Euler finance donation logic exploit: post-mortem and invariant breakdown
Euler Finance was exploited for $197 million on Ethereum mainnet due to an uncollateralized donation mechanism in donateToReserves() that broke health factor checks without verifying liquid balance solvency.
Vulnerability mechanics & exploit trace
On March 13, 2023, the attacker exploited eToken donation mechanics where donateToReserves allowed transferring eTokens to reserves while keeping debt in dTokens, triggering artificial undercollateralization without proper liquidation invariants.
- eToken.burn(subAccountId, amount);
+ require(checkLiquidity(subAccountId) >= 0, "Collateral breach");
+ eToken.burn(subAccountId, amount);Invariant check fails whenever sub-collateral accounts are allowed to donate debt tokens without an immediate inter-block solvency verification.
Some auditors contend that modular sub-accounts provide essential capital efficiency; however, unconstrained balance donations inherently invalidate lending protocol Nash equilibria.