Community Compensation Framework Proposal
(Source: Balancer)
In November 2025, Balancer experienced a major attack with total losses reaching $116 million. The white hats, the internal security team, and StakeWise collectively recovered about $28 million. Recently, community members submitted a new proposal. It outlines specific compensation measures for the $8 million recovered by the white hats and the internal security team. StakeWise will independently manage the nearly $20 million it recovered.
Core Principles of the Compensation Mechanism
The proposal advocates a compensation model built on three core principles:
- Non-Socialized Compensation
Only the affected liquidity pools will be compensated; losses are not distributed across all pools. Each pool is responsible solely for its own losses, and each holder receives compensation according to their share of the pool (BPT). - Pro-Rata Distribution
Compensation will be allocated based on each user’s proportional share in the pool, ensuring all stakeholders receive compensation matching their original holdings. - In-Kind Returns
Victims will receive the same type of tokens that were stolen, preventing secondary losses caused by price discrepancies between different assets.
Attack Incident Overview
Cyvers CEO Deddy Lavid called the Balancer incident one of the most complex attacks of 2025. Balancer’s smart contracts underwent 11 audits by four separate security firms, yet those extensive reviews still failed to prevent the attack. The incident has reignited the community’s debate over whether audits truly guarantee security.
Exploiting Rounding Vulnerabilities and Batched Swaps
Post-incident analysis revealed the root cause of the attack:
The attacker targeted the rounding function used in Stable Pools during EXACT_OUT swaps.
- Under normal circumstances, the rounding logic should round input prices down.
- The attacker manipulated calculations to force rounding up.
This minor discrepancy, combined with batched swaps, led to significant drainage of the liquidity pools.
If you want to explore more Web3 content, click to register: https://www.gate.com/
Conclusion
The Balancer community is working to establish a fair compensation mechanism, aiming to help victims recover a reasonable portion of their losses. The incident once again demonstrates that multiple audits cannot fully eliminate vulnerabilities. As attack methods evolve, strengthening contract security and risk management remains a challenge for the DeFi sector.
