT rate.
- The inflated BPT bought disproportionate amounts of other constituent tokens in the parent Composable Stable Pool.
- Returning the Linear Pool's circulating supply to zero triggered its initialization behavior and reset the rate to one. The attacker repaid the BPT at the lower rate.
Evidence & learning
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.