Balancer V1 Exploit Hits Unmaintained Code: $234k Loss

Security firm SlowMist has identified an exploit in Balancer V1's BPool contract, resulting in a loss of approximately $234,000. The attack occurred when an attacker used flash loans from various DeFi platforms to compress the pool's WBTC reserves until it was possible to mint pool tokens for a single satoshi.

The vulnerability lies in the joinswapPoolAmountOut function, which allows callers to specify the output of pool tokens rather than the input. This function uses 18-decimal fixed-point math, but when the pool's reserves are large relative to the requested output, the calculation rounds down to the smallest representable unit.

The attacker was able to exploit this flaw by compressing the WBTC reserves using flash loans from Spark, Aave, Morpho, and Uniswap V3. Once the reserves were sufficiently reduced, the contract calculated a required input of one satoshi, allowing the attacker to mint 4,408.8 BPT tokens.

SlowMist has identified three missing checks in the contract: no minimum effective input, no minimum pool balance, and no relative-error validation. The contract's _MIN_BALANCE constant is enforced only in the bind and rebind functions, which govern adding and adjusting tokens in a pool, not in the join path.