The Cryptocurrency Post The CryptocurrencyPost
AboutContact
Security

Balancer V1 legacy pools drained of about $234,000 via rounding error exploit

Realistic newsroom image of a Balancer V1 pool draining WBTC and USDC after a rounding error

A Balancer V1 legacy pool was drained of roughly $234,000 after an attacker exploited a rounding issue in the protocol’s single-asset liquidity join path, according to blockchain security firm SlowMist’s incident alert on X.

The security firm said the issue affected a deprecated Balancer V1 BPool and was tied to the joinswapPoolAmountOut mechanism, which lets a user specify how many Balancer Pool Tokens, or BPT, they want to receive while the contract calculates the required asset input. In the reported case, the calculation rounded the required WBTC deposit down to a tiny amount while still allowing new pool tokens to be minted.

SlowMist said the attacker first compressed the pool’s WBTC reserve to an extremely low level, then used the rounding behavior to mint 4,408.8 BPT with what the report described as one satoshi of WBTC. Those pool tokens were then redeemed against the pool’s remaining assets, including DPI, USDC, WETH and WBTC, producing the estimated loss.

Legacy contracts left users with the immediate defense

The incident highlights a structural issue with Balancer V1’s legacy pools: they are deprecated and non-pausable, which means there was no protocol-level freeze available once the bug was identified. The practical response for liquidity providers was to withdraw from the affected pools rather than wait for an administrative intervention.

The reported loss was limited to the vulnerable legacy pool described in the alert, rather than to Balancer across all versions. Still, the exploit shows how a small arithmetic edge case can become material when reserve balances are pushed close to zero and the contract continues to accept a nonzero input.

SlowMist’s description points to a fixed-point rounding problem in the pool’s math, where integer division reduced the required deposit below the true economic value of the minted tokens. In that setup, the attacker was able to create an imbalance between the amount paid in and the value received out.

Balancer legacy pool users were not advised to treat the issue as abstract: the affected contract had already been drained, and the warning centered on removing funds from any remaining vulnerable V1 liquidity positions.