Curriculum·G203 Reading Audit Reports·about 30 min
The audit that found it
By the end of this lesson you can
- →Explain why even a reviewed, competitive-audited protocol can ship a fatal bug, using Euler Finance
- →State how the donateToReserves interaction produced a 197 million dollar loss and what the auditor's response was
- →Compute the residual risk you carry after every audit, and why audits reduce but never eliminate it
- →Combine an audit's signal with the other evidence into a single decision about how much to expose
Graduate · enrolled learners
This lesson opens with Euler Finance, 13 March 2023.
- What happened
- Euler was an Ethereum lending protocol that had been through multiple audits and a competitive review. On 13 March 2023 a flash-loan attack drained almost 197 million dollars, the largest hack of that year. The flaw was in the donateToReserves function: it let an account donate funds to the protocol without a check on the account's own liquidity, which, combined with the ability to use borrowed funds as self-collateral and Euler's dynamic liquidation penalty, let the attacker push their own position into a deliberately unhealthy state and profit from liquidating it. Sherlock, one of the reviewers, publicly took responsibility for missing the vulnerability and agreed to pay a claim of 4.5 million dollars. The attacker, who identified as Jacob, later returned essentially all of the recoverable funds.
- The decision point
- Euler did everything a careful protocol is told to do. It was audited by multiple firms, it ran a competitive review, and a fatal bug shipped anyway, in a function whose missing liquidity check interacted with two other legitimate features to produce a 197 million dollar hole. The lesson is not that audits are worthless; Euler's would have caught many things, and one reviewer stood behind its work with a paid claim. The lesson is the residual: every audit reduces risk and none removes it, because a review is a finite human effort against an infinite space of interactions. A user cannot demand a guarantee that does not exist. They can read the audits as one strong input, combine it with the invariant, the vulnerability classes, the centralization and the tooling, and decide how much to expose to a residual that is never zero.
- Recorded loss
- $197,000,000
What you will be able to answer
- →What did Euler show about audits?
- →What is residual risk?
- →How do you use an audit in a decision?
- →What does no audit at all imply?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/
- https://immunebytes.com/blog/euler-finance-hack-mar-13-2023-detailed-hack-analysis/
- https://www.cyfrin.io/blog/how-did-the-euler-finance-hack-happen-hack-analysis
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The Euler loss is cited near 197 million dollars; almost all recoverable funds were later returned by the attacker. The Sherlock claim figure of 4.5 million is from public reporting.
The donateToReserves mechanism combined a missing liquidity check with self-collateralization and a dynamic liquidation penalty; the interaction, not any single feature, was the flaw. This lesson uses it for the residual-risk conclusion of the course.