Dissecting Euler Finance Examining the $197 Million Fraud Behind the Flash Loan Attack
Stay ahead of the game with Web3Sec.News, the ultimate community-driven platform for the latest news and insights on web3 security, blockchain technology, and audits.
Introduction:
On March 13, 2023, a clever attacker exploited a logical flaw within the platform’s recently announced donate liquidity feature, resulting in a large breach. This vulnerability resulted in a whopping $197 million loss. In this analysis, we go into the event’s complexities to comprehend the mechanics of the exploit.
The attacker planned a complicated operation using flash loans received from AaveV2, playing two unique roles: borrower and liquidator. The following sequence of events depicts the strategic techniques carried out.
What took place during the hack?
- To begin the attack, the hacker obtained a $30 million DAI flash loan and opened two accounts, one as the borrower and the other as the liquidator. The borrower used $20 million DAI to create 195 million e-DAI and 200 million d-DAI.
- To cause instability within Euler Finance, the borrower refunded $10 million DAI, causing the value of d-DAI tokens to decrease by the same amount.
- Taking advantage of this weakness, the borrower issued an additional 195 million e-DAI and 200 million d-DAI tokens. A weakness in the donateToReserve() method was exploited, resulting in the burning of e-DAI tokens while leaving d-DAI tokens untouched, resulting in an unbacked debt.
- The liquidator seized on the chance, liquidated the debt, and then borrowed it. This creative move resulted in a profit of 310 million e-DAI, which was effectively converted into 38.9 million DAI.
- The attacker repaid the flash loan after successfully executing the exploit, resulting in a net profit of 8.8 million DAI. This cycle repeated itself until Euler Finance’s reserves were drained.
The incident gives useful information and recommendations to strengthen against future vulnerabilities:
- Token Burn Precision: Ensure that token burns, including both e-DAI and d-DAI tokens, are executed meticulously in scenarios requiring the gift of funds to alternate accounts.
- Oversight of Collateralization: Implement severe checks within the donateToReserves function to ensure ongoing over-collateralization. If this criterion is not met, transactions should be suspended.
- Use trustworthy oracles or established market price feeds to reliably determine the market prices of collateral and loaned assets. This ensures that conversion rates are transparent and precise during liquidation.
- Introduce safeguards, such as minimum collateralization ratios and borrowing limitations, to prevent over-leveraging and reinforce the platform against potential malicious exploitation.
The Euler Finance incident highlights both how the world of decentralized finance is changing and how crucial it is to have strong security measures. The industry may move closer to a more stable and secure financial future in the context of decentralized finance by learning from similar incidents.
Remain vigilant and aware!!
Sign up today to stay informed about the newest trends in smart contract security
For more information: https://web3secnews.substack.com