Reports show that four security firms conducted 11 audits of Balancer smart contracts starting in 2021, but a bad actor was still able to withdraw millions of staked Ether.
Many cryptocurrency traders are searching for answers following the successful exploit of decentralized exchange and automated market maker Balancer that resulted in the theft of over $100 million in digital assets.
In a Monday X post updating users about the vulnerability, Balancer said the issue “only affects V2 Composable Stable Pools and does not affect Balancer V3 or other Balancer pools.”
The platform added that it had “undergone extensive audits by leading companies and has been running a bug bounty program for a long time to incentivize independent auditors,” raising questions about how this exploit was carried out.
“Balancer has been audited over 10 times,” said Suhail Kakar, head of developer relations at TAC blockchain on X. “The repository was audited [three] separate times by different companies and still got hacked for $110 million. The space needs to accept that ‘audited by X’ means almost nothing. Programming is hard, DeFi is harder.”
According to the Balancer V2 audit checklist available on GitHub, four different security firms — OpenZeppelin, Trail of Bits, Certora, and ABDK — have conducted 11 audits of the platform's smart contracts, most recently on Trail of Bits ' stablecoin in September 2022.
Cointelegraph reached out to OpenZeppelin for comment, but had not received a response by the time of publication. A Trail of Bits spokesperson declined to comment on the exploit “until the root cause is determined and all Balancer forks are secure.”
The exploit, reported early Monday morning, resulted in more than $116 million worth of staked Ether
ETH price is currently $3,645 as of BingX — including StakeWise Staked ETH (OSETH), Wrapped Ether (WETH), and Lido wstETH (wSTETH) — is being transferred to a newly created wallet. A Nansen research analyst told Cointelegraph that the Balancer incident may have stemmed from smart contract issues that had “an access check error that allowed an attacker to send a withdrawal request.”
Project offers 20% white hat reward for backing
In a blockchain transaction note sent to the attackers on Monday, the Balancer team offered a bounty of up to 20% of the stolen funds if the entire amount was returned within 48 hours of receiving notification.
“If you choose not to cooperate, we have hired independent blockchain forensic experts and are actively cooperating with multiple law enforcement agencies and regulatory partners,” Balancer said.
At the time of publication, the project has yet to release any additional updates on the bounty or details of the attack.
Source: Cointelegraph
