Balancer Warns V1 LP Users of Pool-Draining Bug in Legacy Contracts
Balancer advised users to exit liquidity positions from its deprecated v1 contracts after identifying a pool-draining vulnerability tied to fixed-point rounding errors. Security firm SlowMist reported approximately $234,000 in losses attributed to the flaw before the warning.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Vulnerability and Response
Balancer warned liquidity providers to withdraw funds from its legacy v1 pools after discovering a bug that could drain pool reserves. The vulnerability stems from a fixed-point rounding flaw in the deprecated contracts, according to security firm SlowMist. Balancer noted that the v1 pools are non-pausable, meaning the protocol cannot freeze them unilaterally to prevent further losses.
Scope of Losses
SlowMist attributed approximately $234,000 in drained liquidity to the rounding error before Balancer issued its public warning. The firm did not specify whether this figure represents the total loss across all affected pools or an initial drain that prompted the disclosure.
Implications for Legacy Infrastructure
The incident underscores the ongoing maintenance burden of deprecated smart contracts in DeFi ecosystems. Balancer v1 has been superseded by later versions for over two years, yet liquidity and user funds remained active in the older contracts. The non-pausable design of v1 pools limited Balancer's ability to respond immediately, forcing reliance on user self-evacuation rather than protocol-level intervention.
Why It Matters
For Traders
LPs with active positions in Balancer v1 pools face immediate withdrawal risk; exiting quickly minimizes exposure to further drainage if the vulnerability remains exploitable.
For Investors
The incident reveals that older DeFi protocol versions can pose tail-risk threats to capital even after being officially deprecated, requiring ongoing audit and monitoring cycles.
For Builders
Protocol designers should consider mandatory pause mechanisms and tiered deprecation timelines for legacy contracts; non-pausable pools compound vulnerability response friction.
This article is for information only and is not financial advice. Read the full disclaimer.
