The short answerBalancer's vault-and-weights design supports pool logic no constant-product AMM can express, which is why so much liquid staking and rate-provider liquidity lives there. The shared vault has held; several pool types have been exploited, including boosted pools in 2023 and Composable Stable Pools in November 2025, the latter for well over $100m.
Best forProgrammable liquidity pools
Security recordweight 25%
6.0avg 8.0
Economic designweight 20%
7.5avg 7.8
Real usageweight 20%
7.0avg 7.9
Governanceweight 20%
7.5avg 7.4
Transparencyweight 15%
8.0avg 8.3
this service category average across 15Score = Σ mark × weight. Works well for a specific use case, weaker outside it. Methodology.
| Criterion | Mark | What we found | Source | Checked |
|---|
| Security record | 6.0 | not sourced yet | not sourced yet | — |
| Economic design | 7.5 | not sourced yet | not sourced yet | — |
| Real usage | 7.0 | not sourced yet | not sourced yet | — |
| Governance | 7.5 | not sourced yet | not sourced yet | — |
| Transparency | 8.0 | not sourced yet | not sourced yet | — |
What we liked, and what fell short
Liked- Arbitrary weights, rate providers and composable pools enable real financial engineering
- Vault design is gas-efficient and widely integrated
- Disclosure during incidents has been prompt and detailed
Fell short- Repeated vulnerabilities including the 2023 boosted-pool issue and a November 2025 exploit of well over $100m
- Depth on plain pairs is far behind the leaders
Why the marks landed where they did
Balancer is infrastructure for structured liquidity. Pools can hold up to eight assets at arbitrary weights, use external rate providers to price yield-bearing tokens correctly, nest inside one another, and implement custom logic. That expressiveness is genuinely useful and genuinely dangerous.
The vault architecture
All pools share a single vault holding the assets, while pool contracts contain only pricing logic. Multi-hop swaps move tokens once rather than between separate pools, which saves gas, and it concentrates the most security-critical code in one heavily audited place. That vault has never been drained.
Where the failures happen
At the edges. The 2023 boosted-pool vulnerability required an emergency call for liquidity providers to withdraw, with losses for those who did not act in time. In November 2025 a precision-loss bug in Composable Stable Pool invariant maths was exploited for well over $100m across four chains, and hit forks of the protocol too. In both cases the core held and composability created the opening — which is the recurring lesson of this protocol's history.
Its structural role
Much of DeFi's liquid staking liquidity depends on Balancer pool types that price accruing value correctly. That makes it more systemically important than its trading volume suggests, and it means its vulnerabilities matter beyond its own users.
Who should care
Liquidity providers in LST and rate-provider pools, builders needing expressive pool logic, and anyone assessing how composability trades against safety.
FAQ
Has Balancer's vault been exploited?+
No. The shared vault has held throughout; the exploits have affected specific pool types built on top of it.
What happened in the 2023 boosted-pool incident?+
A vulnerability required an emergency call for liquidity providers to withdraw. Most funds were saved; those who did not exit in time lost around $2m.
Why is Balancer important beyond its trading volume?+
Its pool types with rate providers underpin a large share of DeFi's liquid staking liquidity, making it structurally significant to that market.
Is Balancer safe for liquidity providers?+
It depends heavily on the pool type. Simple weighted pools have a strong record; more composable structures are where the vulnerabilities have appeared.
