SlowMist's Yu Xian: The root cause of over $100 million being stolen from Balancer is that, in the implementation of Balancer v2's Composable Stable Pool, scaling factor calculation errors can be amplified and exploited through low-liquidity swaps.

Golden Finance reports that SlowMist’s Yu Xian has released an analysis on Balancer’s over $100 million hack. The report points out that the fundamental issue lies in Balancer v2’s Composable Stable Pool implementation (based on Curve StableSwap’s Stable Math), which uses integer fixed-point arithmetic for scalingFactors. This approach causes precision loss, resulting in tiny but cumulatively compounded price discrepancies or errors during token swaps. Attackers exploit small exchanges with low liquidity to amplify these errors, enabling them to accumulate significant profits over time.