# Balancer DoS Bugfix Review

Flash-loaning both entry points of a double-entry-point ERC-20 made Balancer's Vault count the repayment as excess fees, draining it to ProtocolFeesCollector and DoSing swaps.

- Payout: $50,000
- Severity: medium
- Program: Balancer
- Credited: k_besic
- Disclosed: 2022-07-22
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/balancer-dos-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-balancer-dos-bugfix-review
- Tags: domain:web3 impact:dos impact:integrity kind:bounty platform:blog platform:immunefi sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Balancer Vault flashLoan function (FlashLoans.sol) with double entry-point ERC-20 tokens
**Root cause:** flashLoan tracks pre-balances per token address; passing both the proxy and target entry points of the same token makes the second loop see the proxy's repayment as a surplus and pay the full balance to ProtocolFeesCollector.
**Steps:**
1. Identify a double entry-point token traded in Balancer pools (e.g. sBTC: proxy + target).
2. Deploy an Exploit contract implementing IVault flashLoan and IFlashLoanRecipient.receiveFlashLoan.
3. Call `vault.flashLoan(exploit, [target, proxy], [fullVaultBalance, 0], data)`.
4. In receiveFlashLoan, repay the borrowed amount to the target entry point.
5. Second loop sees proxy pre-balance 0 and post-balance full, sets receivedFeeAmount = full balance.
6. `_payFeeAmount` transfers full balance to ProtocolFeesCollector, emptying the Vault.
**How found:** Reasoning from the flashLoan code: pre-balances are recorded per token address, and the fee loop compares post vs pre balance. Noticing double entry-point tokens (proxy + target) share one underlying balance, the auditor hypothesized that listing both addresses would make the repayment appear as a surplus on the second entry point.
**Exploitation:** Attacker flash-borrows the Vault's entire balance of a double entry-point token via the target address with zero amount on the proxy address, repays through the target, and the fee accounting misreads the proxy balance delta as fees, sending the whole balance to ProtocolFeesCollector. Funds are unrecoverable by attacker (governance-controlled) but Vault is emptied, breaking swaps and pool exits.
**Insight:** When a contract tracks balances keyed by token address, check whether two addresses can alias the same underlying balance (proxy vs implementation, double entry-point tokens) so a delta on one is misread as a surplus/fee on the other.