Balancer Post-Mortem Reveals Details of $116 Million Exploit
Balancer is a decentralized finance (DeFi) protocol. On Wednesday, the Balancer team published an initial post-mortem report, giving further details about the $116 million exploit that rocked DeFi markets earlier this week.
A report says that the hack happened on Monday when the hacker targeted Balancer v2 Stable Pools and Composable Stable v5 pools, leaving other pools unharmed. According to the report, an attack involving BatchSwaps and a rounding function vulnerability in the pools of Stable Pools was sophisticated.
A feature called BatchSwaps, which allows users to use flashloans and wrap multiple actions into a single transaction, served as the entry point for the exploit. Borrowers of flashloans can receive some funds and repay them in the same transaction. The exploit also took advantage of the high-end rounding function of the EXACT_OUT swaps in Stable Pools.
The Exploit: How the Attacker Tampered With Token Prices
The attacker leveraged the rounding function to manipulate token prices. It was supposed to round down the token prices when inputted. By using this function with the BatchSwaps, the hacker drained the pools. In certain instances, the money stayed in the Vault as internal balances before being removed later in the transaction.
The Balancer team underlined the need to secure hot wallets, liquidity pools, and on-chain funds that are exposed on the internet in a warning sent out to crypto users and devs as threats evolve.
Also Read : Evernorth Hits $1B Milestone, Eyes Nasdaq Listing
The Hacker’s Professionalism Takes Months to Prepare
The person or group who committed this act had spent months preparing for the attack. As per Cointelegraph, the hacker funded the onslaught by making multiple 0.1 Ether (ETH) deposits using the Tornado Cash mixer. In order to cover their tracks, the attacker used a VPN to conceal their activities on the website.
Balancer’s Response: Cooperation with Crypto Protocols and a White Hat Bounty
After the exploit, Balancer worked with cybersecurity experts and other crypto protocols to recover or freeze some of the stolen funds. As of the most recent report, 5,041 StakeWise Staked ETH or around $19 million and 13,495 osGNO tokens valued at about $2 million were successfully clawed back.
To prevent further harm, Balancer paused every affected pool and disabled the ability to create any new vulnerable pools until a security patch could be applied. No one has claimed the 20% white hat bounty that the team offered to anyone who returns the stolen funds.
