Ignored bounty disclosure

Evidence summary #

The Aug 2023 exploit: whitehatter GothicShanon89238 submitted the rounding vulnerability to Immunefi on Aug 11 2023; Balancer issued warnings and began pool migration, but the exploit occurred Aug 27 before completion. Balancer paid $1M bounty. This is not a case of ignoring the disclosure — they responded and paid. However, the 2025 November $128M exploit used the same root-cause class (rounding direction) in a different pool type (ComposableStablePool), suggesting the 2023 remediation did not fully address the underlying vulnerability class. This repeat-class pattern is a yellow here (not fully ignored, but remediation incomplete).

Sources #

Methodology #

Determine whether any prior post-mortem documents a disclosed vulnerability that was reported to the team and not actioned before exploit.

See the full factor methodology and distribution across all protocols →