Unfortunately, and somewhat annoyingly, I need to post this…
On April 7, 2025, we (DeFi France) discovered an issue with the Balancer pool that held most of the liquidity for EURe on GnosisChain. Someone immediately contacted Balancer, who corrected the problem but without making any public announcement about it.
Why discuss this on the Gnosis forum rather than Balancer’s?
Simply because this pool was the primary source of liquidity for GnosisPay and was also used by kpk with funds from the Gnosis DAO.
What’s the problem?
The pool uses an oracle to determine the price of sDAI and EURe. The first and main issue is that this price was only updated every 3 hours, leading to a divergence between the true EURO price and the pool’s EURe price, causing unjustified losses for liquidity providers. This arbitrage led to a significant loss for the pool. I estimated the total loss due to price divergences at $700,000. I should clarify that this amount does not account for transaction fees or slippage; the actual amount lost is closer to $400,000.
The second problem, which caused less loss but is more serious from my perspective, demonstrates a lack of due diligence by those who deployed and used this pool. This is the fact that the EURO price was not updated on weekends. However, a price for the EURO is still easily accessible via CeX, DeX, or even brokers offering derivative contracts. This limitation, due to the functioning of the ChainLink oracle, should have immediately disqualified this pool.
Now that I’ve summarized the problem, we can talk about the core issue.
The incident management by Balancer and kpk is catastrophic.
We first contacted them on April 7, three months ago. No communication has been made to inform the pool’s liquidity providers that the price was previously only updated every 3 hours.
I shared my report privately on May 19, with all the data demonstrating that the problem existed and still partially exists even with the correction of the 3-hour bug.
For the past three weeks, I’ve been assured every few days that communication will arrive, and I just need to wait a few more days.
They decided to re-do the calculations themselves because they disputed the amount of my findings. That’s fine, but it didn’t prevent them from already communicating about the problem the pool encountered (the 3-hour bug) and its limitations (no price on weekends).
I am very frustrated by what Balancer and kpk have done.
You can find the report here => Balancer sDAI/EURe incident report - NolanV