On March 13, 2023, lending protocol Euler Finance took a major hit as it was targeted in a sudden credit attack that resulted in losses of up to nine digits. The Altcoin project recently published details of the attack, shedding light on how the hacker was able to exploit the protocol. Here are the details…
Details of altcoin hack revealed
The project shared an “autopsy” update on its official Twitter account, explaining the measures it took to fix the problem. These measures included disabling the EToken module, which blocks deposits, and the vulnerable donation function that allowed the attack to occur. The project also commissioned TRM Labs, Chainalysis, and the wider Ethereum security community to assist with the search and recovery of funds. He also provided and shared information with law enforcement agencies in the US and UK.
One of our auditing partners, @Omniscia_sec, prepared a technical post-mortem and analysed the attack in great detail. You can read their report here:https://t.co/u4Z2xdutwe
In short, the attacker exploited vulnerable code which allowed it to create an unbacked token debt… https://t.co/FGnPqvYUGB
— Euler Labs (@eulerfinance) March 14, 2023
The project also tried to contact the perpetrators of the attack to learn more about their options. Euler Finance’s audit partner, Omniscia, has prepared a technical autopsy that analyzes the attack in detail. According to Omniscia’s report, the attacker exploited a vulnerability in the protocol that allowed them to create an unrequited token debt position by donating funds to their reserves. As a result, the attacker was able to liquidate their accounts in this loss and profit from the liquidation returns. Euler Finance worked with various security groups to audit the protocol, and although the vulnerable code was reviewed and approved during an external audit, the vulnerability was not discovered.
Euler hack also affected these projects
The vulnerability remained on the chain for eight months until the attack occurred, despite the project offering a $1 million bug bounty program during that time. Euler Finance expressed its devastation over the impact the attack had on its users and pledged to work with security partners, law enforcement and the wider community to resolve the issue as best they can. Unfortunately, Euler Finance’s influence has spread to many other DeFi projects, as some use the Euler platform to build their products. Some popular altcoin projects influenced by Euler include:
- Balancer:The business transferred $11.9 million to Euler in bbeUSD tokens.
- YearnFinance:Estimated loss of $1.38 million.
- Angle Protocol:Estimated loss is 17 million USDC.
- Yield Protocol:Estimated loss of $1.5 million.
- Inverse Finance:Estimated loss of $860,000.
Other names such as Mean, Opyn and Sense also suffered losses. Sherlock, a leading insurance provider, reported that losses incurred by Euler Finance amounted to $200 million, and only $3.3 million of the $4.5 million portion of insured assets to date has been paid. The firm stated that it confirmed the root cause of the attack, assisted Euler Finance in filing a claim, voted on the claim, and the vote was accepted and settled the payment. Sherlock is one of Euler’s first clients and has worked with the project’s supervisors in the past.
Unfortunate news@eulerfinance, a Sherlock protocol customer, was hacked earlier today for ~$200M.
Sherlock verified the root cause, helped Euler submit a claim, held a vote on the claim for $4.5M (which passed), and executed $3.3M of the payout today.https://t.co/CT7aBml9bV
— SHERLOCK (@sherlockdefi) March 13, 2023
It’s worth noting that Euler Finance’s security audit was done before Sherlock’s competition model was released. This meant that only a few talented people reviewed the code base, rather than the 100-200 people who typically review projects in current Sherlock auditing competitions. This has been a painful lesson for everyone involved in the project.
How does EUL compare to the traditional market?
Wall Street digested the collapses of Silicon Valley Bank (SVB) and Signature Bank, both crypto-friendly, while the First Republic’s (FRC) plunge of 62 percent on Monday caused the banking industry to dive. By comparison, Euler tumbled roughly 50 percent after an exploit in which an attacker used a flash loan from Euler Finance to loot nearly $200 million. The two assets were the biggest losers in their respective markets on Monday. However cryptocoin.comAs we reported, in crypto, almost every asset rallied following the news that all bank creditors will be compensated.
The price movements of the FRC and EUL highlight how investors’ perceptions of market events can be more influential than actual events. The First Republic did not default, go bankrupt, or be seized by the government; in fact, it raised $70 billion over the weekend to support its liquidity. Meanwhile, Euler lost hundreds of millions of dollars from which there was little hope of getting it back. Still, traders punished FRC shares more harshly.
Still, security is one of the biggest concerns in the DeFi space, and this attack has shown how important it is to perform comprehensive security checks on every project before going live. While Euler Finance may have survived this attack, the damage it has done to its reputation and the wider DeFi ecosystem is already evident. At the time of writing, EUL is changing hands at $3.12, down 50 percent.
