Copycat Attack on Balancer: Why DeFi Needs to Change

**Executive summary:** On June 29, 2020 CertiK reports two copycat attacks against Balancer where attackers used dYdX and Uniswap flash loans to mint cTokens, trigger Compound's COMP airdrop, and exploit Balancer's gulp() function to siphon off newly created COMP (netting ~11.5 ETH in these instances), highlighting that the root cause is a financial-model/design weakness rather than a simple code bug and urging DeFi projects to adopt financial-model-level security and proactive defenses.