Euler Finance exploit

Exploits

Euler FinanceMar 13, 2023

$197M lost#17 on rekt.newsFunds returned

Overview

Lost

$197M

#17 on the rekt.news leaderboard

Came back

$177M

Funds returned

Attacked

EToken.donateToReserves

Missing health check

Audit

Sherlock

Ethereum

What happened

Euler added donateToReserves (EIP-14) so users could give eTokens to the protocol's reserves. It lowered the donor's collateral but never ran the liquidity check every other balance-lowering function ends with, so an account could donate itself under water and be liquidated at the maximum discount by a second contract, which withdrew the collateral.

lendingliquidationflash loanupgrade (EIP-14)

Timeline

Mar 13, 2023Lending pools drained: DAI, USDC, WBTC and staked ETH, about $197M.
Apr 3, 2023Euler: all recoverable funds have been returned, over $177M.

Attack flow

Self-liquidation through a donationmissing check

Attacker

Aave

EToken

Liquidation

What happens

1
deploys
Attacker deploys
Deploys two contracts: one builds the position (the violator), the other liquidates it.
2
flashLoan()
Aave.flashLoan
Borrows DAI for one transaction. Flash loans are a normal feature; everything below happens before it must be repaid.
3
deposit()
EToken.deposit
Deposits the DAI into Euler and receives eDAI, its collateral.
4
mint()
EToken.mint
Mints eDAI and dDAI together: Euler's built-in leverage, debt and collateral created as a pair. Repays part of the debt and mints again; Euler's own check says the account is healthy.
5
donateToReserves()
EToken.donateToReserves
Donates eDAI to the reserves. The account's collateral falls below its debt, yet the call succeeds.
Missing check. No checkLiquidity(account) after the donation: unlike withdraw, mint or transfer, this function never asks whether the donor is still solvent.
6
liquidate()
Liquidation.liquidate
The second contract liquidates the under-water account. The deeper under water, the larger the discount: it takes the eDAI collateral cheaply and only part of the debt.
7
withdraw()
EToken.withdraw
The liquidator withdraws the DAI behind its eDAI. The bad debt stays with the first account.
8
repay()
Aave.repay
Repays the flash loan and keeps the difference. The same was repeated for WBTC, stETH and USDC.

Funds

Balance changes and fund flow, from the sources

PartyAssetValueNet

Euler lending poolsLost−86k ETH derivatives−849 WBTC−34M USDC−8.9M DAI−$135M−$19M−$34M−$9M−$196M

AttackerGainedrekt.news counts $197M in total.The same assets+$196M+$196M

Returned to EulerGot backBy April 2023, after Euler's ultimatum and bounty.All recoverable funds+$177M+$177M

Fund flow, in order

[1] $197M[2] $177M returned

Euler lending pools−$196M

Attacker+$196M

Returned to Euler+$177M

Root cause

EToken.sol (Euler v1, EIP-14) · illustrative, written to the pattern

11function donateToReserves(uint subAccountId, uint amount) external nonReentrant {

22 address account = getSubAccount(msgSender, subAccountId);

33 uint origBalance = assetStorage.users[account].balance;

55 assetStorage.reserveBalance += amount;

66 assetStorage.users[account].balance = origBalance - amount;

7− // the donor may now owe more than it holds

7+ checkLiquidity(account); // the check withdraw, mint and transfer end with

Missing check. No checkLiquidity(account) after the donation: unlike withdraw, mint or transfer, this function never asks whether the donor is still solvent.

88}

Why it broke

Every function that lowered an account's collateral ended with checkLiquidity(account). The one added later did not, and the liquidation logic assumed no owner could push a healthy account under water on purpose.

Catch it

Tests of intended behaviour, never attack code

The invariant that would have failed

After any call, an account that was healthy is still healthy, or the call reverts.

As a Foundry test· illustrative, write it against your own contracts

// a handler calls deposit, mint, repay, withdraw and donateToReserves in random order;// after every call, every account it touched must still be solventfunction invariant_accountsStaySolvent() public view {    for (uint256 i; i < handler.actorCount(); i++) {        address account = handler.actor(i);        assertTrue(markets.isSolvent(account), "a call left an account under water");    }}

What an auditor checks0/3

List every function that lowers collateral or raises debt and confirm each ends with the same solvency check. A helper added by an upgrade (EIP-14 here) is the one to diff against the rest.
Ask whether an account can make itself liquidatable and profit by liquidating itself from a second address; bound the liquidation discount with that in mind.
Review small additions against the protocol's core invariants, not only their own lines: the donation looked harmless on its own.

In Luora. In Atlas Paths, open each function that writes the user's balance: the one without a liquidity check stands out. An invariant test of solvency, like invariant_solvency in the sample vault, calls every function in random order and fails on the first call that leaves an account under water.

Sources