Omniscia, the auditing partner of Euler Finance, has released a post-mortem report on the same which stated that the vulnerability that was exploited by the malicious hackers originated from the decentralized finance lending protocol’s incorrect donation mechanism that failed to account for the donator’s debt health.
The vulnerable code introduced in eIP-14 brought about several modifications throughout the Euler ecosystem. This enabled the attacker to create an over-leveraged position and liquidate it themselves in the same block by artificially causing it to go “under-water,” said the firm in a statement.
The feature at the center of the vulnerability was not in the scope of any audit conducted by Omniscia.
An outside audit was responsible for reviewing the vulnerable code, which was later approved.
However, the vulnerability was not discovered as part of that audit and remained on-chain for eight months until it was exploited on March 13th despite a $1 million bug bounty in place.
The flawed etoken module has been disabled to prevent deposits and the vulnerable donation function.
Following the attack, the DeFi protocol revealed working with various security groups to perform audits and has also tapped law enforcement agencies to recover the funds.
“We are devastated by the effect of this attack on Euler protocol users and will continue to work with our security partners, law enforcement, and the broader community to resolve this as best we can. Thank you so much for your support and encouragement.”
The post Euler Finance Flash Loan Exploit: Vulnerability Remained On-Chain for 8 Months appeared first on CryptoPotato.
—
Blog powered by G6
Disclaimer! A guest author has made this post. G6 has not checked the post. its content and attachments and under no circumstances will G6 be held responsible or liable in any way for any claims, damages, losses, expenses, costs or liabilities whatsoever (including, without limitation, any direct or indirect damages for loss of profits, business interruption or loss of information) resulting or arising directly or indirectly from your use of or inability to use this website or any websites linked to it, or from your reliance on the information and material on this website, even if the G6 has been advised of the possibility of such damages in advance.
For any inquiries, please contact [email protected]
