3 Nov 2025, 07:46 UTC
Balancer V2: Exact-Out Rounding Drained Composable Stable Pools
Balancer: on 3 Nov 2025 incorrect rounding in the exact-out swap path of V2 Composable Stable Pools enabled a multi-chain drain. Balancer puts theft at $121.1M before recoveries; V3 unaffected.
- Event date
- Incident typeSmart-contract exploit
- Bug classAccounting
- Published
Loss, as sourced
$121.1M total losses across Ethereum, Arbitrum, Base, Optimism and Polygon, per Balancer; ~$45.7M protected or recovered through pauses, whitehats and partner interventions. Earlier intro text also cites an estimated $94.8M theft figure.
Traceability
Primary sources
In brief
Root cause: Per Balancer: in _swapGivenOut, amountOut is rounded down by _upscale before StableMath, which also rounds amountIn down — caller underpays. Combined with rate providers and exitSwap-induced low liquidity in BPT-composable pools, the error was magnified across batch swaps.
Timeline, as sourced: Per Balancer (UTC, 3 Nov): 07:46 first malicious txs; 07:52 Hypernative alert; 08:07 CSPv6 paused ($19.3M protected); 09:50 public disclosure; 11:01 Recovery Mode.
Account, as sourced
Claimed (Balancer) (post-mortem (opens in a new tab)): CSPv5 primarily hit; Weighted, Gyro and other Stable variants unaffected; V3 unaffected.
Claimed (Balancer): whitehat recoveries ~$4.6M under SEAL Safe Harbor; StakeWise DAO recovered osETH/osGNO.
Unknown: final pool-by-pool claim outcomes under DAO governance.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/balancer-csp-rounding-2025