Balancer warned liquidity providers on Aug. 31 to withdraw from its legacy V1 pools after saying it was aware of a bug that allows LP funds to be drained. The protocol said the deprecated pools are non-pausable, leaving users — rather than a protocol-initiated pause — as the immediate line of defense.
Balancer directed users to exit proportionally through its legacy withdrawal interface and said its other products are not affected. The instruction applies to LPs who still hold positions in the old contracts.
Balancer's warning did not state how much value remained in the affected pools or publish their addresses. The withdrawal site asks users to connect a wallet or enter an address to scan for positions, and it permits a pool address to be added manually.
Blockchain security firm SlowMist separately estimated that one Balancer V1 pool lost roughly $234,000. It attributed the drain to fixed-point rounding in the `joinswapPoolAmountOut` path, which lets a caller specify a Balancer Pool Token output while the contract calculates the required asset input.
SlowMist said the attacker compressed the pool's WBTC reserve to dust before the calculation rounded the required input down to one satoshi of WBTC while still minting the requested pool tokens. The firm said those tokens were then exited proportionally to drain DPI, USDC, WETH and WBTC from the pool.
