Incident analysis· 8 min read
Rounding errors, amplified: how three 2025 exploits turned a few wei into $146M
Balancer V2, zkLend and Bunni were drained in 2025 by integer rounding that lost at most a unit or two per operation. Attackers shrank pools to a few wei, repeated the lossy step dozens of times in one transaction, and walked off with about $146M. Here is how, and how to design against it.