Euler Finance blocks vulnerable module, working on recovering funds
Decentralized finance (DeFi) lending protocol Euler Finance became a victim of a flash loan attack on March 13, resulting in the biggest hack of crypto in 2023 so far. The lending protocol lost nearly $197 million in the attack and impacted more than 11 other DeFi protocols as well.
On March 14, Euler came out with an update on the situation and notified its users that they had disabled the vulnerable Etoken module to block deposits and the vulnerable donation function.
The firm said that they work with various security groups to perform audits of its protocol, and the vulnerable code was reviewed and approved during an outside audit. The vulnerability was not discovered as part of the audit.
One of our auditing partners, @Omniscia_sec, prepared a technical post-mortem and analysed the attack in great detail. You can read their report here:https://t.co/u4Z2xdutweIn short, the attacker exploited vulnerable code which allowed it to create an unbacked token debt… https://t.co/FGnPqvYUGB
The vulnerability remained on-chain for eight months until it was exploited, despite a $1 million bug bounty being in place during that time.
Sherlock, an audit group that has worked with Euler Finance in the past, verified the root cause of the exploit and helped Euler submit a claim. The audit protocol later held a vote on the claim for $4.5 million, which was passed and later executed a $3.3 million payout on March 14.
The audit group, in its analysis report, noted that a major factor for the exploit was a missing health check in donateToReserves(), a new function added in EIP-14. However, the protocol stressed that the attack was still technically possible even before the existence of EIP-14.
Related: More than 280 blockchains at risk of
Read more on cointelegraph.com
