2026-10-31
Script: Balancer finance invariant non-convergence PoC
Disclaimer
- Quick Note
- Might contain dual-use cybersecurity knowledge
Pools affected
Main
- All communication with Balancer finance using anonymous alt pebbleel. (No longer anonymous because of this post ofcourse.)
- A member of the Balancer finance team confirmed the bug was real, but said it was out of scope of their bug bounty. They said whether I publish it is upto me but it would be nice if I delay publishing until the official Balancer pool shutdown on 2026-10-30.
- I am publishing the PoC after the shutdown as requested.
This will be most likely on 2026-10-30 or 2026-10-31. It is now published!
- I am not publishing the methodology used to uncover this, because it is dual-use. As in, publishing methodology might help either the defenders or attackers, and I don't have any particular motivation to help either the attackers or the defenders here. I am here to help myself.
Subscribe
Enter "Subscribe: " followed by Signal username, email address or whatsapp phone number. You will receive atmost one update per month. View previous updates here.
Alternatively, you can use RSS, or a third-party service like blogtrottr.
Comment
Enter "Comment: " followed by comment. Alternatively, contact me