What happened
Balancer V2's Boosted Pools were exploited through manipulation of the rates assigned to nested Linear Pool tokens. Attackers inflated a constituent token's rate, traded it for other pool assets, then reset the rate to repay their flash-swapped position cheaply.
Technical root cause
Linear Pool rate calculations combined exploitable precision and rounding behavior with a rate reset when virtual supply reached zero. Nested pools trusted the manipulated rate, enabling profitable trades followed by discounted repayment.
How it happened
- The attacker obtained Linear Pool BPT through a Balancer Vault batch swap that settled at the end.
- Carefully chosen swaps manipulated balances and supply, exploiting precision and rounding behavior to raise the BPT rate.
- The inflated BPT bought disproportionate amounts of other constituent tokens in the parent Composable Stable Pool.
- Returning the Linear Pool's circulating supply to zero triggered its initialization behavior and reset the rate to one. The attacker repaid the BPT at the lower rate.
Protocol details
Security review history
- OpenZeppelin View report
- Trail of Bits View report
Evidence
Proof of concept
1 availableSources
- report Rate manipulation in Balancer Boosted Pools — technical postmortem medium.com
- report Post-Mortem blocksecteam.medium.com
- report @mevrefund incident report twitter.com
- report @CyversAlerts incident report twitter.com
- report @Balancer incident report twitter.com
- analysis Website reference forum.balancer.fi
- analysis DeFiLlama defillama.com
- analysis [BIP-443] Restore Brand Trust in Balancer by Assisting DNS Hack Users forum.balancer.fi
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
