On November 3, 2025, Balancer suffered an incident in which attackers manipulated internal vault logic to drain liquidity across multiple blockchains. The breach underscores the importance of prioritizing security even for mature protocols with multiple audits, and it raises urgent questions about composability, operational controls, and the evolving threat-landscape in Web3. Here is Certora’s analysis of the incident, as well as a detailed timeline of events.

We explain the vulnerabilities in our first DeFi hacking challenge and announce a relaunch of the contest with a twist: Capture the Funds - Endless CTF!

Certora researchers identified a high-severity soundness vulnerability in gnark’s fake GLV scalar multiplication. An unconstrained prover-supplied point could enable forged ECDSA signatures in circuits using P-256, P-384 or the STARK curve. Fixed in gnark v0.16.4.

In recent years, tiny rounding mistakes, often as small as 1 wei, have cost DeFi protocols over $100 million. Because the EVM only handles integers, every division forces a round‑up or round‑down decision, creating subtle gaps that attackers can exploit at scale. Learn how formal verification tools can systematically prove your contracts’ invariants and reveal hidden rounding bugs before they go live.

"Trustless" bridges claim to allow secure asset exchange across chains even in the presence of malicious actors. However, we argue that truly trustless protocols based on commit-reveal schemes are actually impossible when at least one of the participants does not wait for block finality.