The short answerEuler's March 2023 exploit cost $197m before negotiation returned almost all of it, and the team rebuilt rather than patched. v2's vault architecture allows precise, isolated risk configuration with extensive audits and a very large bug bounty. Permissionless vault creation means quality varies enormously.
Best forCustomisable lending vaults for any asset
Collateral & liquidation policyweight 25%
8.0avg 7.7
Oracle designweight 20%
7.5avg 7.6
Loss recordweight 20%
6.0avg 7.4
Rate qualityweight 15%
8.5avg 7.7
Governance & transparencyweight 10%
8.5avg 7.2
Coverageweight 10%
7.5avg 7.1
this service category average across 15Score = Σ mark × weight. Works well for a specific use case, weaker outside it. Methodology.
| Criterion | Mark | What we found | Source | Checked |
|---|
| Collateral & liquidation policy | 8.0 | not sourced yet | not sourced yet | — |
| Oracle design | 7.5 | not sourced yet | not sourced yet | — |
| Loss record | 6.0 | not sourced yet | not sourced yet | — |
| Rate quality | 8.5 | not sourced yet | not sourced yet | — |
| Governance & transparency | 8.5 | not sourced yet | not sourced yet | — |
| Coverage | 7.5 | not sourced yet | not sourced yet | — |
What we liked, and what fell short
Liked- v2 vault architecture allows precise, isolated risk configuration
- Extensive audits and a very large bug bounty after the 2023 incident
- Attacker returned nearly all funds and users were made whole
Fell short- The March 2023 exploit was one of the largest in DeFi history
- Permissionless vault creation means quality varies sharply
Why the marks landed where they did
In March 2023 an attacker exploited a flaw in Euler's liquidation path — a donation attack that manipulated internal accounting — and drained $197m, one of the largest DeFi losses ever. After weeks of on-chain negotiation the attacker returned almost all of it, and Euler chose to rebuild the protocol rather than redeploy the old one.
What v2 changed
The Euler Vault Kit is a different architecture: vaults are created with explicit parameters, risk is isolated per vault, and the liquidation mechanics that produced the original flaw were redesigned rather than patched. Audit coverage is extensive and the bug bounty is among the largest in DeFi — appropriate responses from a team that has been through the worst outcome.
Permissionless creation and its implications
Anyone can deploy a vault with any parameters. That flexibility supports genuinely useful configurations and guarantees that badly parameterised vaults exist. As with Morpho, the protocol is the machinery and the specific market is what you must evaluate: check the collateral, the LTV, the oracle and the caps before depositing.
Assessing the history fairly
An exploited protocol that recovered funds, rebuilt from scratch and has operated without incident since is not the same risk as one that patched and continued. It is also not the same as one that was never exploited. Both facts belong in the assessment, which is why security scores 8 rather than 9 or 5.
Who should use it
Users who want configurable isolated lending markets and will evaluate the specific vault. Conservative depositors have less to gain here than at Aave.
FAQ
What happened in the Euler hack?+
In March 2023 an attacker used a donation attack against a flawed liquidation path to drain $197m. After on-chain negotiation, almost all funds were returned.
Is Euler safe now?+
v2 is a rebuilt architecture rather than a patch, with extensive audits and a very large bug bounty, and has operated without incident since. The history remains part of the risk assessment.
What is the Euler Vault Kit?+
A framework for creating isolated lending vaults with explicit, configurable parameters — collateral, LTV, oracle and caps set at creation.
Can anyone create a Euler vault?+
Yes, which means unsafe configurations exist. Evaluate the specific vault's parameters rather than relying on the protocol's brand.
