Euler v2

This review rejects Euler V2 as a protocol-wide exposure but leaves a path to reopen a specific vault. This is not a postponed judgment. The original Euler lost about $197M in March 2023 and recovered 100% of the stolen assets. Their value was about $240M when returned. Euler V2 launched in September 2024 after a ground-up rebuild. Those facts deserve weight, but they do not support protocol-wide approval. Current evidence shows that Euler did not report $137M of protocol bad debt from Stream Finance. Its 2026 retrospective says Ethereum DAO-managed markets had zero direct Stream exposure, while the incentivized Plasma deployment lent heavily to Stream and was effectively wiped out. That is still a serious allocation and governance failure, not a second core-contract exploit. V2 is permissionless infrastructure: each EVK vault chooses collateral, LTVs, interest-rate model, oracle, hooks, governor, and upgrade posture. EulerEarn can allocate across as many as 30 ERC-4626 strategies, including external ones. “Known” vault metadata explicitly is not an endorsement, and curators can later change parameters. The formal rejected verdict states the decision clearly: reject Euler as a protocol-level exposure and reopen only a named vault after an independent, address-specific dossier. Brand, aggregate TVL, and audit count are not substitutes.

Review triggers: events that reopen the verdict
• No protocol-wide approval: only a named vault can be reopened
• Any candidate vault holding or accepting an asset outside the approved list
• Any realized bad debt, oracle failure, or loss in the candidate vault or an underlying strategy
• Governor, curator, strategy, oracle, implementation or upgrade posture changing outside the documented exit window
• Proposed-size withdrawal failing the written stress-liquidity limit

Watched nightly: a warning on its venues or files, or a cited document that changes, reopens the memo. The first confirmation is due 2026-11-16.

The research file

The mechanism

Euler V2 separates the lending primitive from the market product. The Euler Vault Kit deploys isolated ERC-4626 vaults. A vault holds one asset, and its configuration sets collateral relationships, loan-to-value ratios, an interest-rate model, price oracles, caps, and optional hooks. The Ethereum Vault Connector authenticates and batches operations across vaults, supports subaccounts and operators, and permits one vault’s shares to serve as collateral elsewhere. Isolation can contain a bad market, but links between vaults can transmit the economic risk selected by its creator. EulerEarn adds a managed meta-vault: one deposit asset can be allocated across up to 30 Euler or external ERC-4626 strategies under caps and ordered supply and withdrawal queues set by the curator.

Who controls it

Control is specific to each vault. A creator chooses whether an EVK vault is upgradeable or immutable and governed or finalized. For upgradeable vaults, the factory upgrade administrator controlled by Euler DAO can replace implementation code. A governor can change permitted parameters. Finalized immutable vaults remove both ways to make changes or patches. Governed vaults may use curators, timelocks, guardians, and emergency roles. EulerEarn owners assign roles and fees, curators add or remove strategies and caps, and allocators reorder flows. The docs warn that a “known” listing means only that the initial configuration was reviewed, not that the vault remains safe. Curators retain control and can misconfigure it. An institutional memo must therefore name every contract, governor, signer threshold, timelock, oracle, and strategy, not just “Euler.”

Failure and operating record

Euler V1’s March 2023 exploit removed about $197M. Euler’s recovery account says all stolen assets were returned after negotiations and were worth about $240M at recovery. V2 uses different code and launched in September 2024. Euler now reports more than 60 security reviews by more than 16 firms and a Cantina bounty up to $7.5M. These are issuer counts and do not certify each third-party vault, hook, oracle, or external strategy.

The late-2025 Stream episode is evidence about governance. Euler says DAO-managed markets had zero direct toxic-asset exposure and isolation contained them. But it also says Stream borrowed much of the incentive-driven liquidity on Plasma and that the deployment was effectively wiped out. Its own retrospective attributes the growth to weak curation, fragile deposits, and unclear responsibility, and records a 2026 leadership transition. That does not support the old $137M bad-debt claim. It does support requiring named accountability and loss history for every vault.

Exit and liquidity

An EVK lender can use the ERC-4626 withdrawal path only while the vault has unborrowed underlying liquidity. A borrow market with high utilization or losses can make an economically solvent share temporarily or permanently impossible to redeem. In EulerEarn, the curator’s withdrawal queue determines which underlying strategies are tapped first. A reserve strategy can make withdrawals faster at the cost of yield. Strategy losses, exhausted queues, and simultaneous withdrawals are therefore part of the client exit, not mere implementation details. Any proposed position needs a same-block measurement of cash, utilization, borrower concentration, queue, caps, and a withdrawal of the proposed size. Protocol TVL or share-token DEX volume cannot replace those measures.

Comparison and decision recommendation

Against Aave, Euler offers much wider freedom in market design and finer isolation, but transfers far more asset, oracle, and parameter research to each vault owner. Against Morpho, the underwriting problem is similar: the code may be common while the investable product is a curator and a finite allocation set. EulerEarn also permits external ERC-4626 strategies, so a familiar deposit symbol can hide risks outside Euler. Compared with a single immutable pair, a governed market can react to a failing asset. An immutable market removes administrator risk but cannot be patched or have its parameters changed.

Recommendation: reject Euler V2 protocol-wide. It remains a venue that may produce an approvable named vault. Any future approval must name the address, curator, and strategies, with no assumption of safety based on the Euler label.

Open questions and observable reopen tests

For a candidate vault, record the factory and implementation hash; upgrade flag; governor, guardian, owner, and allocator addresses; signer thresholds and timelocks; underlying asset; every collateral and strategy; oracle route and fallbacks; LTV, caps, utilization, and borrower concentrations; prior bad debt; incentives; and withdraw queue. Match the live configuration to the exact audit scope and simulate collateral impairment, oracle staleness, full utilization, and a run of the proposed size.

Reopen a named vault only after six months with no realized bad debt, every asset already approved, a verified accountable curator, risk-increasing changes subject to at least a one-day exit window, and the proposed position withdrawable inside the written slippage and timing limit under stress. Any unapproved strategy, unannounced governor change, audit-scope mismatch, or loss closes that vault file. No aggregate protocol metric can satisfy these tests.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Euler — V1 exploit recovery account · primary · accessed 2026-08-14
  Supports: $197M exploit, 100% asset recovery, $240M recovery value, V2 rebuild
• Euler — Q1 2026 retrospective · primary · accessed 2026-08-14
  Supports: September 2024 launch, Stream Finance exposure correction, Plasma loss, leadership transition, risk-management failures
• Euler docs — protocol introduction · primary · accessed 2026-08-14
  Supports: EVK mechanism, permissionless vaults, EVC composition
• Euler docs — EVK architecture and control · primary · accessed 2026-08-14
  Supports: upgradeability, governor, factory admin, vault configuration
• Euler docs — vault types and risk model · primary · accessed 2026-08-14
  Supports: governed vaults, unverified vaults, indirect collateral exposure
• Euler docs — known-vault metadata warning · primary · accessed 2026-08-14
  Supports: listing is not endorsement, curator parameter control, deprecated metadata
• Euler docs — EulerEarn overview · primary · accessed 2026-08-14
  Supports: 30 strategies, roles, caps, withdraw queues, external ERC4626 exposure
• Euler docs — interacting with EVK vaults · primary · accessed 2026-08-14
  Supports: withdrawal mechanism, vault shares, borrower liquidity
• Euler docs — security overview · primary · accessed 2026-08-14
  Supports: 60+ reviews, 16+ firms, monitoring, pause and upgrade
• Euler docs — Cantina bug bounty · primary · accessed 2026-08-14
  Supports: $7.5M maximum bounty, EVK and EVC scope, responsible disclosure

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.