The missing check
Euler let users donate part of their balance to the protocol’s reserves. Most state-changing functions in a lending protocol end by confirming the account is still solvent — the health check. This one did not, because donating to reserves does not obviously look like an operation that could make you unhealthy.
It could. An attacker took a flash loan, deposited, borrowed, then donated enough to push their own position below the liquidation threshold deliberately. They then liquidated themselves. Because the liquidation discount was calculated from the now-distressed position, self-liquidating was profitable, and the flash loan was repaid from the proceeds.
Audits and the shape of what gets reviewed
Euler had been audited multiple times. That is worth stating plainly rather than glossing, because “audited” is routinely offered to users as a security guarantee and this incident shows exactly what it is not. Reviewers examine what they recognise as risk-bearing. A donation function reads as a giveaway — the user is voluntarily reducing their own balance — and the adversarial framing in which that is the first move of an attack is easy to miss.
What a reader can take from it
Protocol risk is not well summarised by an audit count. The more useful questions are whether invariants are enforced uniformly across every state-changing path, whether the protocol is covered by an active bug bounty at a meaningful value, and whether there is monitoring that would catch an anomalous liquidation pattern in progress.
Timeline
Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.
- The attack executes across several Euler markets in a sequence of flash-loan-funded transactions. Euler confirms the incident. Euler Labs
- The attacker begins returning funds; substantially all of the assets are ultimately returned. Euler Labs
What to check
Euler Labs published a technical post-mortem, linked below, identifying the specific function and the missing check.
Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.
Sources
- Euler Labs, Euler Exploit Post-Mortem (13 Mar 2023)
Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.
Last verified by Conisec Staff.
