How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation

According to Check Point Research, on 3 November 2025 an attacker drained $128.64 million from Balancer V2 across six blockchain networks by exploiting arithmetic precision loss in pool invariant calculations within ComposableStablePools. The attack leveraged a rounding error in the _upscaleArray function, where small balances pushed to the 8-9 wei range cause Solidity’s integer division to incur significant precision loss, enabling repeated arbitrage cycles in batchSwap operations.

The exploitation occurred during contract deployment, with the constructor executing 65 micro-swaps that compounded the losses and stored the stolen value in the exploit contract’s internal balance. The stolen funds were subsequently withdrawn to the final recipient via a withdrawal function that transferred the exploit contract’s internal balance to the attacker, as evidenced by InternalBalanceChanged events and a total of 6,586 WETH, 6,851 osETH, and 4,259 wstETH accumulated across two targeted pools.

In total, the attack transferred 6,586 WETH plus the associated osETH and wstETH out of the Vault, illustrating how tiny rounding errors can be weaponised when amplified through numerous atomic operations.