If you notice some outdated information please let us know!
Process Quality Review (0.9)
Euler V2
PASS
Scoring Appendix
The final review score is indicated as a percentage. The percentage is calculated as Achieved Points due to MAX Possible Points. For each element the answer can be either Yes/No or a percentage. For a detailed breakdown of the individual weights of each question, please consult this document.
Very simply, the review looks for the following declarations from the developer's site. With these declarations, it is reasonable to trust the smart contracts.
- Here are my smart contract on the blockchain(s)
- Here is the documentation that explains what my smart contracts do
- Here are the tests I ran to verify my smart contracts
- Here are all the security steps I took to safeguard these contracts
- Here is an explanation of the control I have to change these smart contracts
- Here is how these smart contracts get information from outside the blockchain (if applicable)
This report is for informational purposes only and does not constitute investment advice of any kind, nor does it constitute an offer to provide investment advisory or other services. Nothing in this report shall be considered a solicitation or offer to buy or sell any security, token, future, option or other financial instrument or to offer or provide any investment advice or service to any person in any jurisdiction. Nothing contained in this report constitutes investment advice or offers any opinion with respect to the suitability of any security, and the views expressed in this report should not be taken as advice to buy, sell or hold any security. The information in this report should not be relied upon for the purpose of investing. In preparing the information contained in this report, we have not taken into account the investment needs, objectives and financial circumstances of any particular investor. This information has no regard to the specific investment objectives, financial situation and particular needs of any specific recipient of this information and investments discussed may not be suitable for all investors.
Any views expressed in this report by us were prepared based upon the information available to us at the time such views were written. The views expressed within this report are limited to DeFiSafety and the author and do not reflect those of any additional or third party and are strictly based upon DeFiSafety, its authors, interpretations and evaluation of relevant data. Changed or additional information could cause such views to change. All information is subject to possible correction. Information may quickly become unreliable for various reasons, including changes in market conditions or economic circumstances.
This completed report is copyright (c) DeFiSafety 2023. Permission is given to copy in whole, retaining this copyright label.
Code and Team
100%
This section looks at the code deployed on the relevant chains and team aspects. The document explaining these questions is here.
1. Are the smart contract addresses easy to find? (%)
Smart contract addresses are easy to find in the developers section of the docs.
2. Does the protocol have a public software repository? (Y/N)
Yes, Link found in the footer of the homepage. Address: https://github.com/euler-xyz
3. Is the team public (not anonymous)?
There are links to the LinkedIn profiles of the senior members of the staff. Score 100%.
4. How responsive are the devs when we present our initial report?
Devs responded within 24 hours.
Code Documentation
46%
This section looks at the software documentation. The document explaining these questions is here.
5. Is there a whitepaper? (Y/N)
Euler white papers are listed in the footer of the homepage
6. Is the protocol's software architecture documented? (%)
There is a text overview of the protocol describing the main elements. It does not have links or diagrams. Score 40%.
7. Does the software documentation fully cover the deployed contracts' source code? (%)
Documentation is actually quite limited. There are comments in the code. The documentation sections for the major code elements of the Euler vault kit and the Ethereum Vault Connector both have most subsections blank (evidently and oversight). The Periphery section did have some contract documentation, but even here it was quite limited to just a sentence or two about the function with no links. Score 40%
8. Is it possible to trace the documented software to its implementation in the protocol's source code? (%)
Given the limited set of documentation, traceability is impossible. Score 0%.
9. Is the documentation organized to ensure information availability and clarity? (%)
The documentation is well organized but minimal. Given that major sections of the software documentation were blank a score of 50% is given.
Testing
73%
This section covers the testing process of the protocol’s smart contract code previous to its deployment on the mainnet. The document explaining these questions is here.
10. Has the protocol tested their deployed code? (%)
Test to Code = 22127 / 6903 = 320% which gives a score of 100% as per guidance.
11. How covered is the protocol's code? (%)
No indication of code coverage, but clearly there is a complete set of tests, Score 50%.
12. Is there a detailed report of the protocol's test results?(%)
Enter data here no test report is evident. Score 0%.
13. Has the protocol undergone Formal Verification? (Y/N)
Yes, there is [evidence ](lhttps://github.com/euler-xyz/ethereum-vault-connector/tree/master/certorain the GitHub that formal verification tests were run.
Security
97%
This section looks at the 3rd party software audits done. It is explained in this document.
14. Is the protocol sufficiently audited? (%)
There is a full list of audits by a number of very reputable auditors. Findings are public and largely implemented. Score 100%.
15. Is there a matrix of audit applicability on deployed code (%)? Please refer to the example doc for reference.
On the audits page there is a list of many audits where the scope, auditor and date are listed. There is no indication of applicability. This only partially addresses the requirements and gets a score of 60%.
16. Is the bug bounty value acceptably high (%)
Euler has a $5 million bug bounty via Cantina. This gives a score of 100%.
17. Is there documented protocol monitoring (%)?
Euler has comprehensive protocol monitoring technology, that individual votes can opt into. There is however no indication of an incident response process. This gives a score of 80%.
18. Is there documented protocol front-end monitoring (%)?
There is comprehensive application/website security documentation. This gives a score of 100%.
Admin Controls
73%
This section covers the documentation of special access controls for a DeFi protocol. The admin access controls are the contracts that allow updating contracts or coefficients in the protocol. Since these contracts can allow the protocol admins to "change the rules", complete disclosure of capabilities is vital for user's transparency. It is explained in this document.
19. Is the protocol code immutable or upgradeable? (%)
Euler appears to be mostly immutable. The Euler factory contract is upgradable. In addition, users can deploy vaults. These can be upgradable or immutable and with pause capability, all selected by the user that deploys the vault. While this makes does not fit with our guidance, we will give it 100% score both for its innovation and that it is primarily immutable.
20. Is the protocol's code upgradeability clearly explained in non technical terms? (%)
The mix of upgradability and immutable aspects of the core boiler code is not clearly described. Certain aspects are declared immutable, but other aspects are left unclear. The pause and upgradability capability in deployed vaults is clearly described. Score 70% as it is a mix.
21. Are the admin addresses, roles and capabilities clearly explained? (%)
The roles and responsibilities for the Multisig's are explained, but the addresses are not available. This gives a score of 80%, as per our guidance.
22. Are the signers of the admin addresses clearly listed and provably distinct humans? (%)
There is no information on the signers of the Multisig. Score 0%.
23. Is there a robust documented transaction signing policy? Please refer to the Example doc for reference.(%)
No transaction signing policy is evident.
Oracles
100%
This section goes over the documentation that a protocol may or may not supply about their Oracle usage. Oracles are a fundamental part of DeFi as they are responsible for relaying tons of price data information to thousands of protocols using blockchain technology. Not only are they important for price feeds, but they are also an essential component of transaction verification and security. These questions are explained in this document.
24. Are Oracles relevant? (Y/N)
25. Is the protocol's Oracle sufficiently documented? (%)
There is excellent documentation on the Oracle and Oracle adapters that can be deployed with user deployed vaults. Score 100%.
26. Can flashloan attacks be applied to the protocol, and if so, are those flashloan attack risks mitigated? (Y/N)
Euler is vulnerable to flash on attacks, depending on the setup of the user deployed vaults. There is a detailed description and mitigation of this attack vector described in the documentation.