Skip to content
#08 largest Input validation 2023

The Euler Finance hack — $197M lost

Loss$197M
Date13 Mar 2023
ChainEthereum
Failure classInput validation
In assetsbug lived on-chain for 8 months
Targetlending protocol
1

What happened

Euler added a donation feature in eIP-14: donateToReserves lets you give your own eToken balance to the protocol's reserves. Every other function that reduces a user's collateral ends with a solvency check. This one did not. So the attacker built layered leverage, then deliberately donated his own collateral away to make himself insolvent, and immediately self-liquidated — collecting Euler's own liquidation discount (up to 20%) on a debt he had manufactured. The feature had been live for eight months and sat outside the scope of the protocol's primary auditor.

2

How the attack ran

  1. Flash-loan and loop depositsLayered leverage — every step legitimate
  2. Donate your own collateraldonateToReserves: equity falls, debt does not
  3. No checkLiquidity()The one balance-reducing path that skips the solvency check
  4. Self-liquidate at a discountTake your own position at up to 20% off — $197M
3

The code

EToken.sol (eIP-14) — annotated
function donateToReserves(uint subAccountId, uint amount) external nonReentrant {
    address account = getSubAccount(msg.sender, subAccountId);
    ...
    decreaseBalance(assetStorage, assetCache, proxyAddr, account, amountInternal);
    increaseReserves(assetStorage, assetCache, amountInternal);
    ...
    // ❌ every other balance-reducing path ends with:
    //       checkLiquidity(account);
    //    this one returns without it.
}

// The three-step attack, all inside one transaction:
  1. flash-loan & loop deposits  → heavily leveraged position
  2. donateToReserves(...)       → collateral drops, debt untouched, no check
  3. liquidate(self)             → take the position at up to 20% discount
→ result: $197M across six Euler markets
4

What would have caught it

What an audit looks for: enumerate every path that can reduce collateral or increase debt, and prove each one ends in the same solvency check. A new feature is exactly where this invariant breaks — and "it was added after the audit" is how most of these end.
6

Sources

Every figure on this page comes from the post-mortems above, not from us. Losses are US dollars at the time of the incident.

Check your own contract for this

Input validation is one of the 203 classes the SaferICO scanner checks for. It will not review your signing process — but it will read your Solidity.

Run the scanner See how it is attacked Read the docs