Euler Finance

Summary

Euler Finance is an Ethereum lending protocol built by Euler Labs (founded 2020 by Michael Bentley, Doug Hoyte, and Jack Prior) that set out to answer a question Compound and Aave deliberately avoided: can a money market list any asset permissionlessly without governance gatekeeping, and still contain the risk? Its v1, launched on mainnet in December 2021, combined permissionless listing with a tiered risk system, "reactive" interest rates that behaved like a control-system thermostat, and softer, MEV-aware liquidations. The experiment is also one of DeFi's most dramatic morality plays: in March 2023 a flash-loan attacker drained $197M through a missing health check in a governance-added donateToReserves function, then — after weeks of negotiation and on-chain messaging — returned effectively everything (~$240M at recovered-asset prices). Euler shipped a fully rebuilt, modular v2 in September 2024 after 31 audits, reframing itself from a monolithic money market into a "credit layer" of composable ERC-4626 vaults.

Design (Mechanism)

Euler v1's core bet was that listing risk could be priced and quarantined instead of vetoed:

• Permissionless listing with asset tiers. Anyone could activate a market for a token with a Uniswap v3 WETH pair. New assets entered an isolation tier (borrowable, but not usable as collateral, and not borrowable alongside other assets), could be promoted by governance to a cross tier (borrowable together), and only vetted assets reached the collateral tier. Systemic risk from junk tokens was structurally fenced off rather than excluded.
• Two-sided risk adjustment. Unlike Compound's collateral factors alone, Euler applied both collateral factors and borrow factors, discounting risky borrowed assets as well as risky collateral — an asymmetric-information-aware refinement of loan-to-value math.
• Reactive interest rates. Instead of hand-tuned kinked curves, Euler used PID-controller-style rates that adapted dynamically to push each pool toward a target utilization, reducing the governance burden of parameterizing hundreds of permissionlessly listed markets.
• Softer liquidations. Liquidation discounts ramped up Dutch-auction style as positions sank deeper underwater, rather than a fixed penalty, and gave slight advantages that dampened MEV-driven priority-gas auctions.
• eTokens/dTokens and deferred liquidity checks. Deposits and debts were tokenized, and multi-step positions (including sub-accounts and minting leveraged positions via mint()) could defer solvency checks to transaction end.

Euler v2 (Sept 2024) generalized all this into infrastructure: the Euler Vault Kit (EVK) lets anyone deploy customized ERC-4626 lending vaults in minutes, and the Ethereum Vault Connector (EVC) is an immutable primitive letting any vault accept any other vault as collateral — turning "the lending protocol" into a network of interoperating credit markets with per-vault, customizable risk governance.

Outcome

V1 grew to hundreds of millions in TVL and a native token (EUL, mid-2022). On 13 March 2023, an attacker used flash loans plus Euler's mint() leverage function and the donateToReserves() function — added later by governance and lacking the account health check that guarded other balance-changing functions — to make their own position deeply insolvent, self-liquidate at the maximum discount from a second account, and withdraw $197M across six pools. It was 2023's largest DeFi exploit at the time. What followed was unprecedented: Euler Labs paused the vulnerable module, coordinated with security firms and law enforcement, offered a 10% bounty, and negotiated on-chain; over roughly three weeks the attacker returned substantially all funds (~$240M in recovered asset value), and Euler ran a redemption process that made depositors essentially whole. Rather than patch v1, the team spent ~18 months rebuilding: v2 launched 4 September 2024 after 31 audits and with a $7.5M bug bounty, and subsequently rebuilt TVL into a genuine comeback story — one of very few protocols to fully recover users after a nine-figure exploit. Status: ongoing.

Why it worked

• The tier system genuinely solved the "long-tail listing" dilemma: isolation-by-default let permissionless markets exist without making every depositor bear every token's risk.
• Reactive rates and two-sided factors reduced the governance parameter surface — the right direction for a protocol with unbounded listings.
• The recovery worked because Euler Labs moved fast, kept legal and negotiation pressure credible, and gave the attacker a face-saving exit; the episode became the playbook for post-exploit negotiation.
• V2's EVK/EVC pivot converted a hard-won security reputation into an infrastructure position: modular vaults with an immutable connective primitive fit the post-2023 appetite for isolated, customizable risk.

Limitations and criticisms

• The 2023 exploit came from a governance-added function (donateToReserves) that skipped the liquidity check applied elsewhere — a one-line omission in code added after the original audits, showing that audit coverage decays as protocols mutate.
• Self-liquidation across sub-accounts plus maximum-discount soft liquidation created an internal arbitrage the design never priced: the attacker was both the insolvent borrower and the profiting liquidator.
• Deferred liquidity checks and mint() leverage made it possible to construct enormous synthetic positions within one transaction, amplifying a small logic flaw into $197M.
• V1's monolithic architecture meant one flaw endangered every pool at once — the failure mode v2's isolated vaults are designed to eliminate, but which any monolithic money market sharing one solvency surface remains exposed to.

Lessons

• Every state-mutating function needs the solvency check. The invariant "no operation may leave an account unhealthy" must be enforced structurally (as v2's EVC does at transaction end), not re-implemented per function by fallible humans.
• Audits are snapshots, not shields. Code added by governance after audit (eIP-level changes) carries disproportionate risk; incremental changes need the same scrutiny as launch code.
• Self-liquidation is an attack primitive. Any liquidation mechanism with discounts must consider the borrower and liquidator being the same economic actor across accounts.
• Negotiated recovery is a real strategy. A credible mix of bounty, deadline, chain analysis, and legal escalation recovered ~$240M — post-exploit incident response deserves design attention before launch.
• Monoliths concentrate risk; modules quarantine it. Euler's own redesign (isolated ERC-4626 vaults joined by a minimal immutable connector) is the clearest statement of the lesson its v1 taught.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial hypothesis, not historical fact. A v1-era redesign could have prevented the exploit with a single architectural rule Euler later adopted: route all balance-affecting operations through one solvency-check chokepoint rather than per-function checks — effectively pulling the EVC's end-of-transaction health enforcement back into v1. Second, treat self-liquidation as first-class: cap liquidation discounts when the liquidator and violator share funding provenance within the same transaction, or require liquidations to occur in a later block than the actions that created the insolvency, which would have broken the atomic flash-loan loop at minor UX cost. Third, gate reserve-donation and other "unusual direction" transfers behind a timelock or per-block size limit, since donations that worsen an account's health have no honest large-scale, same-block use case. Finally, the tier system could price listing risk more explicitly by requiring isolation-tier markets to fund a first-loss insurance tranche from their own interest spread, making the long tail self-insuring instead of merely quarantined.