Skip to content
#14 largest Arithmetic 2025

The Balancer v2 hack — $128M lost

Loss$128M
Date3 Nov 2025
Chain8 chains at once
Failure classArithmetic
In assetsdrained in under 30 minutes
TargetComposable Stable Pools
1

What happened

Balancer scales every token balance up to 18 decimals before doing pool math, and that scaling rounds down. Normally the lost wei is noise. The attacker drove pool balances down to the 8–9 wei range, where a single wei is a huge fraction of the value, and then chained dozens of swaps inside one batchSwap so the error compounded in his favour on every hop — suppressing the pool token's price, then cycling the arbitrage. Ethereum, Base, Arbitrum, Optimism, Polygon, Avalanche, Gnosis, Berachain and Sonic, all inside half an hour. Balancer's TVL fell 58% in two days.

2

How the attack ran

  1. Push balances to 8–9 weiWhere a single wei is ~11% of the value
  2. Chain dozens of swapsAll inside one batchSwap call
  3. _upscale always rounds downEvery hop hands the discarded wei to the caller
  4. BPT price suppressed$128M across 8 chains in under 30 minutes
3

The code

ScalingHelpers.sol — a rounding direction, weaponised
function _upscale(uint256 amount, uint256 scalingFactor) internal pure returns (uint256) {
    return FixedPoint.mulDown(amount, scalingFactor);   // ❌ always rounds DOWN
}

// At normal balances the discarded wei is invisible.
// At a balance of 9 wei it is 11% of the value.

  batchSwap([ swap, swap, swap, ... ])   // one tx, many hops
      hop 1  balance 9 → rounds to 8     // 1 wei to the attacker
      hop 2  ...                          // and again
      hop n  ...                          // and again
  → BPT price suppressed → buy cheap, redeem at true value, repeat

// ✅ the invariant: rounding must ALWAYS favour the pool, never the caller.
//    Direction has to be chosen per call site, not globally.
4

What would have caught it

What an audit looks for: rounding direction at every single arithmetic site, and behaviour at extreme balances. "It's only a wei" stops being true the moment an attacker controls the balance and the number of iterations. Test your pool math at 1 wei, not just at realistic amounts.
6

Sources

Every figure on this page comes from the post-mortems above, not from us. Losses are US dollars at the time of the incident.

Check your own contract for this

Arithmetic is one of the 203 classes the SaferICO scanner checks for. It will not review your signing process — but it will read your Solidity.

Run the scanner See how it is attacked Read the docs