Incident Overview
The transaction behind the attack:
https://etherscan.io/tx/0x013be977…c78106
The attacker's address:
https://etherscan.io/address/0xbf675c80…e7469a
The attacker:
- borrowed a flash loan (104,331 WETH) from dYdX
- performed multiple swapExactAmountIn() calls within the same transaction to drain the STA balance in the attacked Balancer pool. swapExactAmountIn() sets the limit on the swap amount, i.e., inRecord.balance * MAX_IN_RATIO. The attacker calculated the limit and swapped the maximum allowed amount of WETH for STA via a flurry of operations. The result of performing the above swaps is to intentionally left 1e-18 in the Balancer pool
- by sending in 1e-18 STA into BPool via swapExactAmountIn(), the attacker swapped out 30,347 WETH in the first run. In internal records for book-keeping, _records[STA] is increased by tokenAmountIn (i.e., 1) before the BPool contract actually collects the corresponding STA tokens from the msg.sender
- the _pullUnderlying() function collected the STA tokens. Note: STA is a deflationary token that charges shown 1% on every token transfer. Because of the transfer fee cut, the Balancer pool actually got zero STA tokens. Therefore, there’s a mismatch between the actual STA balance of BPool and its internal records (i.e., _records[STA])
- The gulp() is exploited to reset the _records[STA], which helps the attacker to maintain the state that BPool has only 1e-18 STA
- repaid the flash loan back to dYdX.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Balancer, these are the critical security checks that could have prevented this incident (June 2020).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Balancer
The Balancer hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.