Author: Jack Inabinet Source: bankless Translation: Shan Ouba, Jinse Finance

Analyzing the Aftermath of the Balancer V2 Vulnerability Attack

Balancer is a popular decentralized exchange known for its automatic rebalancing of liquidity pools and token-incentivized liquidity rewards. Recently, its V2 version liquidity vault was hacked, resulting in losses of tens of millions of dollars.

Many Balancer V2 forks (i.e., alternative exchanges that reuse Balancer code) were also affected, and several affected blockchains have taken aggressive measures to mitigate further losses.

Why has this incident triggered a chain reaction in the crypto industry? The following will analyze this in detail.

Why has this incident triggered a chain reaction in the crypto industry?

A Major Mishap by Balancer: On Monday, November 3rd, Balancer V2 vaults deployed on chains such as Ethereum, Base, Polygon, and Arbitrum were compromised by a vulnerability, resulting in a loss of nearly $80 million. The issue only existed in the V2 version's "composable stable pools" and did not affect Balancer V3 or other pool types. Data analytics platform DeFiLlama shows that Balancer V2 has 27 independent forks. Although the total value locked in most forks was negligible, attackers still stole $3.4 million from the Beets protocol in the Sonic ecosystem and $283,000 from the Beethoven protocol in the Optimism ecosystem. Furthermore, approximately $12 million in user funds were at risk on BEX, the native exchange built on the Berachain chain based on Balancer. As of this writing, Balancer has not released an official post-attack analysis report, but some believe the vulnerability stems from a flaw in the access check within the "manageUserBalance" function; others speculate that the attack originated from "invariant manipulation" of the Balancer pool token price. Following the attack, users of Balancer and its forks immediately evacuated to protect their assets. One whale user, dormant for three years, withdrew all $6.5 million worth of GNO-WETH assets from Balancer in a single transaction within 30 minutes of the attack. To mitigate losses, some blockchains have resorted to extreme measures—these radical actions blur the lines between crisis response and centralized control: Polygon's Balancer V2 deployment only resulted in a loss of approximately $100,000, but network validators' decision to censor the hackers' transactions effectively froze the stolen digital assets; Sonic modified the logic of its native token "S," granting the Sonic Foundation the unilateral authority to blacklist wallet addresses (prohibiting them from holding native tokens) and emptied the attackers' S token balances; Meanwhile, Berachain completely halted block generation across its network to prevent further asset theft on BEX (Berachain's official native exchange). The Core Questions Raised by Balancer This Balancer vulnerability attack raises two key questions for the entire crypto industry. Question 1: If Balancer V2 can be easily attacked, which other DeFi protocols are secure? Balancer V2 is a proven protocol: it has been operating for over four years and has undergone smart contract audits by multiple independent institutions. The fact that even such a protocol can be easily attacked inevitably raises the question – which other DeFi protocols are secure? Undoubtedly, crypto users enjoy the convenience brought by blockchain, but when a vulnerability in a cornerstone DeFi protocol is ignored by countless auditing experts for years, it becomes increasingly difficult for people to have absolute trust in the security of applications based on permissionless smart contracts. Question 2: If some blockchains have the power to freeze hackers' funds, why can't regulatory agencies force them to freeze "illegal activities"? Since blockchains like Polygon, Sonic, and Berachain have the ability to freeze attackers' funds, why can't financial regulatory agencies force these (and other similarly centralized) blockchains to freeze all activities they deem illegal? In March 2023, MakerDAO's vault front-end, Oasis.app (now renamed Summer.fi), followed an order from the High Court of England and Wales, accessing its own smart contracts through an administrator key backdoor to recover $225 million in crypto assets from the Wormhole cross-chain bridge hack. This incident demonstrates that traditional legal systems can force decentralized protocols to take specific actions through threats of arrest or other legal consequences. Is it possible that regulators will now follow this model—taking action against behaviors they disapprove of across multiple blockchains (such as transactions without government oversight or identity verification) based solely on a court order?