Critical Vulnerability Discovered in DeFi Protocol Balancer, TVL Tanks 28%

On Aug. 22, Balancer Labs stated that it had received a “critical vulnerability report affecting a number of V2 Pools.”

The firm went on to warn that it had taken action, but funds may be at risk.

“Emergency mitigation procedures have been executed to secure a majority of TVL, but some funds remain at risk.”

Balancer advised users to withdraw from affected liquidity pools immediately.

Balancer has received a critical vulnerability report affecting a number of V2 Pools.

Emergency mitigation procedures have been executed to secure a majority of TVL, but some funds remain at risk.

Users are advised to withdraw affected LPs immediately.https://t.co/PDzX32gqeS pic.twitter.com/F1f649Wz3L

— Balancer (@Balancer) August 22, 2023

Another DeFi Exploit?

In a follow-up note, the project reassured users that “the majority of funds on Balancer are safe.” Only 1.4% of the total value locked is at risk, it added before confirming only boosted pools are affected.

“Several pools are paused to mitigate risks and will remain so, with users advised to withdraw liquidity as soon as possible.”

According to DeFiLlama, Balance V2 TVL was around $750 million before the vulnerability was discovered. In the hours since the announcement, Balance V2 TVL has tanked around 28% to $543 million as liquidity providers pulled out.

Furthermore, a few more details were posted on the Balancer Labs forums. They noted that the vulnerability had not been exploited (at the time), and no funds had been lost.

“We were able to mitigate over 80% of these [pools]; the remaining funds at risk represent about 4% of Balancer TVL.”

The list of pools affected were: mainnet, Polygon, Arbitrum, Optimism, Avalanche, Gnosis, Fantom, and zkEVM.

There were no other details at the time of writing, but it is hoped that Balancer’s quick discovery and decision to alert its users has saved them from becoming the latest DeFi protocol exploited.

BAL Token Reaction

Balancer’s native token BAL dropped 4% in the hours following the announcement in a fall to $3.40.

However, it has managed to recover over the past few hours returning to trade at $3.52. The DeFi asset has had a tough fortnight dropping 18% in two weeks.

Additionally, it remains battered like its DeFi brethren, with BAL languishing 95% down from its May 2021 all-time high of $74.45.