Attack Vectors, Manipulation Mechanisms, and Mitigations Introduction The ERC4626 Tokenized Vault standard has exploded in popularity. Many protocols are racing to implement compatible contracts, hoping to become integrated with yield aggregators and to capture significant shares of trading volume and user share. However, as with any new technology, there are dangers that are not immediately apparent. Shortly after its release, it was identified that naive ERC4626 vaults are vulnerable to fi

Today marks a significant day for Euler Labs, as we proudly introduce The Ethereum Vault Connector, a public good, open-source primitive designed to make lending markets more customizable and interconnected, powering the creation of novel use cases. DeFi is Dead, Long live DeFi.  DeFi emerged as the answer to traditional finance's shortcomings — limited choices, opacity, and centralised control. For DeFi to continue fulfilling its mission, we believe our efforts must extend beyond just dece

"Tell me I can't, and then watch me work twice as hard to prove you wrong" - Unknown This feeling has resonated with us and with everyone in crypto for the last two years. As we now see, crypto is coming back, stronger than before. And it's not just crypto making a comeback – Euler is too.  Behind the scenes, we've been diligently building. Over the past several months, our team has been in stealth mode, developing not one, but three projects. The moment to draw back the curtain and unveil to

TL;DR: * In March 2023, the Euler Protocol was exploited for ~$197 million in assets. * Over the course of the following three weeks, the Euler Labs team engaged in a highly strategic recovery effort that led to the return of ~$240 million in the stolen assets. * During the operation, multiple twists and turns threatened to throw things off course. These included the intervention of the notorious Lazarus Group, multiple red herrings, an unpredictable attacker and frontrunning bots. * The t

Containing Complexity Engineering is largely about containing complexity. By creating well-defined interfaces, and enforcing that modules interact through these interfaces, each module can ignore the inner workings of the other modules and focus on its own implementation. Consider engineers building a bridge. They don’t need to work out a new chemical composition of metal specific for their project. Instead, they will take an existing steel “off the shelf”. The steel is a module, and the inter

Which is better? I recently saw this claim: “If a smart contract is feature-oriented, then it is a product, not a protocol.” I thought this was an interesting distinction worth exploring in more detail, especially given the current trend of people advocating for the development of more primitive, base layer-type protocols. Distinctions The traditional definition of a protocol is a set of simple rules determining how information is transmitted between different parties or devices. The Inter

tl;dr SSTORE is one of the most expensive EVM opcodes. A savvy developer always optimizes their smart contract to use SSTORE in the most efficient manner. However, there’s a catch buried in EIPs that nobody talks about. Or at least, I haven’t encountered any information about it until today. tl;dr, Read the Conclusion. Background There are a ton of resources out there that can teach you how to reduce and optimize the gas consumption of your smart contract. Recently, I went through some of th

The Euler Labs team recently deployed a preventative update to the Euler smart contracts that protects contracts integrating with Euler against a class of manipulation attacks. As far as we know, no users were ever exploited by this issue, but it is quite an interesting attack vector and very likely applies to other projects as well. Background Like many other DeFi systems, Euler created a wrapper asset around deposited tokens. For example, eDAI is a wrapper for DAI. Since this is an interest

Euler Finance’s frontend has had a significant improvement to the health monitor! Thanks to the hard work of contributors, users can clearly understand the risk of other events while having no effect on a position. Given that this is a simulation (and has no effect on the user’s existing position), this will assist a significant refinement in risk management. Thanks to this boost to the Health Monitor, Users can now have a much clearer idea of what conditions might be met in order for their acc