On Mar 13, 2023, DeFi protocol Euler Finance was exploited with a ~$197M loss in multiple Txs. Around 34,224,863 <a href="https://twitter.com/search?q=$USDC&amp;src=cashtag_click" rel="noopener noreferrer nofollow">$USDC</a>, 849 <a href="https://twitter.com/search?q=$WBTC&amp;src=cashtag_click" rel="noopener noreferrer nofollow">$WBTC</a>, 85,818 <a href="https://twitter.com/search?q=$stETH&amp;src=cashtag_click" rel="noopener noreferrer nofollow">$stETH</a> and 8,877,507 <a href="https://twitter.com/search?q=$DAI&amp;src=cashtag_click" rel="noopener noreferrer nofollow">$DAI</a> were stolen.About Euler FinanceBack in June 2020, Euler won first place in the Spark College Hackathon online competition organized by Encode Club.Euler is initially a lending protocol built on top of Aave, Compound and other lending protocols that allows users to create their own lending marketplace for any ERC-20 Token, while also providing Reactive rate models to reduce governance intervention.In August 2021, Euler received $8 million in Series A funding led by Paradigm. On the official website, Euler also shows that they have six auditors, and none of them have found critical vulnerabilities.<img src="https://miro.medium.com/v2/resize:fit:1050/1*P7MXB5EDEl3Jsgd2LAdRPg.png">Related Info<h2 id="header-0">Project address:</h2>0x27182842e098f60e3d576794a5bffb0777e025d3<h2 id="header-1">Attack Txs:</h2><a href="https://etherscan.io/tx/0xc310a0affe2169d1f6feec1c63dbc7f7c62a887fa48795d327d4d2da2d6b111d" rel="noopener noreferrer nofollow">https://etherscan.io/tx/0xc310a0affe2169d1f6feec1c63dbc7f7c62a887fa48795d327d4d2da2d6b111d</a><a href="https://etherscan.io/tx/0x47ac3527d02e6b9631c77fad1cdee7bfa77a8a7bfd4880dccbda5146ace4088f" rel="noopener noreferrer nofollow">https://etherscan.io/tx/0x47ac3527d02e6b9631c77fad1cdee7bfa77a8a7bfd4880dccbda5146ace4088f</a><a href="https://etherscan.io/tx/0x71a908be0bef6174bccc3d493becdfd28395d78898e355d451cb52f7bac38617" rel="noopener noreferrer nofollow">https://etherscan.io/tx/0x71a908be0bef6174bccc3d493becdfd28395d78898e355d451cb52f7bac38617</a><a href="https://etherscan.io/tx/0x62bd3d31a7b75c098ccf28bc4d4af8c4a191b4b9e451fab4232258079e8b18c4" rel="noopener noreferrer nofollow">https://etherscan.io/tx/0x62bd3d31a7b75c098ccf28bc4d4af8c4a191b4b9e451fab4232258079e8b18c4</a><a href="https://etherscan.io/tx/0x465a6780145f1efe3ab52f94c006065575712d2003d83d85481f3d110ed131d9" rel="noopener noreferrer nofollow">https://etherscan.io/tx/0x465a6780145f1efe3ab52f94c006065575712d2003d83d85481f3d110ed131d9</a><a href="https://etherscan.io/tx/0x3097830e9921e4063d334acb82f6a79374f76f0b1a8f857e89b89bc58df1f311" rel="noopener noreferrer nofollow">https://etherscan.io/tx/0x3097830e9921e4063d334acb82f6a79374f76f0b1a8f857e89b89bc58df1f311</a><h2 id="header-2">Attacker:</h2>0x5f259d0b76665c337c6104145894f4d1d2758b8c0xb2698c2d99ad2c302a95a8db26b08d17a77cedd4We take one tx to analyze.<ol><li>The hacker first flashloaned $30M <a href="https://twitter.com/search?q=$DAI&amp;src=cashtag_click" rel="noopener noreferrer nofollow">$DAI</a> and created two attack contracts. The 0x583 is for borrowing and the 0xA03 for liquidation. Then he deposited $300M to the borrowing contract.</li></ol><img src="https://miro.medium.com/v2/resize:fit:1050/1*ZgUXhuyJF9-PzWgU4sYE9g.png">2. The attacker deposited $20M to get 19,568,124 eDAI.<img src="https://miro.medium.com/v2/resize:fit:1050/1*WxRGJkAHI3Z2ZPMGM6h-Dg.png">3. Then the attacker called mint function to use the 19,568,124 eDAIs to borrow 195,681,243 eDAIs (collateral assets) and 200,000,000 dDAIs (debt assets), thus scaling up the eDAI balance to ten times.<img src="https://miro.medium.com/v2/resize:fit:1050/1*WT6JvhQCkDLMa1rujI0Upg.png">4. The attacker then deposited the remaining 10M DAI via the repay function, borrowing 195,681,243 eDAI and 200,000,000 dDAI again.<img src="https://miro.medium.com/v2/resize:fit:1050/1*lRA9zNxkVyiKr26gfLMcXg.png">5. The attacker then carried out a donateToReserves operation to burn 100M eDAI, making eDAI &lt; dDAI, which reaches the liquidation condition.<img src="https://miro.medium.com/v2/resize:fit:1050/1*M4bd1d8gjX_Wh4iih_TSVQ.png">6. The liquidation contract liquidated the borrowing contract.<img src="https://miro.medium.com/v2/resize:fit:1050/1*TOuPlG5R2L_627-vw0Ongw.png">7. The attacker finally withdrew all 38.9M DAI from the contract and returned 30M DAI to AAVE, making a profit of ~8.9M $DAI.<img src="https://miro.medium.com/v2/resize:fit:1050/1*k4xyTJcHuzNCwQWLVGmGDw.png">Vulnerability AnalysisThe Etoken contract’s donateToReserves function fails to check the actual number of tokens held by the user and the health status of the user’s ledger after donation, resulting in the attacker being able to donate 100 million eDAI (obtained through leverage, with the user actually depositing only 30 million DAI). After the donation, the health status of the user’s ledger qualifies for liquidation, leading to the lending contract being liquidated. The lending contract transfers the eDAI and dDAI to the liquidation contract, which is then liquidated. Due to the unusually large amount of bad debt, the liquidation contract will be liquidated with the maximum discount, resulting in 310.93M eDAI and 259.31M dDAI after the liquidation. At this point, the user has been restored to health and can withdraw funds, and the amount that can be withdrawn is the difference between eDAI and dDAI. However, since there are only 38.9M DAI in the pool, only that amount can be withdrawn.Overall, the root cause of the attack is that the Etoken contract does not properly check the actual number of tokens held by the user and the health status of the user’s ledger after donation, which provides an opportunity for attackers.<img src="https://miro.medium.com/v2/resize:fit:1050/1*SRpfgFE8zQbrY7yLeIhjpA.png">Fund FlowAs of press time, 80,080.98 ETH are held at address 0xb2698c2d99ad2c302a95a8db26b08d17a77cedd4.<img src="https://miro.medium.com/v2/resize:fit:1050/1*ZO2LUFynwiluPErcarfXjw.png">88,651.70 ETH and 43063733.27 DAI are held at address 0xb66cd966670d962C227B3EABA30a872DbFb995db.<img src="https://miro.medium.com/v2/resize:fit:1050/1*x1-zsJAkKlUWS5DPp_hRIw.png">Only a small number (100 ETH) were transferred to Tornado Cash.<img src="https://miro.medium.com/v2/resize:fit:1050/1*-XEe23BrAT5OkNMK8TFKPQ.png">Try Beosin KYT at kyt.beosin.com.What are the protocols affected by Euler?According to 0xScope, Angle Protocol has $17.6 million USDC in Euler; Idle DAO has $4.6 million USDC in Euler; SwissBorg has 6,357 Ether and 1.7 million USDT deposited in Euler. After the attack, SwissBorg quickly borrowed 4,752 cbETH to mitigate losses, but still had about $4.26 million assets in Euler; the 0x28a5 whale address and czsamsun.eth had $4 million and $2.74 million in the protocol, respectively.Yield aggregator Yearn tweeted that while it was not directly exposed to the Euler attack, some Yearn vaults were indirectly exposed to the hack.Idle Finance tweeted that it was also affected.<img src="https://miro.medium.com/v2/resize:fit:1050/1*pACSH704hkolQgaT3Z47dA.png">Recommendations1. In developing smart contracts, note whether the subsequent addition of functionality has an impact on the preceding logic.2. Be careful to check on the assets.

Analysis of the Euler Finance’s 197M Exploit — the Largest Security Incident so far in Q1 2023

Table of Contents

Beosin

Other articles published on Mar 15, 2023

Explore Japanese DeFi With the Latest GYEN Quest On Layer3

SHIB’s Burn Rate Skyrockets by 1,322% after PuppyNet Introduction

Crypto Analyst Who Called 2018’s Market Bottom Predicts $FTM, $ETH, and $GRT Rallies

Becoming Unbanked Part 3: Receiving Payments in Nano

Bit2Me breaks record and completes the launch of the $GFAL token with nearly 200,000 euros raised...

DOJ and SEC to Probe SVB Collapse and Insider Stock sales: Report

Join our free newsletter for daily crypto updates!