Euler Earn

Identification (verified to October 4, 2026). Name: Euler V2 / Euler Finance. Website: euler.finance; docs: docs.euler.finance. Category: permissionless, modular DeFi lending/money-market infrastructure built from isolated ERC-4626 lending vaults, connected through the Ethereum Vault Connector (EVC).

Launch: announced February 22, 2024; production V2 launch was reported in September 2024. Native token: EUL, governance/reward token; Ethereum address 0xd9Fcd98c322942075A5C3860693e9f4f03AAE07b, cross-referenced by Euler’s address registry and its MiCA whitepaper. Chains supplied for this review: Arbitrum, Avalanche, BSC, Base, Ethereum, Linea, Monad, Plasma and Unichain.

Official materials also identify HyperEVM—not “Hyperliquid L1”—and list these networks in deployment/oracle infrastructure. Treat “Hyperliquid L1” as a naming discrepancy requiring address-level confirmation. Main contracts / explorer status. Euler’s canonical registry publishes network-specific EVC, eVaultFactory, eVaultImplementation, ProtocolConfig and related addresses, with bytecode-proven deployment reports. However, the required two-source cross-check including Dune cannot be completed because Dune MCP is unavailable in this run. Not verifiable as of October 4, 2026: a qualifying per-chain address table and explorer-verification status. Fork lineage. Euler V2 is not a conventional fork of Aave or Compound.

Euler describes it as rebuilt “from the ground up” after the March 2023 Euler V1 exploit. It is a new modular codebase, while retaining conceptual lineage from Euler V1 and established ERC-4626 lending designs. The EVK core was independently audited by ChainSecurity (June 18, 2024; two medium findings, one corrected and one risk-accepted), reviewed by OpenZeppelin, and subject to Certora formal verification. Not verifiable as of October 4, 2026: whether every current chain deployment exactly matches an audited revision without the requested Dune/explorer cross-check.

Malicious-modification history among similar Euler forks: Not verifiable as of October 4, 2026.

Euler V2 is a real product portal, not just a landing page: the docs explicitly point users to the official app at app.euler.finance and describe live protocol actions such as supply, borrow, repay, and withdraw, including liquidity-dependent withdrawals. The documentation also shows a mature developer surface, with a Developer Guide and a hosted HTTP API preview for indexed protocol data, plus SDK/periphery references for integrations. The UX appears active rather than static brochureware: getting-started and position-management pages describe wallet-connected workflows, market data like APY/LTV/liquidity, and operational flows for opening and managing positions.

I did not find reliable evidence here of broken links, fake metrics, or template-site signs in the current sources, so those specific issues are not verifiable as of 2026-10-04. On open API access, the docs do indicate an API surface: a hosted HTTP API preview for indexed protocol data and configuration references to V3 API endpoints/keys, which is consistent with an open or semi-open data API for integrators.

Euler V2 has a live bug bounty program on Cantina covering EVK, EVC, EPO, supporting components, EulerEarn, EulerSwap, and the web interface. It started on 2024-08-21. Published reward parameters include smart-contract findings up to $1,000,000 for high-impact issues with a $200,000 minimum payout, up to $200,000 for medium-impact issues with a $50,000 minimum payout, and web-interface findings up to $25,000 for critical issues.

The bounty page also shows a 7,500,000 USDC + rEUL + USUAL reward pool and reports 612 findings submitted. Earlier Euler security material referenced a separate older Immunefi-era bounty, but the current active program is the Cantina program.

As of October 6, 2026 — Euler V2 dependency/counterparty risk dependency_failure_active: false max_exposure_pct: null — Not verifiable as of October 6, 2026 because Dune/on-chain verification is unavailable. Primary dependency risk — vault-specific configuration. Euler V2 is permissionless and isolated by vault, but each market selects its own collateral links, LTVs, caps, governor, liquidation rules, and oracle route. Supported oracle components include Chainlink, Pyth, RedStone, Chronicle, fixed-rate and custom adapters. This limits protocol-wide contagion but creates heterogeneous curator, oracle-staleness, thin-liquidity, sequencer-outage, and price-manipulation risk. Observed dependency failures / lessons. Euler’s April 2025 FDUSD response shows a real depeg-control event: Gauntlet set supply and borrow caps to zero after FDUSD traded below $0.95, specifically to prevent stale-oracle borrowing.

In late 2025, the Stream Finance/Elixir crisis created stablecoin and lender-contagion risk; Euler’s retrospective states DAO-managed markets had zero direct exposure to Stream toxic assets, but also reports that some immutable, uncurated markets later suffered from stale collateral prices during Stream and Resolv-related events. These are historical incidents, not confirmed active failures as of the review date. Stablecoins, LST/LRT, RWA and issuers. Markets may accept USDC/USDT, LST/LRT assets, synthetic dollars, and tokenized/RWA assets. Examples include AXUSD RWA-enabled markets on Arbitrum and markets involving sUSDe, USDY, PYUSD, tokenized funds, and other issuer-dependent assets.

Failure scenarios include issuer insolvency, redemption suspension, depeg, wrapper/underlying mismatch, oracle lag, and liquidation-chain liquidity failure. Exact exposure by asset, issuer, and chain is Not verifiable as of October 6, 2026. Bridges, custodians, CEX/MMs. Euler is non-custodial and no direct CEX, market-maker, or custodian exposure was verified. EUL’s multichain design has used/recommended bridge frameworks including Wormhole NTT; bridge smart-contract, validator, censorship, and wrapped-asset risks remain relevant.

Exact bridge exposure for each listed chain/vault is Not verifiable as of October 6, 2026.

Euler V2 is organized as a non-custodial, smart-contract vault system rather than a centralized custodian: users deposit into isolated ERC-20 vaults and retain control via blockchain transactions, while the protocol’s modular design lets different vaults hold separate assets and risk parameters. Custody is therefore split across independent vault contracts instead of pooled in one omnibus account, and the protocol documentation explicitly says Euler V2 is built from independent vaults rather than a single shared lending pool. Withdrawals are not described as globally paused, but they do depend on each vault’s available liquidity and contract limits, so immediate full withdrawal may not always be possible if assets are borrowed or otherwise unavailable.

On segregation, the best-supported reading is partial segregation: assets are isolated by vault and collateral relationships are configurable per vault, but vaults can be connected through the interoperability layer so exposure is not fully siloed at the protocol level.

Assessment — Euler V2 key management (reviewed October 4, 2026): The previously recorded finding remains valid: Euler V2 does not use one protocol-wide user key. Key authority is separated into user authentication, delegated operators, vault governance, and factory upgrade control.

• User keys and delegation: The Ethereum Vault Connector (EVC) is the common authentication layer. A user’s EOA or smart-contract wallet remains the owner, while operators may be authorized to act for a specified account. EVC sub-accounts provide up to 256 isolated virtual accounts per owner. Signed EVC permits support gasless execution using ECDSA or ERC-1271 signatures.
• Risk controls for delegated keys: EVC lockdown mode restricts activity if an operator or permit is compromised; permit-disabled mode blocks permits signed by the owner. These are user-level emergency controls, not protocol-admin controls.
• Vault-level administration: Vaults outsource authentication to the EVC but retain authorization/business logic. Each vault has a governorAdmin, which may be a wallet, Safe multisig, governor contract, DAO, curator, or risk steward, depending on deployment. Governor contracts can use selector-specific roles, emergency guardians, and timelocks.
• Timelocked governance: Euler’s documented recommended structure separates routine changes from high-privilege administration using a wildcard timelock and an admin timelock. Emergency roles can act immediately for selected risk parameters, while broader reversals may remain timelocked.
• Upgrade authority: governorAdmin is distinct from the EVK factory’s upgradeAdmin. The latter can change the implementation used by factory-linked upgradeable vaults; immutable vaults are outside that upgrade path. Finalized vaults may have no governor at all. Risk conclusion: The architecture supports least-privilege delegation and separation of routine, emergency, and upgrade powers. The main residual risk is deployment-specific role configuration: a Safe, DAO, timelock, or EOA may hold materially different authority for each vault and chain. Current per-chain signer addresses, Safe thresholds, timelock memberships, and deployed role assignments: Not verifiable as of October 4, 2026. Dune/on-chain verification was unavailable in this run.

Assessment as of October 6, 2026. Addresses: Ethereum registry entries previously recorded: eVaultFactory 0x29a56a1b8214D9Cf7c5561811750D5cBDb45CC8e, eVaultImplementation 0x8Ff1C814719096b61aBf00Bb46EAd0c9A529Dd7D, EVC 0x0C9a3dd6b8F28529d72d7f9cE918D493519EE383, ProtocolConfig 0x4cD6BF1D183264c02Be7748Cb5cd3A47d013351b. Per-chain addresses for Arbitrum, Avalanche, BSC, Base, Hyperliquid L1, Linea, Monad, Plasma, and Unichain: Not verifiable as of October 6, 2026. Architecture: FactoryGovernor/admin → EVK Factory → upgradeable vault proxies → current implementation; separately, vault governorAdmin → vault configuration/oracle/router/IRM/caps/LTV/hooks; optional TimelockController → governor roles. Euler documentation states canonical upgradeable factories use FactoryGovernor; DEFAULT_ADMIN_ROLE can use adminCall, including implementation changes, while pause guardians can install a read-only proxy.

Vault governors may be EOAs, multisigs, or selector-based governance contracts. Controls and failure modes: documented roles can pause/unpause, upgrade factory-linked vault implementations, change vault parameters such as caps/LTV/IRM, and potentially alter oracle-router governance. Emergency roles may bypass routine timelocks. Whether users can withdraw or repay during a pause is deployment-specific: Not verifiable as of October 6, 2026.

Timelock presence, delay, pending operations, role membership, proxy-admin type, and renounced roles: Not verifiable as of October 6, 2026. Consequently, compromise of an effective factory admin could cause implementation-level compromise or freezing; compromise of a vault governor could materially change risk parameters. A direct user-fund drain by an admin key is Not verifiable as of October 6, 2026. Audits: Euler’s audit registry records multiple independent reviews covering EVC, EVK/oracles, EVK-periphery governors, and related components, but audit coverage is commit- and component-specific, not proof that every listed deployment is audited. On-chain verification: Dune was unavailable; no Dune query or execution IDs exist for this run.

All requested on-chain role, delay, proxy, withdrawal, and admin checks are therefore Not verifiable as of October 6, 2026.

Formal verification plus manual review, fuzzing, and testing of Euler v2 core and EulerEarn modules.

Security audit of the Ethereum Vault Connector (EVC), a core component of Euler v2’s modular vault architecture.

Euler V2 EVK audit; deployed-code match: Not verifiable as of 2026-09-05.

Corrected previously omitted report: BailSec retrospective audit of the canonical EUL ERC20.

New report: BailSec Euler Price Oracle audit.

EulerSwap review of the source tree.

Euler Price Oracle review of PendleUniversalOracle and CurveEMAOracle.

EulerEarn audit of core vault, factory, allocator and libraries.

New report: yAudit EVC set-size-increase review.

EulerSwap audit covering core swap, periphery and interfaces.

EulerSwap audit covering EulerSwap, factory, periphery and Uniswap hook.

EulerEarn formal-verification review covering libraries, EulerEarn, factory and PublicAllocator.

New report: Cantina EulerSwap V2 review.

EulerEarn audit covering vault, factory, allocator, libraries and interfaces.

EulerSwap review delivered through Cantina Managed.

Independent review of Euler v2 focusing on access control, math safety, decentralization, code stability, testing and verification.

Euler V2 EVK audit; deployed-code match: Not verifiable as of 2026-09-05.

Euler DAO funded a large security program for Euler v2: 29 external audit reports from 12+ firms plus a $1.25m post‑audit bug‑bounty contest.

Across Euler V2, public sources report 29–31+ audits by ~12–13 independent firms plus large‑scale audit competitions. Media and protocol communications agree that these engagements collectively identified two critical and five high‑severity issues, all reported as fixed before launch. Subsequent public bug bounty and Cantina audit‑contest activities reportedly found no remaining critical, high or medium‑severity issues; only low‑severity bugs were rewarded.

Exact mapping of each firm’s report to specific modules, chains, and deployments remains fragmented and not verifiable as of 2026-08-30 at a bytecode‑match level.

Euler V2 EVC audit; deployed-code match: Not verifiable as of 2026-09-05.

Euler V2 EVK audit; deployed-code match: Not verifiable as of 2026-09-05.

Euler V2 EVC audit; deployed-code match: Not verifiable as of 2026-09-05.

Euler V2 EVK audit; deployed-code match: Not verifiable as of 2026-09-05.

yAudit performed a comprehensive, independent audit of the Euler V2 EVC, EVK and EPO codebases over a 30‑day period. The engagement covered core vault connector logic, vault kit, and price oracle modules for the v2 architecture. Detailed findings (including severity and fix status) are in the PDF report; public secondary sources only state that issues were resolved, with no disclosed remaining ≥medium‑severity items.

Not verifiable as of 2026-08-30 whether this report’s scope covers all currently deployed chain variants or later upgrades.

Comprehensive code review of Euler v2 contracts (EVC, EVK, EPO repos) over ~30 days, including vault connector and modular vault architecture.

Assessment: Euler V2 is associated with Euler Labs, a UK-registered development company—not an anonymous team or an evident web-only front. The founders publicly identified in the available evidence are Michael Bentley, Doug Hoyte, and Jack Prior. However, the project’s credibility must be discounted for the material March 2023 Euler V1 exploit, despite the subsequent recovery of most or all recoverable assets. Founders and team

• Michael Bentley is identified as co-founder and CEO; published profiles describe an Oxford PhD/research background in dynamical systems, mathematical biology, and evolutionary game theory.
• Doug Hoyte is identified as co-founder and blockchain developer, with software, network-security, and financial-application experience.
• Jack Prior is identified as co-founder and full-stack developer; profiles attribute prior web-development roles to him.
• Euler Labs Ltd is registered with UK Companies House under company number 12863550. Its registered office is 128 City Road, London, EC1V 2NX. This verifies a UK corporate registration and registered office, but not a staffed operating office, employee count, or substantive UK operations. A real physical office beyond the registered address is Not verifiable as of October 4, 2026. Public versus anonymous; credibility
• The core founders are public and repeatedly identified across independent profiles and reporting.
• Their technical backgrounds and prior launch of Euler V1 support genuine protocol-building capability. The evidence does not establish prior successful companies or major projects comparable in scale to Euler; prior-project outcomes are Not verifiable as of October 4, 2026.
• Euler Labs appears to be a lean software/startup entity rather than a regulated financial institution. No evidence in the reviewed material establishes banking, broker-dealer, or comparable financial-services licensing. > Reality check — prior failure: On March 13, 2023, Euler Finance suffered an exploit reported at approximately $197–200 million, involving a code vulnerability. Reporting states that roughly $240 million in assets were ultimately recovered, including funds returned by the exploiter. Recovery reduces loss severity but does not remove the original smart-contract and governance-risk finding. Claims of extensive post-incident audits are reported, but audit quantity is not equivalent to safety assurance. Bottom line: Public founders, identifiable UK incorporation, and credible technical profiles are positive indicators. The decisive negative is the prior catastrophic exploit; Euler V2 should therefore be treated as a technically serious but demonstrably battle-tested—and not failure-free—startup protocol. On-chain founder holdings, current team status, office substance, and chain-by-chain exposure are Not verifiable as of October 4, 2026.

Euler V2 has a mixed but improving reputation. The principal negative factor is Euler’s March 2023 Euler V1 exploit, which caused approximately $240 million in losses before the stolen funds were reportedly recovered through negotiations; this history remains a material operational and governance risk, even though it is not evidence that V2 itself is fraudulent or insolvent. Euler’s own retrospective is a protocol-origin source and should not be treated as independent confirmation. Security and auditors. Euler reports more than 40 security reviews by 16+ firms, while its later security account says more than 60 reviews; the differing totals likely reflect different dates or scopes and should not be presented as a single independently verified figure.

Named review participants include yAudit and Spearbit, with additional firms such as ChainSecurity, Cantina, Cyfrin, and Fuzzland reported by secondary research. These reviews reduce—but do not eliminate—smart-contract and upgrade risk. On-chain verification of audit coverage, deployment integrity, TVL, and chain-by-chain exposure: Not verifiable as of October 4, 2026. Team and investors. Euler Labs is associated with founder Michael Bentley and co-founders including Jack Prior and Doug Hoyte; secondary sources also identify Kasper Pawlowski in senior technical leadership.

Reported backers include Haun Ventures, Paradigm, Variant, Jane Street, Uniswap Labs Ventures, Coinbase Ventures, Lemniscap, Jump Crypto, and FTX Ventures. The investor roster supports perceived institutional credibility, but it is not a guarantee of solvency, governance quality, or investor endorsement of every V2 deployment. Criticisms and unresolved concerns. The 2023 exploit, reliance on extensive audit claims from protocol-origin material, possible centralization and insider token allocation, and uncertainty around multi-chain deployments remain the main concerns. I found no reliable evidence in the gathered sources of a current fraud, rug-pull, sanctions, regulatory enforcement action, or V2 insolvency allegation.

Legal/regulatory status and sanctions screening: Not verifiable as of October 4, 2026. Market sentiment is best characterized as cautiously positive after the relaunch, but the recovery narrative and security statistics remain partly self-reported. Overall assessment: credible institutional backing and substantial post-exploit security investment, offset by a severe historical exploit and incomplete independent verification of current cross-chain risk.

As of October 6, 2026; off-chain data only. Dune MCP was unavailable, so on-chain balances, exposure, leverage, and revenue attribution are Not verifiable as of October 6, 2026. Economic model. Euler V2 is a permissionless, modular lending system built from isolated ERC-4626 vaults. Suppliers deposit one ERC-20 and receive shares; borrowers post accepted collateral and pay variable interest. Supplier yield is primarily borrower interest, net of configured protocol/curator fees and utilization effects.

EulerEarn can route deposits across configured Euler or external ERC-4626 strategies, including assets such as sDAI. Displayed APY may combine lending yield, intrinsic asset yield, and campaign rewards. Risk/strategy. The base activity is collateralized credit intermediation and is generally market-neutral at the protocol layer—not proprietary directional trading. However, vault composition permits directional exposure, looping/multiply, leveraged LST/LRT and LP positions, carry trades, synthetic assets, RWAs, and external-vault exposure.

Risk is vault-specific: collateral links, oracle, LTVs, caps, interest-rate model, hooks, governance, and liquidation settings differ by market. Withdrawals, gates, collateral. ERC-4626 withdrawals depend on available liquidity and contract limits; specific vault caps, liquidity constraints, and any cool-off/lock-up are market-specific. Collateral is accepted vault shares or compatible ERC-20 collateral, valued through configured oracle routes. Liquidation uses a reverse-Dutch-auction-style discount; bad-debt socialization may be enabled by a vault. TVL / revenue snapshot. DeFiLlama reports $347.48m TVL, down 2.3% over 30 days, with average supply APY 10.23% across 151 pools.

Requested-chain TVL: Monad $256.67m (73.9%), Ethereum $53.68m (15.4%), Base $17.97m (5.2%), Avalanche $4.61m (1.3%), Hyperliquid L1 $2.25m, Unichain $2.10m, Plasma $1.98m, BSC $1.47m, Arbitrum $0.99m, Linea $0.33m. The reported total also includes BOB, Sonic, Berachain, and TAC. Thirty-day fees were $1.75m; protocol revenue was $72.9k. APY history/volatility/sustainability: Not verifiable as of October 6, 2026 from the available sources; current APY is not sufficient to establish organic persistence or volatility. Contradiction: the supplied chain list omits several chains included in DeFiLlama’s current total; therefore the listed chains do not reconcile to total TVL. Structured fields: organic_yield_pct: null; leverage_ratio: null.

As of October 6, 2026 Status: Current reserve size, composition, liabilities, and per-chain balances are Not verifiable as of October 6, 2026. Dune MCP/on-chain balance queries were unavailable in this run; no independent current balance snapshot or liabilities statement was identified. Therefore no USD reserve value is reported. Known custody / addresses

• Canonical DAO Treasury: 0xC7C5aFDB61e08BE3e2FB09098412b5706EB5c550. Euler’s current documentation states that treasury assets were migrated there in November 2025, excluding protocol revenue temporarily retained during transition.
• Former Treasury / current Operational Multisig: the November 2025 governance update states the former treasury multisig was repurposed for protocol administration, with 6 Euler Labs signers + 2 Foundation directors and a 4/8 threshold.
• Operational wallet disclosed separately: 0x0e33089449606CDE00Ad767d66C28Cf4cfCF0bF5; its current balance and authority are Not verifiable as of October 6, 2026.
• Legacy Treasury: 0x25Aa4a183800EcaB962d84ccC7ada58d4e126992. The EUL contract’s documented mint destination is this address; it should not be treated as proof of current liquid reserves. > Contradiction / update: The prior finding said the signer set and threshold were unverified. This is now partially resolved for the former operational multisig (4/8), but the current Canonical DAO Treasury’s signer set, threshold, Safe configuration, and custody provider remain Not verifiable as of October 6, 2026. Composition / policy / attestations
• Historical figures include 6,236,107 EUL in the then-current DAO treasury as of January 31, 2025, and a March 2025 proposal for $500k USDC operating funds, 500,000 EUL strategic reserves, and up to $5m USDC reallocation. These are stale planning or historical figures, not current balances.
• Treasury transactions require multisig approval. The March 2025 proposal promised quarterly spending attestations, but a current independent attestation was not identified.
• Fee Flow is documented as inactive, with protocol fees set to 0%; new EUL issuance is capped at 2.718% of total supply no more than once per 365 days and directed to the Legacy Treasury.

As of October 4, 2026, Euler V2 has native token EUL (Euler), an ERC-20 governance token. Canonical Ethereum contract: 0xd9fcd98c322942075a5c3860693e9f4f03aae07b. Published bridged/deployed contracts exist on several networks, but full addresses for every requested chain—especially Hyperliquid L1, Linea and Monad—are Not verifiable as of October 4, 2026 without on-chain verification.

Supply/valuation: stated maximum supply is 27,182,818 EUL; circulating supply is approximately 24.03m. CoinGecko reports market cap about $34.46m and FDV about $38.97m; these are live aggregator figures, not on-chain measurements. Utility/governance: EUL provides voting power over protocol-code and DAO proposals.

Treasury transactions require multisig approval. rEUL is a locked incentive receipt redeemable 1:1 into EUL: 20% immediately and 80% linearly over six months. Revenue/buybacks/burns: Euler protocol fees are currently set to 0%; DAO governance could reintroduce them. Fee Flow payments do not inherently burn EUL.

No standing buyback or staking-yield program was verified. Reward emissions occur through user incentives/rEUL, but current emission totals are Not verifiable as of October 4, 2026. Announced allocation: users 25%; early users 1%; treasury 13.83%; Euler Labs shareholders 25.85%; DAO partners 9.67%; Encode 4%; employees/advisors/consultants 20.65%.

Historical vesting included 18-month, 30-month and 48-month schedules beginning January 1, 2022. Whether all announced unlocks occurred on-chain is Not verifiable as of October 4, 2026. DeFiLlama labels 69.7% insiders, 20.1% community, 9.2% farming and 1% airdrop, based on a January 2025 update—stale relative to this review.

Contract controls: Ethereum EUL exposes ADMIN_ROLE-controlled minting, capped at 2.718% of supply no more than once per 365 days, directed to the treasury; treasury address can be updated. No blacklist or transfer-fee switch was identified in the verified interface. Current role-holder identity, top-holder concentration, insider wallets, actual mints, burns and cross-chain balances are Not verifiable as of October 4, 2026.

Main reported listings include Binance, Upbit, Coinbase Exchange, Kraken, Gate, Toobit and KuCoin. DEX liquidity depth and chain-by-chain exposure are Not verifiable as of October 4, 2026.

Stress scenario: BTC falls below $10,000 — Euler Earn risk assessment A BTC collapse below $10,000 would create severe liquidation, liquidity, and loss-socialization risk for Euler Earn vaults with direct or indirect exposure to BTC collateral or BTC-linked debt. The magnitude cannot be quantified from the available evidence because on-chain exposure, vault allocations, collateral balances, debt, health factors, and cross-chain TVL were not verified. Not verifiable as of October 10, 2026.

• Euler positions become liquidatable when risk-adjusted collateral no longer exceeds liabilities; price or oracle changes can trigger liquidation, and positions may be liquidated repeatedly if they remain undercollateralized.
• Liquidations may fail to fully cover liabilities if collateral cannot be sold, transferred, or redeemed, or if the liability vault lacks liquidity. Oracle staleness, manipulation, incorrect routing, and insufficient swap depth are identified risk vectors.
• Euler documentation states that bad debt is generally socialized across vault depositors when collateral does not cover obligations. Therefore, a BTC shock could reduce the value of affected lending-vault assets and potentially transmit losses to depositors rather than remaining limited to borrowers.
• Euler Earn adds strategy and withdrawal-liquidity risk: immediate withdrawable liquidity may be below total vault supply, while curator and allocator decisions determine deployment and how quickly liquidity can be freed.
• If an underlying strategy realizes a loss, Euler Earn records the shortfall through lostAssets; negative-yield harvesting or an emergency strategy status can cause a sudden share-price decline, with losses socialized across depositors.
• Cross-chain exposure is not safely aggregatable without verified chain-level data. Arbitrum, Avalanche, BSC, Base, Ethereum, Hyperliquid L1, Linea, Monad, Plasma, and Unichain should be assessed separately. Chain-by-chain BTC exposure and each chain’s share of total exposure: Not verifiable as of October 10, 2026. Key institutional conclusion: treat a sub-$10,000 BTC event as a potential multi-stage stress: rapid oracle repricing, borrower liquidations, stressed collateral-sale liquidity, possible bad-debt socialization, and delayed or impaired Earn withdrawals. Exact loss severity, affected vaults, and concentration are Not verifiable as of October 10, 2026.

Stress scenario — 20% depeg of the largest collateral (Euler V2) Result: The loss cannot be quantified reliably because current collateral exposure, debt, vault configuration, and chain-level TVL are not verifiable from the available evidence. Not verifiable as of October 4, 2026. On-chain verification was unavailable, so no exposure, liquidation-loss, or chain-allocation figures are inferred. Mechanically, a 20% price decline reduces the collateral’s USD value by 20%. Whether this causes liquidations depends on each vault’s collateral factors, liquidation LTVs, oracle settings, debt composition, and available liquidation liquidity; these parameters are configured at the vault level rather than uniformly across Euler V2.

An account becomes liquidatable when its risk-adjusted collateral value is no longer greater than its liability. Liquidators can repay debt and receive collateral at a configurable discount, with the discount increasing as the account becomes more undercollateralized. If liquidation proceeds do not cover the outstanding liability, Euler V2 documentation states that bad-debt socialization is enabled by default: the residual liability is cancelled or allocated across depositors in the affected vault.

This creates vault-level depositor loss, rather than establishing a protocol-wide loss estimate. Historical reference, not a current stress estimate: During the 2023 USDC/DAI depeg, Euler’s forum reported that the markets represented approximately 20% of total supply at that time, while reporting no significant bad debt in the referenced update. This is an old, protocol-authored event record and does not establish present Euler V2 exposure or resilience. > Contradiction / data gap: A quantitative “largest collateral” stress result requires current on-chain balances and vault risk parameters. Those figures are unavailable here; therefore no claimed TVL or exposure number is accepted as verified.

Chain-by-chain exposure percentages for Arbitrum, Avalanche, BSC, Base, Ethereum, Hyperliquid L1, Linea, Monad, Plasma, and Unichain: Not verifiable as of October 4, 2026.

Status / change from prior finding (as of October 4, 2026): The earlier conclusion that Euler V2 was not live is superseded. Current Euler documentation describes deployed, configurable Euler Vaults, and DeFiLlama tracks approximately $347.8m TVL across 17 chains, including all 10 chains listed. However, the largest borrower/counterparty, its exact exposure, and concentration by vault are Not verifiable as of October 4, 2026 because Dune MCP is unavailable.

DeFiLlama is an analytics source, not raw on-chain verification. > Contradiction: The prior “no live multi-chain Euler V2 system” finding conflicts with current deployment documentation and analytics. The current evidence wins; exact on-chain balances remain unverified. Stress path — top counterparty becomes insolvent 1. Trigger: The borrower’s risk-adjusted collateral falls below liability, potentially because of default, collateral-price collapse, oracle movement, or illiquid collateral. The position becomes liquidatable.

2. First-loss / recovery path: A liquidator assumes some or all of the borrower’s debt and receives eligible collateral at a health-dependent discount. The borrower’s collateral is therefore the primary recovery source; the liquidator is economically compensated through discounted collateral, not a guaranteed protocol payment. 3. Residual expected loss: If collateral is exhausted while qualifying debt remains, the affected vault may cancel/socialize the bad debt across its depositors when bad-debt socialization is enabled.

Euler documentation says this is enabled by default for vaults, but configuration is vault-specific. Depositors—not a protocol-wide insurance fund—absorb the residual shortfall. 4. Smart-contract impact: Health checks permit liquidation; liquidation transfers debt and collateral between accounts; remaining uncollateralized debt is written down/socialized in the relevant vault.

Because Euler V2 uses independent vaults rather than one shared pool, contagion should remain market/vault-local, except where a vault’s shares or assets are reused as collateral elsewhere. Compensation: Liquidators receive discounted collateral. Depositors receive no documented automatic compensation for socialized losses. Treasury, insurance, rescue funding, and governance reimbursement are Not verifiable as of October 4, 2026.

Chain-by-chain counterparty exposure and loss allocation are likewise Not verifiable as of October 4, 2026.

Assessment: no verified evidence of committed fraud by the Euler V2 DAO or owners. As of October 4, 2026, the available evidence does not establish that Euler Labs, the DAO, or identifiable owners intentionally defrauded users. The prior Euler incident was a 2023 exploit of Euler V1: independent incident analyses describe an attacker exploiting vulnerable lending and liquidation logic, including donateToReserves(), rather than proving insider fraud. The stolen funds were subsequently reported as recovered following negotiations with the exploiter.

The evidence does identify governance and centralization considerations, but these are not fraud findings. One 2026 audit-style analysis reports that insiders and investors controlled a substantial share of EUL supply, presenting governance concentration risk; this is an analytics/audit interpretation, not evidence of embezzlement or fraudulent conduct. Euler’s reported 2026 proposal to sunset directly managed markets and vaults is a governance/business decision, not proof of misconduct. Conclusion for the stress scenario:

• Committed fraud by DAO: Not verifiable as of 2026-10-04.
• Committed fraud by owners/Euler Labs: Not verifiable as of 2026-10-04.
• 2023 exploit: verified by multiple independent incident accounts as an external code exploit, but attribution to DAO/owners is not established.
• Insider concentration: a governance-centralization risk, not evidence of fraud. On-chain verification, including treasury flows, owner-controlled addresses, and potential undisclosed transfers, was unavailable for this run; therefore no on-chain fraud determination can be made.

Assessment: not verifiable as an actual Euler V2 30-day negative-yield event. On-chain verification is unavailable in this run, so the required vault- and chain-level metric cannot be established: “Not verifiable as of October 4, 2026.” The stress interpretation remains valid if the premise is supplied: Euler V2 credit-vault yield is primarily generated by borrower interest. Supplier returns depend on borrow rate, utilization, vault accounting, and applicable interest fees; the documented relationship is approximately supply APY = borrow APY × utilization × (1 − interest fee). A negative primary yield over 30 days would therefore indicate that core lending carry failed to produce positive supplier returns during that window.

It would be a yield and liquidity stress, not proof of insolvency by itself. Potential consequences include:

• lower or negative realized supplier performance and reduced vault APY;
• withdrawals becoming less attractive relative to alternative venues;
• increased liquidity risk if utilization is high and suppliers attempt to exit simultaneously;
• greater sensitivity to borrower concentration, rate-model configuration, bad debt, fees, and asset-price or oracle stress. The evidence reviewed confirms the mechanism, but not a current negative 30-day result. Independent coverage describes Euler V2 as utilization-sensitive: low utilization can reduce supply yield toward zero, while higher utilization can improve returns but may indicate tighter liquidity. Analytics pages report aggregate APY figures, but they do not establish a negative 30-day primary yield across the specified chains or individual vaults. Contradiction / data gap: no independently verified chain-by-chain 30-day negative-yield figure was available. Any protocol dashboard or documentation claim about current yield would be an unverified marketing claim unless independently reproduced. Euler V2 must be assessed separately across Arbitrum, Avalanche, BSC, Base, Ethereum, Hyperliquid L1, Linea, Monad, Plasma, and Unichain; chain-level exposure percentages are Not verifiable as of October 4, 2026.

Assessment (as of October 13, 2026): hybrid/company-influenced governance; not a pure DAO. EUL holders can signal on Snapshot and, for applicable contract changes, vote on Tally. The documented flow is forum/RFC → eIP → Snapshot → optional Tally → execution by a Safe, governor, timelock, or Foundation. Snapshot is normally signaling-only unless an execution transaction follows.

Published parameters are 500 EUL Snapshot threshold/50,000 quorum and 75,000 EUL Tally threshold/815,480 quorum, but the live Snapshot configuration should be checked. Control map. Euler Labs develops the code and operates the frontend/products; the Euler Foundation is the legal, treasury, and operational wrapper. Current Terms state that Products are offered by the Foundation or affiliates, while the Protocol is not controlled by the Company. The Foundation says it is a Cayman Islands foundation company established in 2022; the named operating company, Euler Labs Ltd, is an active UK private company (company no.

12863550; incorporated September 7, 2020; London registered office). Foundation directors are described only as professional directors; names and an official registration number were not verified. Powers and key risk. EVK vaults may give a curator, DAO, multisig, or risk steward broad governorAdmin authority. Factory governors can pause or upgrade factory-linked vault implementations; emergency roles can lower LTVs/caps or pause operations, potentially bypassing ordinary timelocks.

A 2025 proposal explicitly assigned Euler Labs a canceller role and contemplated rapid-response actions bypassing traditional timelock/admin requirements. The 2025 restructuring proposed a Foundation treasury multisig and a separate operational multisig with six Euler Labs signers plus two Foundation directors at 4/8; the older treasury documentation states 4/9. Current signer membership, threshold, independence, and completion across all listed chains are Not verifiable as of October 13, 2026.

Dune was unavailable; voting concentration/top holders and on-chain role assignments are Not verifiable as of October 13, 2026. Conclusion: DAO influence is real but execution and emergency authority remain materially Foundation/Labs/multisig/curator controlled; DAO governance is therefore symbolic or partial rather than controlling.

As of October 4, 2026. Entity / jurisdiction. The structure is multi-layered: Euler Foundation, a Cayman Islands foundation company and contracting entity; Euler OpCo Ltd, a British Virgin Islands private company identified as the EUL offeror in the MiCA whitepaper; and Euler Labs Ltd, an active UK private company whose registered activities are software publishing and software development. Terms, restrictions and classification. The May 4, 2026 Terms distinguish the hosted “Products” and interface from the autonomous Protocol, disclaiming control, custody, fiduciary duties and broad liability. They impose sanctions/jurisdiction restrictions, including Iran, Belarus, Cuba, DPRK, Syria, Crimea/Donetsk/Luhansk and Russia, and permit access termination or reporting for sanctioned persons. Certain protocol components may have governors able to restrict users, freeze or transfer assets pursuant to legal or law-enforcement action.

The MiCA document identifies Euler OpCo Ltd as offeror, but is a project-issued whitepaper—not an independent regulator’s classification or authorization. No independently verified regulatory classification of Euler V2 itself was found: Not verifiable as of October 4, 2026. KYC/AML. The reviewed Terms contain sanctions and prohibited-use restrictions, but I found no verified evidence that Euler V2 performs universal customer KYC/AML for permissionless protocol users. Not verifiable as of October 4, 2026. Data protection. The privacy policy, effective August 28, 2024, covers websites and services and describes collection, use, retention and sharing of personal data. The Terms warn that blockchain data is public, immutable and not erasable by the Company, placing substantial privacy risk on users. Warnings, enforcement and litigation. No regulator enforcement action against Euler Foundation, Euler OpCo Ltd or Euler Labs Ltd was identified in the checked SEC, OFAC and UK-company sources; this does not prove none exists. Not verifiable as of October 4, 2026. A private New York commercial lawsuit filed June 9, 2026 names Euler DAO, Euler Foundation and Euler Labs among defendants; it is litigation, not regulatory enforcement, and was pending as of the latest docket update. Risk conclusion. The corporate wrapper and contractual restrictions do not eliminate protocol-level or cross-border legal risk. Liability allocation, arbitration/class-action waiver, sanctions screening, autonomous smart-contract operation, and uncertain regulatory treatment remain material institutional risks.

No exact GLEIF LEI record for 'Euler Foundation', 'Euler OpCo Ltd', 'Euler Labs Ltd', 'Euler Earn'. OFAC SDN screening of 'Euler Foundation', 'Euler OpCo Ltd', 'Euler Labs Ltd', 'Euler Earn': no match. SEC litigation and administrative release feeds: no mention.

Euler V2 does not appear to issue its own stablecoin; it is a lending protocol that supports third-party stablecoins such as USDC, DAI, USDT, USDS, USD0, and USR. A stablecoin depeg did occur in Euler’s ecosystem: the clearest protocol-relevant event in the retrieved sources is the March 11, 2023 USDC depeg monitoring thread, where Euler explicitly said USDC and DAI were affected and described them as unpegged at the time. The exact depeg count, last depeg date, and maximum depeg percentage are not verifiable from the available sources in this run, so those fields are left null per the evidence standard.

Euler V2’s principal risks remain deployment-specific because its modular, permissionless architecture lets each vault select its oracle, collateral graph, LTVs, caps, hooks, interest model, and governance structure. Current documentation still identifies configuration, oracle, composability, administrative, and liquidation risks; audits and formal verification reduce implementation risk but do not eliminate market or deployment risk. Cross-chain TVL, exposure, liquidity, and role assignments are Not verifiable as of October 5, 2026 because Dune MCP was unavailable.

Euler V2’s top 5 strengths are: (1) modular architecture — it is built from separate vaults rather than one monolithic pool, which improves flexibility and product design; (2) strong risk isolation — each market/vault is isolated by default, so issues in one vault are designed not to contaminate others; (3) composability through the EVC — the Ethereum Vault Connector lets vaults recognize each other as collateral and coordinate cross-vault account checks and actions; (4) permissionless market creation — builders can deploy configurable vaults/markets for ERC-20 assets without needing a centralized listing process; and (5) advanced developer and user tooling — Euler exposes configurable risk parameters, sub-accounts, batching, scoped permissions, hooks, and custom liquidation logic, which supports more capital-efficient and customizable lending products.