Little Pains, Great Gains: How the Balancer DeFi Contract Was Drained

On June 28 an attacker leveraged a dYdX flash loan and a mis-exposed Balancer contract function (gulp()) to artificially inflate the price of a deflationary token (STA) and repeatedly extract value, draining WETH, WBTC, LINK, and SNX from Balancer pools and stealing ~565.53 ETH (~$127k). The report documents the multi-phase attack flow, specific contract functions and transactions used, attacker addresses, and recommends making gulp() internal or adding access controls to prevent similar exploits.