Earlier this week, a critical vulnerability in the decentralized finance (DeFi) protocol Balancer was exploited, with crypto losses estimated to be worth $120 million or more. While it was initially unclear how the exploit worked, a preliminary report from the team behind Balancer has indicated it mostly came down to how the protocol dealt with rounding crypto token balances.
This exploit of Balancer shocked many in the DeFi ecosystem, as this is a project that has undergone many security audits from respected firms, and the particular version of the protocol that was exploited had existed in the wild since 2021.
In an interview with CNBC’s Squawk Box on Wednesday morning, former Director of the Cybersecurity and Infrastructure Security Agency Chris Krebs compared the Balancer exploit to the scheme from Office Space, where the idea was to skim fractions of a penny off the top of many individual transactions. Krebbs also pointed to the possible use of artificial intelligence in crafting the exploit code as another interesting aspect of the situation.
Without getting too deep into the technical weeds, here’s basically what happened with the exploit, according to Balancer’s own analysis.
At the heart of this mess was a rounding error in Balancer’s code related to how it handles trades, specifically batched swaps where multiple trades between different crypto assets can be bundled into a single transaction. This is intended to help users save on gas, which is effectively the crypto-denominated cost of interacting with a blockchain-based smart contract platform like Balancer.
During a particular version of this type of swap, known as EXACT_OUT, Balancer’s code has to scale numbers up or down to make calculations precise (think of it like converting pennies to dollars). But the system sometimes rounded down in a way that created tiny imbalances.
Over repeated trades, hackers could exploit these tiny gaps to mess with the pool’s balances, hence Krebs’s comparison to the plan in Office Space. There was some additional manipulation on top of that, but this rounding error was the key flaw that opened up the opportunity for the hacker.
While the Balancer exploit sent shockwaves throughout the DeFi ecosystem, some blockchains were able to limit the reward for the hacker by simply freezing assets, which is obviously at odds with the “code is law†philosophy that was originally at the heart of crypto platforms focused on more expressive smart contracts, such as Ethereum.
Some DeFi proponents were worried a hack of a widely trusted protocol like Balancer would weaken the level of trust in the DeFi sector more generally; however, it’s clear that much of this activity is still somewhat centrally controlled and able to operate in ways similar to traditional fintech platforms.
According to Unchained, the Polygon and Sonic blockchains effectively froze or “censored†some of the Balancer hacker’s assets following the exploit to prevent the funds from moving anywhere else in the future. Berachain went as far as to deploy an emergency hard fork that will allow those affected by the hack to reclaim their funds.
This is reminiscent of actions taken by Ethereum developers following the infamous hack of The DAO nearly ten years ago in the early days of the crypto network. And it’s clear that crypto is still struggling with the tradeoffs between giving everyone full control over their own digital money and subsequently having no one to turn to when something goes wrong.
