Balancer x Certora: Future-Proofing Protocol Security

Certora Re-Audit + New Security Guardrails: Building Preventive Security Into V3

Following the November 3rd exploit targeting Composable Stable Pools on V2, Balancer took decisive action. While V3 remained completely unaffected, we recognized an opportunity to strengthen our security posture even further. Rather than waiting for threats to emerge, we decided to build future-proofing protocol security on V3.

The Preventive Security Mindset

The CSP exploit revealed that attack vector had existed for over four years before anyone discovered it. Similar exploits hit other protocols after our incident, yet the pattern remained invisible to the industry. This reality forced us to rethink our entire approach.

Traditional security operates reactively: find vulnerabilities, patch them, move on. But what about the vulnerabilities we don’t know exist yet? What about attack vectors that won’t be discovered for another four year?

Our answer to that problem is to eliminate entire categories of potential exploits by constraining protocols to only legitimate use cases. If an operation has no valid use case to exist, it shouldn’t be possible at all.

V3’s Structural Advantages

V3’s architecture already embodies this philosophy. The vault-centric approach centralizes token balances, fees, BPT management into a single, heavily audited system. With this and other design choices, V3 eliminates multiple attack surfaces that could be exploited by malicious actors, including the specific rounding vulnerability that enabled the November 3rd exploit. The proof is in the results: zero V3 pools were affected by the incident.

But we didn’t stop there.

Comprehensive Re-Audit with Certora

In partnership with Certora, we conducted an extensive re-audit of many V3 contracts. The goal was to identify and eliminate any possible attack vector before it could be discovered by bad actors.

The Certora team found no vulnerabilities across the audited V3 contracts, highlighting the power of V3’s simplified architecture. By moving complexity away from individual pools and into the vault, we’ve created a system that’s more secure by design.

For more details regarding the methodology and results, please read Certora’s full report on the security reassessment.

New Security Guardrails: Constraining to Legitimate Use

Beyond the clean audit, we implemented additional security guardrails across both Weighted and Stable pools, to restrict protocol activity to valid use cases.

Weighted Pool Guardrails

On weighted pools, we added two preventive guardrails that directly eliminate malicious use cases:

• Minimum Token Balance Limits: We’ve implemented minimum token balances that are effective across the entire range of token decimals. Since reaching very low balances generally requires very large trades, this effectively limits the maximum trade size, and restricts pool operations to an economically meaningful range.
• Enhanced Balance Rounding: Originally, liquidity operations in the Vault that require specific rounding pass the required rounding direction to the pools. In V3, the pool math itself always rounds correctly. In particular, the amountIn rounding for ExactOut swaps is now correct, addressing the issue present in V2. On top of this, we also round up the tokenIn balance during calculations, further pushing the already correct rounding in a safer direction.

Stable Pool Guardrails

We also added one new guardrail to V3 stable pools:

• Maximum Imbalance Ratio: Stable pools now enforce a maximum 10,000:1 ratio between the highest and lowest token balances. While stable pools are designed to maintain near 1:1 balance, this generous ceiling still blocks the extreme imbalances that characterize known attack patterns. The main idea is to restrict Stable pools to an operating range that is economically meaningful. There’s no valid use case for operating at such extreme imbalances, so we’re forbidding it entirely.

Flash Swaps

One critical realization shaped our approach: flash swaps are not flash loans. While both allow temporary access to assets, flash loans are limited by a token’s available liquidity. Flash swaps, however, are only constrained by storage limits, theoretically up to 1e128 tokens, far exceeding any token’s actual liquidity.

There’s no legitimate reason to “borrow” more tokens than will ever exist. That’s either a mistake or an attack, and definitely not a valid use case. Our guardrails now prevent these impossible scenarios from occurring at the pool level.

Setting the New Standard

The November 3rd exploit taught the industry valuable lessons. Our response reinforces our commitment to learning from incidents, even those that don’t directly affect our latest version.

By acting preventively rather than reactively, we’re committed to setting a new standard for AMM security, one where robustness is built into the architecture, and threats are blocked before they exist. Security goes beyond smart contract architecture. In collaboration with Hypernative, new pools feature extended pause capabilities backed by 24/7 monitoring, enabling immediate response when threats emerge and moving beyond rigid immutability toward active protection

New Weighted and Stable pool factories (including Stable Surge pools) with enhanced security guardrails are now deployed across all V3 networks. Learn more about Balancer V3 in our documentation.