Euler Finance suffered a flash loan attack, losing nearly 200 million dollars.

On March 13, 2023, the Euler Finance project suffered a major flash loan attack, resulting in a loss of approximately $197 million. This attack involved six different tokens and is one of the largest security incidents in the DeFi space in recent times.

Analysis of the Attack Process

The attacker first obtained a Flash Loans of 30 million DAI from a lending platform, and then deployed two key contracts: one for the lending operation and the other for liquidation.

The main steps of the attack are as follows:

1. Stake 20 million DAI in the Euler Protocol to receive 19.5 million eDAI.

2. Utilize the 10x leverage feature of the Euler Protocol to borrow 195.6 million eDAI and 200 million dDAI.

3. Use the remaining 10 million DAI to repay part of the debt and burn the corresponding dDAI.

4. Borrow the same amount of eDAI and dDAI again.

5. Donate 100 million eDAI through the donateToReserves function, then trigger liquidation to obtain 310 million dDAI and 250 million eDAI.

6. Finally, withdraw 38.9 million DAI, repay the Flash Loans principal of 30 million DAI, with a net profit of approximately 8.87 million DAI.

Vulnerability Reason

The core issue of this attack lies in the lack of necessary liquidity checks in the donateToReserves function of Euler Finance. Unlike other key functions (such as mint), donateToReserves does not call the checkLiquidity function to verify the user's asset status.

Under normal circumstances, checkLiquidity would call the RiskManager module to ensure that the user's eToken amount is always greater than the dToken amount. However, since the donateToReserves function skipped this step, the attacker was able to manipulate their own account into a liquidatable state, thereby carrying out the attack.

Security Recommendations

For DeFi projects, especially platforms that involve lending functions, special attention needs to be paid to the following points:

1. Ensure that all critical functions include necessary security checks, especially liquidity validation.

2. Conduct a comprehensive security audit before the contract goes live, focusing on core aspects such as fund repayment, liquidity detection, and debt clearance.

3. Regularly conduct code reviews and vulnerability scans to timely identify and fix potential risks.

4. Establish a sound risk management mechanism, set reasonable borrowing limits and liquidation thresholds.

5. Consider introducing additional security measures such as multi-signature or time locks to prevent rapid loss of large amounts of funds.

This incident once again highlights the importance of security in DeFi. Project teams should continuously strengthen their security awareness and adopt multi-layered protective measures to ensure the safety of user assets. At the same time, users should remain vigilant when participating in DeFi projects and understand the potential risks.