Balancer Issues Urgent Warning Over Legacy Pools Bug

Balancer has issued an urgent warning to liquidity providers (LPs) holding positions in its legacy V1 pools, advising them to withdraw their funds immediately due to a bug that allows LP funds to be drained. The protocol stated that the deprecated pools are non-pausable, leaving users as the primary line of defense against potential losses.

The affected pools are not pausable, meaning that Balancer cannot temporarily halt transactions on these contracts, making it crucial for LPs to withdraw their funds quickly. Balancer's warning did not specify how much value remains in the impacted pools or provide their addresses.

A blockchain security firm, SlowMist, estimated that one V1 pool lost around $234,000 due to a fixed-point rounding flaw in the `joinswapPoolAmountOut` path. This allowed an attacker to compress the pool's WBTC reserve to almost nothing and then mint pool tokens while draining DPI, USDC, WETH, and WBTC from the pool.

Balancer directed LPs to exit their positions proportionally through its legacy withdrawal interface, which can be accessed by connecting a wallet or entering an address. The protocol assured that its other products are not affected by this issue.