PHUX.io

Current assessment of Balancer Exploit as it pertains to Phux.io We do not believe manageUserBalance itself is the universal attack vector that makes all Balancer-style forks or pools vulnerable. Our analysis indicates that the recent exploits primarily relied on invariant manipulation in composable-stable-type pools, exploiting rounding and scaling interactions inside the pool math. Most balancer pools are not affected by this mechanism. The risk appears limited to stable pools that combine non-unit rate providers, ERC-4626-style wrappers, or other custom scaling factors—configurations where token scaling is dynamic or fractional rather than fixed by simple decimals. Fortunately, we have been very conservative in the types of pools we have allowed on the platform eschewing complexity from Day 1. Our own stable pools use only straightforward decimal normalization (powers-of-ten scaling), so we have not identified any evidence of the same vulnerability in our deployments. We note that we are not aware of any similar Balancer pools being exploited. An example of which is this Balancer pool on Arbitrum: balancer.fi/pools/arbitrum/v… Another on ETH balancer.fi/pools/ethereum/v… For our pools to be vulnerable then these pools would need to be as well. Nonetheless, we are reviewing all pool math paths and monitoring for any edge-case deviations to confirm this assessment, and we will update the community promptly if new information arises. We will keep studying this and update you with anything we find. -PH Team

Fresh details on the @Balancer V2 exploit - like the attacker's binary search via reverts & decompiled math helper code. Deep dive into rounding biases & on-chain forensics ⬇️ coinspect.com/blog/balancer-…

Life would be better if everyone would remove all liquidity for pDAI vs everything else. The pDAI supply has grown by 213,546,101 since I started tweeting about the exploiters. Tons of coins are worthless out there, and no one cares about them, because they don't have liquidity, meaning, you can't inflate and dump them for other things, and then sell those things for stables and bridge out. But instead, whoever is providing liquidity is getting extracted on, as you see from 20 minutes ago. And the those things they swapped their inflated pDAI for, then get sold. So when the liqudiity providers stop getting pDAI dumped on them, then the holders of the other coins don't have to get dumped on as well. The extraction problem goes away when there's not liquidity to extract from for pDAI anymore. Just like thousand and thousands of other coins on Ethereum and PulseChain, not worth talking about, because worthless.