Balancer V3
Audit · firm’s term: security assessment & formal verification · Includes formal verification
Certora reviewed Balancer (Balancer V3) on 19 Sep 2024: 10 findings, 2 critical; 9 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 1 | 3 |
CriticalThe underlying token of ERC4626 can be changed to steal assetsFixed
The report gives no description here.
CriticalUnused token approval in_wrapWithBuffer can drain the vaultFixed
The report gives no description here.
HighAny user can steal the yield of the wrapped tokens that are kept in the bufferFixed
The report gives no description here.
MediumA malicious user can cause a DoS in the erc4626BufferWrapOrUnwrap() external function by front-running the callerFixed
The report gives no description here.
MediumRounding errors in weighted pool invariant allows to take out more tokens than addedFixed
The report gives no description here.
MediumSwap fees are different depending on if EXACT_IN or EXACT_OUT are being usedFixed
The report gives no description here.
LowinitializeBuffer can only be called when it mints double the minimal amountFixed
The report gives no description here.
LowReEntrancy Pool initialization possibleFixed
The report gives no description here.
LowTransposed digits in a constant valueFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Balancer’s security record
BalancerSecurity firm
Certora29 projects reviewed · 56 reports · latest Aug 2026
See Certora’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us