A Detailed Analysis of Euler Finance’s $196 Million Flash Loan Attack

A Detailed Analysis of Euler Finance’s $196 Million Flash Loan Attack

Content provided by various contributors. DYOR.

On 13 March 2023 at 08:56:35 AM +UTC, DeFi lending protocol Euler Finance experienced a Flash Loan Attack.

Euler Finance is a protocol that operates as a permissionless lending protocol. Its primary goal is to facilitate lending and borrowing of various cryptocurrencies for users. The UK-based tech startup utilizes mathematical principles to develop non-custodial protocols on Ethereum and other blockchain networks, with a focus on achieving high performance.

Based on on-chain data analysis, the attacker has successfully executed multiple transactions resulting in the theft of approximately $197 million, making it the largest hack of 2023 thus far. Stolen assets include several million worth of DAI, USDC, Staked Ether (StETH), and Wrapped Bitcoin (WBTC).

The breakdown of the stolen assets are as follows:

The attack was possible due to a lack of liquidity checks in the donateToReserves function of the Etoken. The attacker executed multiple calls with different currencies to generate profit, resulting in a massive loss of $196 million across six different tokens. Currently, the funds remain in the attacker’s account.

The attacker’s address is: https://etherscan.io/address/0xb66cd966670d962c227b3eaba30a872dbfb995db

The attacker’s contract address is: https://etherscan.io/address/0x036cec1a199234fc02f72d29e596a09440825f1c

One of the attack transactions can be found here: https://etherscan.io/tx/0xc310a0affe2169d1f6feec1c63dbc7f7c62a887fa48795d327d4d2da2d6b111d

1. The attacker first borrowed 30 million DAI through a flash loan from Aave and then deployed two contracts: one for lending and one for liquidation.

2. The attacker then called the deposit function and pledged 20 million DAI to the Euler Protocol contract, receiving 19.5 million eDAI in return.

3. The Euler Protocol allows users to borrow up to 10 times their deposit by calling the mint function. The attacker leveraged this capability to borrow 195.6 million eDAI and 200 million dDAI.

4. The attacker called the repay function using the remaining 10 million DAI borrowed through the flash loan to repay their debt and destroy 10 million dDAI. They then proceeded to call the mint function again to borrow 195.6 million eDAI and 200 million dDAI.

5. The attacker then called the donateToReserves function and donated 10 times the amount needed to repay their debt, sending 100 million eDAI. They then called the liquidate function to initiate the liquidation process and obtained 310 million dDAI and 250 million eDAI.

6. The attacker called the withdraw function and obtained 38.9 million DAI, which they used to repay the 30 million DAI borrowed through the flash loan. They profited 8.87 million DAI from the attack.

First, let’s take a look at the donateToReserves function, which is where users become vulnerable to liquidation.

Comparing the donateToReserves function to the mint function in the diagram below, we can see that a key step, checkLiquidity, is missing from the donateToReserves function.

Next, we followed up and examined the implementation of checkLiquidity. We discovered the Call InternalModule function, which calls the RiskManager to check and ensure that Etoken > Dtoken for the user.

It is necessary to check the user’s liquidity each time an operation is performed by calling checkLiquidity.

However, the donateToReserves function does not execute this operation, allowing users to first put themselves in a state of liquidation through certain functions of the protocol, and then complete the liquidation.

The Numen Cyber Lab’s team has managed to reproduce the attack.

You may find out more details on the PoC at https://github.com/numencyber/SmartContractHack_PoC/tree/main/EulerfinanceHack

Euler Finance have confirmed the attack on their official Twitter (@eulerfinance) and have stated that they are currently collaborating with security professionals and law enforcement to address the issue.

Euler Finance recently provided an update on their efforts to recover funds for their protocol users. They outlined several actions they have taken since the attack, including stopping the direct attack as soon as possible by disabling the EToken module, which prevented deposits and the vulnerable donation function.

Additionally, they have engaged with various security organizations such as TRM Labs, Chainalysis, and the wider Ethereum security community to aid in the investigation and recovery of funds. Euler Finance has also shared information with law enforcement in both the US and UK.

Lastly, the company has attempted to reach out to the attackers to learn more about potential recovery options.

The recent attack on the Euler Finance protocol highlights the importance of implementing rigorous security measures, such as conducting thorough audits and regularly checking for vulnerabilities.

Bitcoin live price
price change

As the decentralized finance ecosystem continues to grow, it is crucial for projects to prioritize the security of their users’ funds and adopt best practices to mitigate the risk of similar attacks in the future

Read more from author

Editor's picks

The Best A.I. Crypto Trading Bots

As cryptocurrency evolves, trading has become increasingly automated, with many traders now relying on artificial intelligence (AI) and machine learning (ML) to maximize their profits. These AI-powered crypto trading bots are automated software designed to analyze market data, execute trades, and optimize profits on behalf of traders. Here are some of the top AI crypto trading bots of 2023: Dash 2 Trade As the overall best AI crypto trading bot for 2023, Dash 2 Trade boasts advanced intelligence and analytics…

The Latecomer’s Guide to Cryptocurrency

If you've arrived late to the cryptocurrency party, don't worry. It's always possible to start. Here's a primer to get you up to speed with crypto. Understanding Cryptocurrency Cryptocurrency is a form of digital or virtual currency that uses cryptography for security. Unlike traditional money, cryptocurrencies are decentralized and often operate on blockchain technology, a distributed ledger enforced by a network of computers known as nodes. The first and most well-known cryptocurrency is Bitcoin, but there are now thousands, including…

U.S. Crypto Tax Guide for 2023

The world of cryptocurrency is constantly changing, with innovations and new uses for digital currencies springing up every day. This innovation has left governments, including the U.S., scrambling to catch up. For example, as of 2023, the Internal Revenue Service (IRS) considers cryptocurrency property for tax purposes. This means the tax laws that apply to property transactions, like selling or exchanging property, also apply to cryptocurrencies. Cryptocurrency Basics Cryptocurrencies such as Bitcoin, Ethereum, and others are digital or virtual currencies…

The Best Beginner Crypto Trading Strategies to Learn

As the cryptocurrency market continues to evolve, it offers exciting opportunities for investors and traders alike. The market's volatility might seem intimidating for beginners, but if equipped with the right strategies, one can navigate the crypto space effectively. Here are some beginner-friendly crypto trading strategies that could help you embark on your trading journey. 1. Dollar-Cost Averaging (DCA) Dollar-cost averaging (DCA) is a strategy where you invest a fixed amount of money in a particular cryptocurrency regularly, irrespective of its…

Understanding Utility NFTs: A Comprehensive Guide

Before we dive into utility NFTs, let's briefly recap what NFTs are. NFTs, or Non-Fungible Tokens, are a type of digital asset created using blockchain technology. They're "non-fungible" because they are unique and can't be replaced with something else. This contrasts with fungible cryptocurrencies like Bitcoin or Ethereum, which can be exchanged like-for-like. NFTs can represent ownership or proof of authenticity for a wide range of tangible and intangible items, including artwork, collectibles, music, games, and more. What Are Utility…

A Beginners Guide to Trading Cryptocurrency in 2023

Cryptocurrency has gained considerable popularity in recent years, and many individuals are now exploring the opportunities it provides. Trading cryptocurrency may seem daunting to a newcomer due to its volatility and complexity. Still, this guide will simplify the process, providing a clear roadmap to entering the exciting cryptocurrency trading world. Understanding Cryptocurrency The first step is to understand the basics of cryptocurrency. A cryptocurrency is a digital or virtual currency that uses cryptography for security. It operates independently of a…

Cyfrin – Top Smart Contract Audit Company

The world of Decentralized Finance (DeFi) and blockchain technology is rapidly evolving, and with it come several security risks. As the industry matures, smart contract audits become increasingly important to ensure that projects run securely and efficiently. Cyfrin is at the forefront of this new blockchain security wave by offering developers and investors smart contract audit services. With experienced and certified professionals on staff, Cyfrin guarantees secure, reliable audits backed by industry best practices.  In this article, we'll look into…

How to Choose the Best Crypto Portfolio Tracker for Beginners

As a beginner in cryptocurrencies, it's essential to have access to accurate and up-to-date information to make informed decisions. A crypto tracker is a valuable tool that helps you monitor and analyze various cryptocurrencies, their prices, and other related data. This guide will walk you through choosing the best crypto tracker to suit your needs. Identify Your Requirements Before choosing a crypto tracker, it's crucial to determine your specific needs. As a beginner, you may be interested in the following:…

AI GameToEarn – Rewarding Player Skill and Competitiveness with $100k Guaranteed in a New Web3 Space

The transition from Web2 to Web3 has opened the door to new possibilities. However, AI GameToEarn has identified several challenges in the current gaming sector.  Through multiple features, a comprehensive tokenomics model, and a whitelist event, AI GameToEarn seeks to transform everyone's digital gaming experience. Today, we'll look at what this team intends to offer to the Web3 community. Then, we'll have time to mention the project's future milestones, NFTs, and more. Overview of AI GameToEarn Let's begin by understanding…