Euler Finance Hack Replayed: the One Missing Health Check

TL;DR

• On 13 March 2023, Euler Finance lost about $197M. Every call the attacker made was a public Euler function, or an Aave flash loan, and none of them reverted.
• The bug was one missing line. Every Euler function that could weaken an account, like withdraw and mint, ended with checkLiquidity(account). donateToReserves lowered the donor's collateral and never ran that check.
• donateToReserves was not part of the original code. It arrived later, as part of a fix for an earlier bug report.
• The attacker donated their own collateral until their account was underwater, then liquidated it from a second contract. Euler's liquidation discount grows as the health factor falls, so the attacker bought their own bad position at the maximum 20% discount. In the DAI market alone, that emptied the pool: 38.9M DAI.
• We rebuilt Euler's DAI market in Foundry and replayed the attack locally. Our figures land within 0.1% of the real transaction. With the one missing line added, the attack reverts at step six.
• The check for your own protocol: every function that lowers collateral or raises debt ends with the health check, including the small ones added later as a fix.

Watch the replay

What happened in the Euler Finance hack?

How Euler v1 accounted for collateral and debt

1. Deposit DAI, get eDAI. eDAI is your collateral.
2. Borrow, get dDAI. dDAI is your debt.
3. mint gives you both at once. Euler's own code calls it a "self-borrow": you receive eTokens and the matching dTokens in one call, borrowing against yourself.
4. Health = your collateral, weighted, divided by your debt. The weighting is a collateral factor; for a self-borrow in the same asset, Euler v1 used 0.95 (Constants.sol).
5. Below 1, anyone can liquidate you.

The missing line: withdraw versus donateToReserves

Every function that weakens an account ends the same way

1function withdraw(uint subAccountId, uint amount) external nonReentrant {
2    (address underlying, AssetStorage storage assetStorage, address proxyAddr, address msgSender) = CALLER();
3    address account = getSubAccount(msgSender, subAccountId);
4
5    updateAverageLiquidity(account);
6    emit RequestWithdraw(account, amount);
7
8    AssetCache memory assetCache = loadAssetCache(underlying, assetStorage);
9
10    uint amountInternal;
11    (amount, amountInternal) = withdrawAmounts(assetStorage, assetCache, account, amount);
12    require(assetCache.poolSize >= amount, "e/insufficient-pool-size");
13
14    pushTokens(assetCache, msgSender, amount);
15
16    decreaseBalance(assetStorage, assetCache, proxyAddr, account, amountInternal);
17
18    checkLiquidity(account);
19
20    logAssetStatus(assetCache);
21}

donateToReserves lowers your balance and stops

1function donateToReserves(uint subAccountId, uint amount) external nonReentrant {
2    (address underlying, AssetStorage storage assetStorage, address proxyAddr, address msgSender) = CALLER();
3    address account = getSubAccount(msgSender, subAccountId);
4
5    updateAverageLiquidity(account);
6    emit RequestDonate(account, amount);
7
8    AssetCache memory assetCache = loadAssetCache(underlying, assetStorage);
9
10    uint origBalance = assetStorage.users[account].balance;
11    uint newBalance;
12
13    if (amount == type(uint).max) {
14        amount = origBalance;
15        newBalance = 0;
16    } else {
17        require(origBalance >= amount, "e/insufficient-balance");
18        unchecked { newBalance = origBalance - amount; }
19    }
20
21    assetStorage.users[account].balance = encodeAmount(newBalance);
22    assetStorage.reserveBalance = assetCache.reserveBalance = encodeSmallAmount(assetCache.reserveBalance + amount);
23
24    emit Withdraw(assetCache.underlying, account, amount);
25    emitViaProxy_Transfer(proxyAddr, account, address(0), amount);
26
27    logAssetStatus(assetCache);
28}

It arrived later, as a fix

The Euler attack, step by step

Why the attack paid: a self-liquidation at the maximum discount

Replaying the Euler exploit in Foundry

What we rebuilt

The output

1[PASS] test_replay_theHack() (gas: 3757892)
2Logs:
3  Euler DAI pool before: 8,904,507 DAI
4  [1] Flash loan  30,000,000 DAI
5  [2] Violator deposits  20,000,000 DAI
6        -> 19,559,902 eDAI
7  [3] Violator mints (borrows from itself)  200,000,000 dDAI of debt
8        collateral 215,158,924 eDAI | debt 200,000,000 dDAI | health 1.04
9  [4] Violator repays  10,000,000 DAI
10  [5] Violator mints again  200,000,000 dDAI of debt
11        collateral 410,757,946 eDAI | debt 390,000,000 dDAI | health 1.02
12  [6] Violator donates to reserves  100,000,000 eDAI
13        collateral 310,757,946 eDAI | debt 390,000,000 dDAI | health 0.77
14  [7] Liquidator liquidates the violator, 20% discount
15        gets 310,757,946 eDAI, takes on 259,283,999 dDAI
16  [8] Liquidator withdraws the whole pool  38,904,507 DAI
17  [9] Flash loan repaid  30,027,000 DAI
18        attacker keeps 8,877,507 DAI
19  Euler DAI pool after: 0 DAI

How close the rebuild is to the real transaction

The fix: one line, the same line withdraw already had

1    assetStorage.users[account].balance = encodeAmount(newBalance);
2    assetStorage.reserveBalance = assetCache.reserveBalance = encodeSmallAmount(assetCache.reserveBalance + amount);
3
4    emit Withdraw(assetCache.underlying, account, amount);
5    emitViaProxy_Transfer(proxyAddr, account, address(0), amount);
6
7    checkLiquidity(account); // the line withdraw already had
8
9    logAssetStatus(assetCache);
10}

1[PASS] test_fullAttack_withTheFix_reverts() (gas: 3672549)
2Logs:
3  [1] Flash loan  30,000,000 DAI
4  [2] Violator deposits  20,000,000 DAI
5        -> 19,559,902 eDAI
6  [3] Violator mints (borrows from itself)  200,000,000 dDAI of debt
7        collateral 215,158,924 eDAI | debt 200,000,000 dDAI | health 1.04
8  [4] Violator repays  10,000,000 DAI
9  [5] Violator mints again  200,000,000 dDAI of debt
10        collateral 410,757,946 eDAI | debt 390,000,000 dDAI | health 1.02
11  [6] Violator donates to reserves  -> reverted: e/collateral-violation, and the whole attack with it
12  Euler DAI pool after the attempt: 8,904,507 DAI

How to check your own lending protocol

1. List every function that can lower someone's collateral or raise their debt. withdraw and borrow, but also the quiet ones: a donation, a transfer of collateral tokens, a rewards claim, anything added later as a small fix.
2. Make sure every one of them ends with the health check. Not most of them. Every one, including the ones that look like they only help the protocol.
3. Ask whether a user can make their own position worse on purpose, then liquidate it themselves. If an account can choose its own health, it can choose its own discount.
4. Look at how your liquidation discount behaves. If it grows as health falls, question three matters even more, because the sickest account pays the best.
5. Give every change after launch the same review as the launch. donateToReserves was a small addition in a fix.

Sources

• Euler v1 source, euler-xyz/euler-contracts (master): EToken.sol, Liquidation.sol, Constants.sol
• CertiK, Euler Finance Incident Analysis
• BlockSec, Euler Finance Incident: The Largest Hack of 2023
• The Block, on how donateToReserves was added
• The DAI attack transaction: 0xc310a0affe2169d1f6feec1c63dbc7f7c62a887fa48795d327d4d2da2d6b111d (Ethereum mainnet, 13 March 2023)

FAQ

Glossary