Balancer is infrastructure for structured liquidity. Pools can hold up to eight assets at arbitrary weights, use external rate providers to price yield-bearing tokens correctly, nest inside one another, and implement custom logic. That expressiveness is genuinely useful and genuinely dangerous.
The vault architecture
All pools share a single vault holding the assets, while pool contracts contain only pricing logic. Multi-hop swaps move tokens once rather than between separate pools, which saves gas, and it concentrates the most security-critical code in one heavily audited place. That vault has never been drained.
Where the failures happen
At the edges. The 2023 boosted-pool vulnerability required an emergency call for liquidity providers to withdraw, with losses for those who did not act in time. In November 2025 a precision-loss bug in Composable Stable Pool invariant maths was exploited for well over $100m across four chains, and hit forks of the protocol too. In both cases the core held and composability created the opening — which is the recurring lesson of this protocol's history.
Its structural role
Much of DeFi's liquid staking liquidity depends on Balancer pool types that price accruing value correctly. That makes it more systemically important than its trading volume suggests, and it means its vulnerabilities matter beyond its own users.
Who should care
Liquidity providers in LST and rate-provider pools, builders needing expressive pool logic, and anyone assessing how composability trades against safety.