Banked 2026-06-11 (SEAMS/oracle lane, Euler v2 EulerRouter resolvedVaults follow-up to pufETH + Morpho).
Euler EulerRouter.resolveOracle prices resolved ERC4626 vaults via RAW convertToAssets(inAmount) with ZERO cap/bound/staleness/sanity check (confirmed in euler-price-oracle/src/EulerRouter.sol). Donation-resistance is the resolved vault's accounting + the governor's choice. Thesis: a LOW-TVL, raw-balance (donation-inflatable) external ERC4626 priced as collateral with live LTV + borrowable liquidity = economical donation over-borrow.
The donation-inflatable low-TVL vault EXISTS (Angle stUSD, ~$301k, fork-proven +33% on 100k USDA donation), IS resolved by a real EulerRouter (0xfe3ED784), and HAS a dedicated stUSD escrow vault (estUSD-1 = 0x117576B8854a03aB7C3dF1Cf1cd8E04767BfA866). But: estUSD LTVBorrow=0 on EVERY borrow vault in the cluster (un-borrowable), cluster liquidity ~$3k dust, and the cluster is verified by NO default perspective (out of scope). Same end-state as Morpho deposit_disabled wind-down vaults: dangerous config exists but is operationally neutered.
GenericFactory.isProxy(vault) (factory 0x29a56a1b8214D9Cf7c5561811750D5cBDb45CC8e) returns:
- TRUE => EVK eVault. Exchange rate = (cash + totalBorrows + VIRTUAL_DEPOSIT)/(totalShares + VIRTUAL_DEPOSIT) from INTERNAL cash accounting. DONATION-RESISTANT BY CONSTRUCTION. Skip.
- FALSE => external generic ERC4626 (sDAI, sUSDe, stUSD, wstUSR...). THE AT-RISK CLASS. Fork-test it.
This instantly cuts an 800+ resolved-vault universe to the ~5 external vaults worth testing.
Network-wide cast logs topic scan for ResolvedVaultSet (topic 0x15beaec7...) on publicnode FAILED (50k block cap + silent stalls, 0 events over the full range). The reliable path: get all 199 routers from oracleRouterFactory.getDeploymentsListSlice(0,199) and call resolvedVaults(candidateVault) on each for the known external-ERC4626 universe (sDAI/sUSDe/sUSDS/scrvUSD/stUSD/wstUSR/sfrxUSD/stEUR/steakUSDC). Cheap, deterministic.
r1 > r0 after donating asset() to the vault => inflatable; r1 == r0 => internal/wrapper-accounted safe. Never decide from balanceOf or marketing copy.After confirming a low-TVL raw-balance resolved vault:
- a) Find the escrow EVK vault with asset() == thatVault (the only way it's collateral).
- b) borrowVault.LTVBorrow(escrowVault) across the cluster's LTVList. LTV=0 everywhere => un-borrowable => WALK (this killed stUSD).
- c) borrowVault.cash() = borrowable liquidity. Dust => no extraction.
- d) Scope: <perspective>.isVerified(vault) across governedPerspective (0xC0121817...), eulerUngoverned0x/Nzx, escrow, edge. NOT verified by any => out of Cantina scope.
Euler Cantina bounty (https://cantina.xyz/bounties/4d285eee-..., LIVE, up to $7.5M High):
- In-scope = exactly the verifiedArray() of default perspectives + EulerSwap pools(). A non-verified curator cluster is OUT.
- "In governed vaults, configuration mistakes made by the governor are out of scope." + "Issues related to a malicious/compromised governor in EulerRouter" out of scope. + "Governors are considered trusted."
- => Resolving a donation-inflatable vault via convertToAssets and setting its LTV is a GOVERNOR CONFIG CHOICE = out of scope EVEN IF the cluster were governed/verified. Euler's own donation-attacks doc designates this a per-vault governor responsibility.
CONSEQUENCE: the resolvedVault-donation class is structurally excluded on Euler. Future Euler hunts should target EVK/EVC/EulerRouter CODE bugs (resolution recursion, read-only reentrancy on convert* during operations, configured-oracle-precedence edge cases, cross-vault EVC liquidation accounting), NOT governor oracle wiring.
Resolved external ERC4626 via convertToAssets: stUSD ($301k, INFLATABLE, OOS, LTV=0), sDAI ($176M, rate), sUSDS ($6.1B), sUSDe ($1.75B), scrvUSD ($22.2M), wstUSR ($2.33M, donation-PROOF). All EVK eVaults resolved are donation-resistant by construction. No live in-scope economical donation target exists.