Attack Scenario

In order for the attacker to be able to liquidate themselves, they had to deploy at least two contracts to exploit the vulnerability. The attack transaction⁶ submitted at approximately 2023–02–01 06:29:18 UTC invokes a contract that had been deployed in an earlier transaction⁷. This contract performs the following steps during the attack transaction’s execution:

Primary Contract:

- Acquire a 30m DAI flash-loan from AAVE V2 - Deploy the two contracts (violator⁸ & liquidator⁹) for the attack - Transfer the full 30m DAI loan balance to the violator

Violator Contract:

- Deposit 20m DAI to the DAI EToken of Euler Finance, receiving ~19,56m eDAI tokens - Create a 200m artificial eDAI leverage, minting ~195,68m eDAI and 200m dDAI to the violator - Repay 10m DAI on the violator’s position, causing their dDAI balance to go to 190m - Create another 200m artificial eDAI leverage, minting ~195,68m eDAI and 200m dDAI to the violator - Donate 100m eDAI to the reserve of the EToken At this point, we have the following violator state: eDAI: ~310,93m | dDAI: 390m In the above state, the violator contains a significantly larger amount of dDAI tokens than eDAI tokens that will never be collateralized as their backing was “erased” during the donation call. The liquidator will exploit this due to the calculations within the Liquidation module. As stated earlier, the Liquidation module will liquidate up-to the collateral balance of the user. The liquidator can thus liquidate the violator, incurring their full ~310,93m eDAI balance but only a portion of their dDAI balance, further exacerbated by the liquidation discount of Euler Finance⁵. As the maximum discount will be applied to this position due to how low its health level is, the liquidator will incur a ~310,93m eDAI balance with a conversion rate of 1.25 eDAI tokens per dDAI. This will ultimately evaluate to a post-fee ~259,31m dDAI balance.

Liquidator Contract:

- Liquidate the position, acquiring ~310,93m eDAI tokens and ~259,31m dDAI tokens - Withdraw the full reserve of DAI tokens by burning the corresponding eDAI tokens At the withdrawal step, the eDAI to DAI exchange rate honored by EToken is skewed as the exchange rate calculated¹⁰ factors in the total borrows of the system which are artificially increased by the liquidation’s repayExtra value. As such, an exchange rate of roughly 0,97 eDAI per DAI is utilized for the redemption. As the user is already “above-water” due to the maximum 20% liquidation discount that was applied during their liquidation, they are able to “burn” the ~38m eDAI required to release the ~38.9m DAI held by the contract. Ultimately, the attacker was able to retain the following assets post-execution of their transaction: +~8,877,507 DAI = ~8,779,854.423 USD The contracts the attacker utilized also possess non-zero eDAI and dDAI balances with a health factor of ~1.05 for the liquidator contract in particular. As such, users should avoid re-depositing DAI tokens to the EToken as they may still be vulnerable. We can assess the financial impact of the DAI asset and calculate an estimated profit of roughly ~8,779,854.423 USD as of 2023-03-13 12:42:00 UTC. The attack has been replicated to multiple other assets. As such, the deposit warning applies to the following EToken assets: DAI, WETH

Euler Finance Exploitation