Breaking: Euler Finance Drained of $197M In Flash Loan Exploit

Euler Finance Drained of $197M In Flash Loan Exploit

Ramsha Naushad March 13, 2023

Decentralized finance (DeFi) platform Euler Finance has reportedly suffered an exploit of approximately $196.9 million, per audit platform BlockSec.

[{"selector":"#anim-83d88cb8-88d7-4dfc-9aea-4dbe62c05775","keyframes":{"transform":["translate3d(115.23810%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-703247fc-f0ff-44b8-a003-db45b5a42637","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-70624b20-9b8c-45bc-b61f-19c2329e4c49","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-60d36c70-e096-437d-b13b-c9c2006c7463","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c00bbed0-0eec-464a-9492-af5f1e23d8e1","keyframes":{"transform":["translate3d(-97.16981%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

The attacker nabbed $8.7M in DAI, $18.5M in WBTC, and a whopping $135.8M in stETH another $33.8 million in Circle's USD stablecoin USDC.

[{"selector":"#anim-d048bb94-8c55-4511-8df3-dc59cb9705d3","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-cb472221-ed11-491a-86ad-d5e09bf867de","keyframes":{"transform":["translate3d(-100%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-acdb00d8-ac70-48c9-8ab1-49f5b9335885","keyframes":{"transform":["translate3d(115.55555%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-19d8d40d-282e-4f38-a4ec-f3e403e1347b","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f6f643d8-c91c-4a30-97d4-dd0ccfe3bc5f","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Reports indicate the attacker used flash loans to nab a variety of assets.

[{"selector":"#anim-322b55d9-6601-411c-b0d9-add938b1193f","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-cdfbaa0e-9817-4f1c-91bb-6e336a14ae18","keyframes":{"transform":["translate3d(-100%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-177dcb15-a112-4970-ac19-e490bf2e4cb6","keyframes":{"transform":["translate3d(115.55555%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-38eebd5f-2fc4-4471-b881-e85b430ffad7","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-911a5d51-1a9c-470a-be46-72633bb0e3c7","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Euler Finance is a borrowing and lending platform for cryptocurrencies, allowing users to earn interest for adding various assets to the protocol.

[{"selector":"#anim-b6df8b0b-9c41-43f3-a5ef-ab236d5122a8","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-eaa3bd57-5b0a-4cdc-89c2-6b156986a631","keyframes":{"transform":["translate3d(-96.38009%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-bfe65d36-bd6b-44e8-9370-6b817c35e8a9","keyframes":{"transform":["translate3d(111.11112%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2e9473fb-a076-4f5b-96cb-44303fbd1e38","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-123792d2-23f0-455b-89de-61f3a3837154","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

A BlockSec spokesperson told that the root vulnerability is still unknown, but that the attacker used a series of six different flash loans to leverage the attack.

[{"selector":"#anim-876529c9-3c46-4047-8bed-4405ceb27af0","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8b9deaf0-d96b-4a3a-bfc2-8946d363caa5","keyframes":{"transform":["translate3d(-100%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c8876290-1228-47e8-b951-69e866a11590","keyframes":{"transform":["translate3d(115.55555%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-7bf54aa9-754e-432c-8e89-f36ba629533b","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-933e368a-cb41-4e9a-89f6-264a1d638d65","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Others reported that the "donateToReserves" function in the project's smart contracts is the key vulnerability.

[{"selector":"#anim-fe0b42ab-f2d3-4d49-9702-551cbfe0887d","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-87716e86-a3e7-40df-b2d3-2a3e93001ccf","keyframes":{"transform":["rotate(-1deg) translate3d(-99.51456%, 0px, 0) rotate(1deg)","rotate(-1deg) translate3d(0px, 0px, 0) rotate(1deg)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-df5d3062-a655-4090-ac67-1079c9c64283","keyframes":{"transform":["translate3d(111.74603%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d439c752-b846-4723-bed9-c2897641b510","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b52cbd85-33a8-4789-96ec-416bb205dcb1","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Euler tweeted that they are working with security professionals and law enforcement and will release further information as soon as they have it.

[{"selector":"#anim-1fd46944-e3bc-4173-9e92-2d4cf753a083","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-691da4d6-01f8-4572-ac4e-d1fec342c605","keyframes":{"transform":["translate3d(-99.51456%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-19a7d78f-08a0-4f19-821a-b44aa4c91825","keyframes":{"transform":["translate3d(115.55555%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d7867de3-8a84-46a7-8426-c87344d28048","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-297d342d-b641-40b0-89fd-462d342511e3","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-0b98a416-dfa9-479c-a7ba-ea8aeb5073d6","keyframes":{"transform":["translate3d(338.88885%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1000,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-42434c78-fa5c-47c9-b3ac-71294d821436","keyframes":{"transform":["rotateZ(180deg)","rotateZ(0deg)"]},"delay":0,"duration":1000,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] Read More!