Euler Finance: The $196 Million Attack That Defied Audits

The Rollercoaster Ride of Euler Finance

Euler Finance, a lending protocol built on Ethereum, took a big hit recently when it faced a $196 million flash loan attack on March 13. Talk about a gut punch! This incident came as a shock since the platform had been audited ten times over two years, with results showing it was deemed “nothing higher than low risk.” Someone might want to start questioning the reliability of those audits!

Auditor Confidence: A False Sense of Security?

In a series of tweets, Euler Labs’ CEO, Michael Bentley, expressed his distress over the attack, pinpointing it as one of the hardest times in his career. He highlighted that Euler had gone through the due diligence of security audits performed by various firms, including Halborn, Solidified, ZK Labs, Certora, Sherlock, and Omnisica. Despite all that, the attack twisted the knife: who knew that ‘nothing higher than low risk’ could be so misleading?

Audit Results That Missed the Mark

The audits, spanning from May 2021 to September 2022, had a risk assessment system where Halborn classified risks from ‘very low’ to ‘critical’. The findings? Euler consistently floated in the safer waters of low risk. With only a couple of low risks and three informational risks identified, one might think it was safe sailing ahead. Yet, irony appears to be a cryptocurrency enthusiast’s best friend.

What Went Wrong?

Surprisingly, the report from Omnisica pointed out some “incorrect paradigms” in Euler’s implementation—issues that, at least according to the final audit reports, were deemed dealt with. How could the eagle-eyed auditors have missed the proverbial elephant in the room? Or was it merely a case of wishful thinking and paper assurances?

Aftermath: The Hacker’s Ironic Dash

Just hours after announcing a $1 million bounty for leads on the hacker’s identity, the assailant started washing funds through Tornado Cash, leaving the good folks at Euler scratching their heads. Bentley’s resolve appeared undeterred as he tweeted he would never “forgive the attacker,” citing personal sacrifices made during this crisis. Ah, nothing like mixing the high stakes of crypto hacking with the adorable chaos of new parenthood!

Lessons Learned and Looking Ahead

The Euler Finance saga reminds us that while audits are crucial, they’re not foolproof. The real lesson? Perhaps it’s worth picking apart the findings with a fine-tooth comb rather than skimming through the surface. Additionally, incidents like this one prompt protocols to reevaluate their security measures continuously. As they say, better safe than sorry, especially when millions are at stake!