Balancer Urges Users to Withdraw from Legacy V1 Pools Due to Fund-Draining Bug

Balancer Issues Warning Over Legacy V1 Pool Vulnerability

Balancer, a decentralized finance (DeFi) protocol that lets users trade and provide liquidity across multiple tokens, has warned users to withdraw funds from its older V1 pools. The warning comes after the discovery of a bug that could allow funds to be drained from these deprecated pools.

The protocol stated on August 31 that the affected pools cannot be paused by the team, leaving users responsible for protecting their own funds by exiting immediately.

How to Exit and What’s at Risk

Balancer directed users to withdraw proportionally using its legacy withdrawal interface. The warning applies only to liquidity providers (LPs) still holding positions in the old V1 contracts. Other Balancer products are not affected, according to the announcement.

The withdrawal tool lets users connect a wallet or enter an address to check for exposed positions. Users can also manually add a pool address if it does not appear in the scan.

Security Firm Reports $234,000 Loss

Blockchain security firm SlowMist reported that one Balancer V1 pool lost roughly $234,000 due to a fixed-point rounding flaw in the joinswapPoolAmountOut function. This function allows a caller to specify a Balancer Pool Token output while the contract calculates the required input.

SlowMist explained that the attacker reduced the pool’s WBTC reserve to almost nothing, causing the input calculation to round down to one satoshi (the smallest unit of Bitcoin) while still minting the requested pool tokens. These tokens were then exited to drain assets like DPI, USDC, WETH, and WBTC from the pool.

What Is Confirmed

• Balancer has confirmed a bug in its legacy V1 pools that can drain LP funds.
• The affected pools cannot be paused by the protocol, requiring users to withdraw manually.
• SlowMist linked a $234,000 loss in one pool to a fixed-point rounding flaw.
• Balancer’s other products are not impacted.

What Is Still Unclear

• The total value remaining in the affected V1 pools has not been disclosed.
• Balancer has not published the addresses of the vulnerable pools.

Why This Matters

Liquidity providers in Balancer’s older V1 pools risk losing funds if they do not withdraw immediately. The inability to pause these pools means users must act on their own to avoid potential losses from the bug.

Sources

• The Defiant