defirisk.co
rubric v1.7.0

Market-listing governance threshold

Balancer (v2 + v3)'s assessment for RD-F-072 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Pool creation on Balancer v2 and v3 is permissionless — anyone can deploy a new pool via the registered factory contracts (WeightedPoolFactory, StablePoolFactory, etc.) without a DAO vote, minimum liquidity requirement, or token vetting. Factory addresses are granted permissions via governance (e.g., BIP-910 grants v3 factory permissions across chains), but the act of creating an individual pool through those factories requires no governance approval. This means arbitrary tokens — including scam tokens, low-liquidity tokens, and tokens with malicious transfer logic — can be paired in Balancer pools. LPs who add liquidity to such pools bear full economic risk without protocol-level safeguards. Balancer's prior exploit history (2023 Boosted Pool exploit on a specific pool type variant) demonstrates how the combinatorial risk of pool type + token type can manifest. Permissionless listing earns a red score under the rubric (no threshold required to list).

Sources #

Methodology #

Classify the governance threshold required to list a new market as: permissionless / low-threshold (team multisig) / high-threshold (DAO vote) / no new listings.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol balancer factor RD-F-072 score red collected_at 2026-05-05 12:41:36