Balancer warned liquidity providers on Aug. 31 to withdraw from its legacy V1 pools after saying it was aware of a bug that allows LP funds to be drained. The protocol said the deprecated pools are non-pausable, leaving users — rather than a protocol-initiated pause — as the immediate line of defense.
Balancer directed users to exit proportionally through its legacy withdrawal interface and said its other products are not affected. The instruction applies to LPs who still hold positions in the old contracts. Balancer's warning did not state how much value remained in the affected pools or publish their addresses. The withdrawal site asks users to connect a wallet or enter an address to scan for positions, and it permits a pool address to be added manually.
How the Exploit Worked
Blockchain security firm SlowMist separately estimated that one Balancer V1 pool lost roughly $234,000. It attributed the drain to fixed-point rounding in the joinswapPoolAmountOut path, which lets a caller specify a Balancer Pool Token output while the contract calculates the required asset input.