Balancer Exploit Post-Mortem: How Rounding Drained V2 Pools

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. On November 3, 2025, an attacker exploited Balancer V2's Composable Stable Pools, where exact-out swaps rounded the required input down. Repeated in low-liquidity pools, that rounding error caused $121.1M in losses, per Balancer's post-mortem.

Watch: Balancer Exploit Post-Mortem: How Rounding Drained V2 Pools 1:44

Video transcript

On November 3, 2025, tiny rounding errors drained Balancer V2 pools on five chains. The attacker found states where they added up.

Balancer's post-mortem counts 121.1 million dollars in losses. Rekt cites PeckShield at about 128 million. About 45.7 million was protected or recovered.

In an exact-out swap, the pool computes what the trader pays in. Balancer V2 rounded that input down, so callers underpaid slightly.

Per Balancer, the exploit needed three conditions at once: that rounding error, rate providers adding imprecision, and low liquidity to magnify it.

The attacker traded BPT they never held, draining the pool. Rekt counts 65 or more swaps in one transaction, each sized for rounding loss. BPT lost value, so the debt was repaid cheaply.

Balancer lists 2022 audits of these pools. Trail of Bits says Stable Math was out of scope, and Certora's proofs covered solvency, not rounding.

Certora names this property: one BPT's share value must never decrease. Fuzz every swap kind, near-empty pools, moving rates and long call sequences, failing on a single wei.

Precision loss recurs in Guardian's public reports. At Baseline Markets, dust trades could collapse the pool price, a Critical finding. Sapience and GMX had High findings, all resolved.

Vanguard writes rounding and solvency properties as executable invariants you keep as a regression harness. Read the full post-mortem, or talk to Guardian.

Balancer's post-mortem counts $121.1M in losses from the November 3, 2025 exploit. Rekt cites PeckShield's total of about $128M.

Each rounding error was tiny. The attacker found pool states where those errors added up.

What Happened on November 3

At 07:46 UTC, malicious transactions hit Balancer V2 on Ethereum, Arbitrum, Base, Optimism and Polygon almost at once, Balancer says.

The targets were Composable Stable Pools, mostly version 5 (CSPv5). Balancer V3, Weighted Pools, Gyro Pools and other Stable Pools were not affected.

Time (UTC)	Event
07:46	First attacks; Bitfinding front-runs one, recovering about $964k
07:52	Hypernative flags the activity; a war room opens
08:07	V6 pools, still in their pause window, are paused
09:50	First public disclosure on X
11:01	Recovery Mode lets LPs withdraw what remains

Balancer counts about $45.7M protected or recovered, including:

$19.3M in V6 pools that were paused in time.
$4.6M in whitehat rescues under the SEAL Safe Harbor Agreement.
5,041 osETH (about $19M) and 13,496 osGNO taken back by a StakeWise DAO operation.

Certora and Trail of Bits also found a second path in MetaStable pools; a whitehat operation secured about $4.1M there.

Forks inherited the flaw. Rekt lists losses at forks on Sonic, Berachain and Optimism; a Berachain hard fork recovered $12.86M.

The Rounding Mechanics

An exact-out swap lets a trader name the amount they want out. The pool then computes what they must pay in.

First, Balancer V2 scales each amount to 18 decimals and applies the token's rate. That step, _upscale, always rounds down:

function _upscale(uint256 amount, uint256 scalingFactor) pure returns (uint256) {
    // Upscale rounding wouldn't necessarily always go in the same direction: in a swap for example the balance of
    // token in should be rounded up, and that of token out rounded down. This is the only place where we round in
    // the same direction for all amounts, as the impact of this rounding is expected to be minimal.
    return FixedPoint.mulDown(amount, scalingFactor);
}

Rounding an output down is usually safe. Here, Balancer says, StableMath's mechanics rounded the required input down as well.

So the caller underpaid slightly for the amount out. The code comment expected the impact to be "minimal."

Three conditions

Balancer says the exploit needed all three:

The rounding error in exact-out swaps.
Rate providers, which price yield tokens such as wstETH and add imprecision.
A low-liquidity state, which magnifies that imprecision.

Only Composable Stable Pools that used rate providers and held their own BPT met all three.

How the attack chained them

Composable pools hold their own LP token, BPT, as a pool token. A batch swap can move BPT in and out like any other asset.

The batch settles only at the end, so a caller can owe the Vault BPT mid-transaction. Balancer calls this a flash swap.

Trade BPT the attacker never held for pool tokens, draining the pool to low liquidity.
Run a long series of swaps sized for maximum rounding loss. Rekt counts 65 or more in one transaction.
Each swap lowers the pool's invariant, and with it the value of BPT.
Repay the BPT debt cheaply and keep the leftover pool tokens.

What the Audits Covered

Balancer's audit list shows two 2022 reviews of Composable Stable Pools: Trail of Bits in early September and Certora later that month.

Rekt quotes OpenZeppelin saying prior audits did not cover the affected pools. Here is what the two firms say.

Trail of Bits

An October 2021 review flagged rounding in how Linear Pools used Stable Math (TOB-BALANCER-004), of "undetermined severity."
It recommended fuzzing "to ensure the rounding directions of all arithmetic operations matched expectations."
In the 2022 review, "the Stable Math library was explicitly out of scope."

Trail of Bits says the pools were exploited "using the same vulnerability that we reported in our audit."

Certora

Certora's 2022 proofs covered solvency. BPT balances could not exceed total supply, and no BPT could be minted without assets.

But they "did not constrain the relationship between individual swaps or rounding behavior." Certora's summary: "Solvency proofs are not sufficient."

Age of the code

The pool audits Balancer lists were about three years old. OpenZeppelin, cited by Rekt, dates the attack vector to July 16, 2021.

Balancer's own lesson: "Even long-running, audited contracts need fresh reviews as new attack vectors and techniques emerge."

Our study of audited and unaudited exploits treats Balancer as its contested case.

How Invariant Fuzzing Finds It

Trail of Bits calls fuzzing "the most effective technique for this type of invariant testing."

It warns that a 1 wei loss "may not seem significant when a fuzzer first identifies it."

It also says the rule "rounding must favor the protocol" is not enough for multi-operation flows.

Certora names two properties that target this exploit:

Roundtrip: "Swapping a token into another and then swapping back should never yield more than the original balance."
Share value: "For any user operation, the share value of a single BPT must not decrease."

A fuzzer breaks them only if it reaches the states the attacker used. Give it:

Handlers for every swap kind, join, exit and batch, including exact out.
Near-empty pools and extreme imbalances, not just realistic balances.
Tokens with 6, 8 and 18 decimals, and rates that move.
Long call sequences, with flash credit settled at the end.
Assertions that fail on a single wei, with no tolerance.

Our Foundry invariant testing guide shows how to build handlers.

The same class in Guardian reports

Precision loss is a recurring class in Guardian's public reports. Three examples:

Baseline Markets: reserve amounts always rounded down when denormalizing, so dust trades could collapse the pool price (C-02, Critical, resolved).
Sapience: a fix rounded a trade ratio the wrong way, so the insolvency it targeted remained (H-01, High, resolved).
GMX: funding values truncated for 6-decimal tokens could leave a deficit in a market (MKTU-6, High, resolved).

Our guide to rounding errors in Solidity walks through two more.

Lessons for AMMs

Pick a direction per operation. Round inputs up and outputs down, through every scaling and rate step. Never trust "minimal."
Bound pool states. New Balancer V3 weighted pools enforce minimum balances; new stable pools cap imbalance at 10,000:1.
Cap virtual credit. Balancer now says "flash swaps are not flash loans": real liquidity does not limit them.
Re-review old math when features combine. BPT in the pool plus rate providers made the error exploitable.
Keep a pause in reach. V6 pools were paused 21 minutes in; V5 pause windows had expired, Rekt notes.

How Guardian Tests AMM Math

Guardian's Vanguard audit writes a protocol's core safety properties as executable invariants. Accounting, rounding, solvency and math formulas are all covered.

Two teams work one scope: one manual with the fuzzing suite, one driving Helix, Guardian's AI auditor.

The suite stays with you as a regression harness for every later change. See smart contract audits for the core engagement.

Frequently Asked Questions

What caused the Balancer exploit?

A rounding error in exact-out swaps on Balancer V2 Composable Stable Pools. Amounts were scaled with rounding down, so the required input came out too low. In low-liquidity states, repeated swaps turned that underpayment into large losses, per Balancer's post-mortem.

How much was lost in the Balancer hack?

Balancer's post-mortem counts $121.1M in losses across five chains. Rekt cites PeckShield's total of about $128M. Balancer says about $45.7M was protected or recovered, including $19.3M in paused pools.

Was Balancer V3 affected?

No. Balancer says V3 was completely unaffected. Its Vault handles scaling, and every arithmetic operation has an enforced rounding direction. Weighted, Gyro and other V2 Stable Pools were also unaffected.

Had the exploited Balancer pools been audited?

Balancer lists 2022 Trail of Bits and Certora reviews of them. Trail of Bits says Stable Math was out of its scope, and Certora's proofs covered solvency, not rounding. Rekt quotes OpenZeppelin saying prior audits did not cover them.

Sources

Fuzz your pool math before attackers do

Guardian writes rounding, solvency and accounting invariants for your protocol, then pressure-tests every reachable state against them.

Get a quote Explore Vanguard