Worked example · 2025-11

Balancer V2 ComposableStablePool rounding-error exploit — multi-chain — 2025-11-03

Loss: approximately $128M (~$128.64M most-cited PeckShield / Check Point figure) extracted from Balancer V2's ComposableStablePool contracts across six EVM chains in a single attack window on 2025-11-03 lasting under 30 minutes. The Ethereum mainnet deployment absorbed the largest share (~$100M); the remaining ~$28M was distributed across additional Balancer V2 deployments on Arbitrum, Optimism, Base, Polygon, and Gnosis Chain. Forked projects built on top of Balancer V2 (notably Beets Finance) reported secondary impacts of approximately $3M+. Only V2 ComposableStablePool contracts were affected; Balancer V3 and the legacy Weighted / regular Stable pools remained operational and were not impacted by the same vulnerability.
Recovery: partial via white-hat-coordinated rescue + capped operator-side compensation. The detection-and-rescue chain produced material recovery on multiple chains: StakeWise DAO's emergency multisig executed an on-chain rescue that recovered approximately 5,041 osETH (~$19M) and 13,495 osGNO (~$1.7M) from the Balancer exploiter, representing approximately 73.5% of the 6,851 osETH stolen on the Ethereum mainnet leg. Gnosis Chain validators executed a coordinated hard fork in late December 2025 to recover approximately $9.4M from the Balancer exploiter, with a validator-penalty enforcement mechanism for non-cooperating validators. Balancer DAO subsequently published a reimbursement plan that returned approximately $8M in rescued assets to affected liquidity providers, with white-hat actors who intervened during the attack receiving bounties equal to 10% of recovered assets paid in the same tokens they returned. The 10% bounty cap applied uniformly across the multi-chain rescue cohort. Balancer Labs subsequently announced a wind-down of the Balancer Labs entity following the V2 exploit, although the V3 protocol continues to operate.
OAK Techniques observed: OAK-T9.005 in the arithmetic-precision-loss / rounding-error sub-class — a rounding error in the _upscaleArray function of Balancer V2's ComposableStablePool math, when combined with carefully crafted batchSwap operations, allowed the attacker to artificially suppress BPT (Balancer Pool Token) prices and extract value through repeated arbitrage cycles. The constructor of the attacker's smart contract executed 65+ micro-swaps that compounded precision loss across iterations to reach the realised $128M-scale extraction. OAK-T9.002 is not the load-bearing precondition — the attack did not require flash-loan working capital; the attacker funded the exploit from existing balances and amplified through repeated micro-swap iteration rather than through flash-loan-sized capital.
Attribution: pseudonymous. No direct named-individual attribution. Some industry analysts noted that the scale and method of the attack are similar to previous OAK-G01-class Lazarus-aligned incidents, but no unique technical indicators — reused contract code, wallet clustering, infrastructure overlap — directly link this attack to a specific OAK-G01 cluster. Attribution remains circumstantial and based on sector-targeting and historical patterns rather than on forensically-anchored cluster correlation. OAK records this case as pseudonymous with the explicit OAK-G01 association not applied; future evidence may move the attribution status if forensic-provider-led cluster correlation produces direct linkage.
Key teaching point: arithmetic-precision-loss in pool-invariant math is a recurring T9.005 sub-class that fires on protocols of substantial maturity, not only on newer or smaller deployments. Balancer V2 was a multi-billion-dollar mature DeFi protocol with multiple historical audits and a well-developed defender community; the rounding-error vulnerability persisted across audit passes because the specific interaction between _upscaleArray precision-loss and crafted batchSwap micro-iteration was not in any single audit's threat-model surface. The Balancer V2 case is the canonical 2025 worked example for mature-protocol-rounding-error as distinct from the Compound-v2-fork empty-market-rounding-error cohort (Hundred / Midas / Sonne / Onyx / zkLend / Resupply): the empty-market cohort fires on low-state-supply conditions, while Balancer V2 fired on normal-operation conditions through compounded micro-swap precision loss. Both sit in T9.005's arithmetic-correctness sub-class but are operationally distinct.

Summary

Balancer is one of the longest-established AMM-and-DeFi protocols on Ethereum, deployed across multiple EVM chains with a multi-billion-dollar TVL through 2024-2025. The V2 architecture launched in 2021 with the introduction of the Vault contract pattern and ComposableStablePool / Weighted Pool / regular Stable Pool primitives; the V3 architecture launched in 2024-2025 with substantial improvements in pool composition and gas efficiency, but did not deprecate V2. By November 2025, Balancer V2 was operating in production across at least six EVM chains with substantial residual TVL despite the V3 launch.

On 2025-11-03 in the early-morning hours UTC, an attacker deployed a smart contract whose constructor executed 65+ carefully-crafted batchSwap operations against Balancer V2 ComposableStablePool contracts across multiple chains. The transaction sequence — per Check Point Research, Halborn, Trail of Bits, OpenZeppelin, BlockSec, and Certora post-incident analyses — exploited a rounding error in the pool's _upscaleArray function: each individual swap incurred a small precision loss that, by itself, would have been within tolerable rounding bounds for the pool's invariant math, but the compounded effect across 65+ iterations within the same atomic transaction window produced sufficient BPT-price suppression to make subsequent extraction profitable. The attacker extracted ~$128M across the affected chains in under 30 minutes.

The Ethereum mainnet leg absorbed the largest share (~$100M); the remaining ~$28M was distributed across Arbitrum, Optimism, Base, Polygon, and Gnosis Chain. Beets Finance, a Sonic-chain Balancer fork, reported secondary impacts exceeding $3M from the same vulnerability class on the forked codebase.

The post-incident response chain was unusually multi-faceted. StakeWise DAO executed an emergency multisig rescue on Ethereum mainnet within the same day, recovering approximately $19M of osETH and $1.7M of osGNO — about 73.5% of the StakeWise-related portion of the Ethereum mainnet loss — by exercising rescue authority on its own contracts that had been integrated with affected Balancer V2 pools. Gnosis Chain validators subsequently coordinated a hard fork in late December 2025 to recover approximately $9.4M from the Balancer exploiter on the Gnosis Chain leg, with a validator-penalty enforcement mechanism that warned non-cooperating validators of slashing consequences. Balancer DAO published a reimbursement plan that returned approximately $8M in rescued assets to affected liquidity providers under a uniform 10%-of-recovered-assets white-hat-bounty structure. Balancer Labs (the entity behind the protocol's development) subsequently announced a wind-down following the V2 incident; the V3 protocol continues to operate.

For OAK's purposes the case is a clean T9.005 arithmetic-precision-loss extraction with no flash-loan precondition. The novel OAK contributions are: (a) documenting the mature-protocol-rounding-error sub-class of T9.005 as distinct from the empty-market-rounding-error cohort; (b) capturing the Gnosis Chain validator-coordinated hard-fork as a recovery primitive structurally analogous to but operationally distinct from the Sui (Cetus 2025) and Aptos (Thala 2024) validator-coordinated freeze primitive; and (c) capturing the multi-protocol-multi-chain rescue coordination (StakeWise + Gnosis Chain validators + Balancer DAO + multiple white-hat actors) as one of the most sophisticated 2025 recovery responses.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Balancer V2 ComposableStablePool contracts deployed across Ethereum, Arbitrum, Optimism, Base, Polygon, Gnosis Chain; rounding error in `_upscaleArray` function latent within tolerable per-swap bounds	T9.005 surface (latent, mature-protocol)
Pre-event	Attacker analyses Balancer V2 ComposableStablePool math; identifies that compounded precision loss across crafted `batchSwap` iterations within an atomic transaction can suppress BPT prices below extraction threshold	(off-OAK pre-event observation)
Pre-event	Attacker funds wallet; constructs smart contract whose constructor executes 65+ micro-swap iterations across multiple chains	(preparation)
2025-11-03 ~early UTC	Attacker deploys exploit smart contract on Ethereum mainnet; constructor executes 65+ `batchSwap` micro-iterations against ComposableStablePool contracts; BPT prices suppressed; extraction completes in same transaction	T9.005 extraction (Ethereum, ~$100M)
2025-11-03 ~within minutes	Attacker repeats pattern across Arbitrum, Optimism, Base, Polygon, Gnosis Chain in close temporal succession; cumulative outflow reaches ~$128M	T9.005 multi-chain fan-out
2025-11-03 ~within first hour	Check Point Research Blockchain Threat Analysis system flags unusual activity on Ethereum mainnet involving Balancer V2 Vault contract	(defender response / community detection)
2025-11-03 ~within hours	Multi-investigator detection chain: BlockSec, Halborn, Trail of Bits, OpenZeppelin, Certora, SlowMist, PeckShield publish converging analyses identifying the `_upscaleArray` rounding error + `batchSwap` compounded precision-loss root cause	(transparency / multi-investigator coverage)
2025-11-03 ~within hours	Balancer DAO and Balancer Labs publish public acknowledgement; affected pools paused where pause authority exists; V3 confirmed unaffected	(operator response)
2025-11-03 ~same day	StakeWise DAO emergency multisig executes on-chain rescue, recovering ~~5,041 osETH (~~$19M) and ~~13,495 osGNO (~~$1.7M); ~73.5% of StakeWise-related Ethereum mainnet portion recovered	(white-hat-coordinated rescue)
2025-11 onward	Balancer DAO publishes reimbursement plan: ~$8M returned to affected LPs; 10% white-hat bounty cap for recovered-asset rescuers paid in same tokens	(recovery coordination)
2025-12-23	Gnosis Chain validators execute hard fork to recover ~$9.4M from Balancer exploiter on Gnosis Chain leg; non-cooperating validators warned of slashing penalties	(validator-coordinated hard-fork recovery primitive)
2025-Q4 onward	Balancer Labs announces wind-down of the entity following V2 exploit; V3 protocol continues to operate; community-led V3 maintenance proposals coordinated	(operator-end-of-life)
Continuing	Residual unrecovered portion (~$90M+) routed by attacker through standard mixing infrastructure; partial cross-chain hops observed	T7.001 / T7.003 (off this example's framing)

What defenders observed

The bug class was arithmetic-precision-loss in pool-invariant math, distinct from the empty-market-rounding-error cohort. Compound-v2-fork rounding-error cases (Hundred / Midas / Sonne / Onyx / zkLend / Resupply) fire when total share supply is at or near zero, allowing donation-based per-share-rate manipulation. Balancer V2 fired during normal operation of mature-TVL pools through compounded _upscaleArray precision loss across crafted batchSwap iterations within a single atomic transaction. The defender lesson is that T9.005's arithmetic-correctness sub-class is broader than the empty-market cohort: precision-loss vulnerabilities in mature protocols can persist across audit passes when the specific interaction between low-level math primitives and high-level batch-operation primitives is not in any single audit's threat-model surface. Defender practice for AMM / pool-invariant-math protocols should explicitly include compounded-iteration scenarios (constructor-driven micro-swap loops, batch-operation amplification) in the threat-model surface, not only single-operation correctness checks.
The detection chain ran in parallel across the most extensive forensic-provider cohort in the 2024-2025 corpus. Check Point Research, BlockSec, Halborn, Trail of Bits, OpenZeppelin, Certora, SlowMist, and PeckShield all published technical analyses within the first 24-48 hours, with substantially-converging root-cause attribution. The breadth of provider coverage reflects (a) the scale of the loss, (b) the maturity of the Balancer protocol's defender community, and (c) the operational maturity of the 2025 forensic-provider ecosystem. Contributors writing future T9.005 worked examples on mature-protocol incidents should expect this multi-investigator coverage as the realistic 2025 baseline.
The Gnosis Chain validator-coordinated hard fork is structurally novel as a recovery primitive. The Cetus 2025 case at /examples/2025-05-cetus.md and the Thala 2024 case at /examples/2024-11-thala.md documented validator-coordinated transaction-censorship freezes on permissioned-validator-set non-EVM L1s (Sui, Aptos). The Gnosis Chain case is structurally distinct: Gnosis Chain is an EVM-equivalent chain with a substantial validator set, but the validators executed a coordinated hard fork to roll back the attacker-state on the Gnosis-chain leg, with a slashing-penalty enforcement mechanism for non-cooperating validators. This is a different recovery primitive than the Sui / Aptos transaction-censorship freeze — it operates at the consensus-state-transition layer rather than at the transaction-inclusion layer — but it shares the structural property that the chain's validator set acted in coordinated opposition to the attacker's on-chain proceeds. Defender / Mitigations-layer practice should now treat validator-coordinated rollback as a distinct fourth recovery primitive alongside (a) on-chain protocol-coordinated recovery, (b) attacker-return-of-funds via bounty negotiation, (c) operator-team reimbursement from reserves, and (d) validator-coordinated transaction-censorship freeze (Sui / Aptos pattern).
Multi-protocol-multi-chain rescue coordination is a 2025 maturity datapoint. The Balancer V2 incident produced a recovery response that involved StakeWise DAO (independent protocol with rescue authority on its own contracts), Gnosis Chain validators (consensus-layer actor), Balancer DAO (governance-layer actor), Balancer Labs (operator-entity actor), and at least a dozen white-hat actors operating across the affected chains. The 10%-uniform-bounty-cap structure across the rescue cohort is the operational coordination mechanism that aligned incentives across the actors. Defender / Mitigations-layer practice should treat coordination-mechanism-design for multi-actor rescue as a discrete operational decision class; the Balancer V2 outcome is the canonical 2025 worked example.
Balancer Labs wind-down is the operator-end-of-life dimension, distinct from protocol wind-down. The V3 protocol continues to operate; the Balancer Labs entity announced wind-down. This is structurally distinct from the Sonne Finance (May 2024) and UwU Lend (June 2024) protocol-end-of-life outcomes, where the protocol itself ceased operation. The operator-entity-end-of-life dimension is one of the cleaner 2025 datapoints showing that mature DeFi protocols can survive operator-entity transitions when the on-chain protocol surface is operationally distinct from the legal-entity surface that built it.

What this example tells contributors writing future Technique pages

OAK-T9.005 covers arithmetic-precision-loss in mature-protocol pool-invariant math as a distinct sub-class from empty-market-rounding-error. Balancer V2 November 2025 is the canonical 2025 worked example for the mature-protocol sub-class. The empty-market sub-class is documented through the Compound-v2-fork cohort (Hundred / Midas / Sonne / Onyx / zkLend / Resupply, six worked examples deep). The two sub-classes share the T9.005 arithmetic-correctness umbrella but differ in operational preconditions: empty-market requires low-share-supply state; mature-protocol requires compounded-iteration amplification. A future v0.x update may warrant promoting both sub-classes to their own technique IDs; until then T9.005 broadly construed covers both.
Validator-coordinated rollback (Gnosis Chain pattern) is a fourth recovery primitive. Contributors writing recovery-section content should now distinguish: (a) on-chain protocol-coordinated recovery (Cetus 2025), (b) attacker-return-of-funds via bounty negotiation (KiloEx, ZKsync, GMX V1, Tapioca, Thala, Munchables), (c) operator-team reimbursement from reserves (DeltaPrime, Banana Gun, GMX V1 LP make-whole), (d) validator-coordinated transaction-censorship freeze (Cetus / Thala / Sui / Aptos), and (e) validator-coordinated rollback / hard fork (Balancer V2 / Gnosis Chain November 2025). Each recovery primitive has different preconditions, different ecosystem-level legitimacy thresholds, and different defender-side implications.
Multi-investigator detection-chain breadth scales with protocol maturity and loss size. Worked examples for 2025-mature-protocol incidents at $50M+ scale should expect 6-8+ independent forensic providers publishing within 48 hours; smaller-scale or less-prominent-protocol incidents will have narrower provider coverage. Contributors writing detection-chain sections should report the actual provider list rather than relying on a generic "PeckShield / SlowMist" boilerplate.
Operator-entity wind-down vs protocol wind-down is a distinct outcome dimension. Worked examples should preserve the distinction explicitly: the Balancer V2 / Balancer Labs case shows that an operator entity can wind down while the protocol survives (V3 continuing); the Sonne Finance / UwU Lend cases show that the protocol itself can wind down. Contributors writing recovery / outcome sections should report which dimension applies.
pseudonymous-with-circumstantial-DPRK-suspicion is a hybrid attribution status that should not be conflated with inferred-strong OAK-G01 attribution. The Balancer V2 attribution is circumstantial — based on sector-targeting and historical patterns — without forensically-anchored cluster correlation. Contributors writing attribution-section content should preserve the distinction between (a) circumstantial OAK-G01 suspicion (Balancer V2), (b) inferred-strong OAK-G01 attribution via wallet-cluster correlation (DMM Bitcoin May 2024, with Mandiant on-device forensics), and (c) confirmed-via-FBI / Treasury / Mandiant public-record attribution (Radiant Capital October 2024). Sector-targeting alone is insufficient grounds for OAK-G01 cluster assignment.

Public references

[balancerv2pmpostmortem2025] — Balancer DAO operator-side post-incident statement covering the V2 ComposableStablePool exploit, the multi-chain impact distribution, the StakeWise / Gnosis Chain rescue coordination, and the 10% white-hat bounty cap.
[checkpointbalancerv22025] — Check Point Research blockchain threat analysis of the Balancer V2 exploit including the _upscaleArray rounding-error walkthrough and the 65+ micro-swap constructor pattern.
[halbornbalancerv22025] — Halborn defender-oriented post-mortem of the Balancer V2 November 2025 hack.
[trailofbitsbalancerv22025] — Trail of Bits hack analysis and guidance for the broader DeFi ecosystem.
[certorabalancerv22025] — Certora technical breakdown of the V2 vulnerability emphasising why V3 is structurally safe from the same class.
[openzeppelinbalancerv22025] — OpenZeppelin technical analysis with lessons-for-blockchain-industry framing.
[blocksecbalancerv22025] — BlockSec PhalconHQ in-depth analysis of the V2 exploit transaction trace.
[slowmistbalancerv22025] — SlowMist forensic walkthrough framed as "small flaws collapse a giant — the $100M+ Balancer hack" with funding-source tracking.
[peckshieldbalancerv22025] — PeckShield headline figures and on-chain analytics for the Balancer V2 multi-chain drain.
[stakewiserescuebalancer2025] — StakeWise DAO public statement on the emergency-multisig rescue recovering ~5,041 osETH and ~13,495 osGNO.
[thedefiantbalancerbounty2025] — The Defiant reporting on the Balancer DAO 10% recovery bounty cap structure.
[gnosishardforkbalancer2025] — Coverage of the Gnosis Chain validator-coordinated hard fork executed in late December 2025 to recover ~$9.4M from the Balancer exploiter.
[ccnbalancerv22025] — CCN public-facing summary covering the smart-contract flaw, multi-chain assets impacted, and ecosystem implications.

Citations

[balancerv2pmpostmortem2025] — Balancer DAO operator post-mortem; primary source for operator timeline, multi-chain impact distribution, and 10% white-hat bounty cap structure.
[checkpointbalancerv22025] — Check Point Research; primary technical source for the _upscaleArray rounding-error root cause and the 65+ micro-swap constructor pattern.
[halbornbalancerv22025] — Halborn defender-oriented post-mortem; secondary technical source.
[trailofbitsbalancerv22025] — Trail of Bits hack analysis; guidance source for the broader DeFi-ecosystem implications.
[certorabalancerv22025] — Certora technical breakdown; primary source for V2-vs-V3 structural safety distinction.
[openzeppelinbalancerv22025] — OpenZeppelin technical analysis; secondary technical source.
[blocksecbalancerv22025] — BlockSec PhalconHQ; primary source for the in-depth transaction-trace walkthrough.
[slowmistbalancerv22025] — SlowMist; primary source for funding-source tracking.
[peckshieldbalancerv22025] — PeckShield; primary source for the cumulative-loss aggregation and on-chain analytics.
[stakewiserescuebalancer2025] — StakeWise DAO; primary source for the emergency-multisig rescue figures.
[thedefiantbalancerbounty2025] — The Defiant; primary source for the 10% recovery bounty cap structure.
[gnosishardforkbalancer2025] — Coverage of the Gnosis Chain hard fork; primary source for the validator-coordinated rollback recovery primitive.
[ccnbalancerv22025] — CCN; secondary source for the public-facing summary framing.

Discussion

Balancer V2 November 2025 is OAK's canonical case for the mature-protocol arithmetic-precision-loss sub-class of T9.005 and for the validator-coordinated rollback / hard fork recovery primitive (the Gnosis Chain leg). The case sits adjacent to but operationally distinct from the empty-market-rounding-error cohort — Balancer V2 fired during normal operation of a mature multi-billion-TVL protocol through compounded micro-swap precision-loss, while the empty-market cohort fires on low-share-supply degenerate states.

The cohort framing for mature-protocol arithmetic-precision-loss is thinner than the empty-market cohort framing in the 2024-2025 corpus. The Balancer V2 case is the strongest 2025 datapoint; earlier instances exist (some Curve-fork read-only-reentrancy cases in 2023 share structural features), but the Balancer V2 incident at $128M scale is the corpus-anchor that makes the sub-class legible as a first-class T9.005 family member. Future cohort cases on mature-protocol arithmetic-correctness vulnerabilities should reference Balancer V2 as the canonical 2025 worked example.

The recovery-coordination outcome is the analytically distinctive feature of the case at the corpus level. The Balancer V2 incident produced one of the most sophisticated 2025 multi-actor rescue responses: StakeWise DAO emergency multisig executing on-chain rescue on its own integrated contracts; Gnosis Chain validators coordinating a hard fork with slashing-penalty enforcement against non-cooperating validators; Balancer DAO publishing a uniform 10%-bounty-cap structure across all white-hat rescuers; and Balancer Labs subsequently announcing entity wind-down while preserving the V3 protocol's operational continuity. The breadth of the response — across protocol DAOs, validator sets, governance entities, operator entities, and white-hat individuals — is the 2025 corpus-level signal that DeFi recovery coordination has matured substantially since Euler Finance 2023's bilateral negotiation pattern.

The attribution status is pseudonymous-with-circumstantial-DPRK-suspicion, which contributors should treat as not equivalent to inferred-strong OAK-G01 attribution. The OAK-G01 wave (DMM Bitcoin, WazirX, Radiant Capital, Bybit) is documented through forensically-anchored wallet-cluster correlation, on-device forensics (Mandiant at Radiant), and public FBI / Treasury attribution. The Balancer V2 attribution is grounded in sector-targeting and historical-pattern arguments only; no public technical indicator links the case to a specific OAK-G01 cluster. Contributors writing future attribution sections should preserve the distinction explicitly.

For OAK's broader credibility, including Balancer V2 in v0.1 closes three structural gaps: it adds the largest 2025 H2 DeFi-exploit worked example to the corpus (closing the Aug-Oct 2025 gap), it documents the mature-protocol arithmetic-precision-loss sub-class of T9.005 distinct from the empty-market cohort, and it captures the Gnosis Chain validator-coordinated rollback as a fifth recovery primitive in the OAK Mitigations-layer recovery-primitives catalogue.