Euler Finance Integration

Euler Finance offers modular lending vaults where permission management is crucial for protecting capital efficiency and preventing unauthorized withdrawals. This guide details how to implement robust security policies for Euler integrations.

Security Architecture

Permission Patterns

1. Secure Deposits

When automating deposits, the critical invariant is ensuring the shares are minted to the smart account, not an attacker.

policies/euler-deposit.matador

import "abis/EulerVault.json" as Euler;

permission SafeEulerDeposit -> 1.0.0 {
    parameters: {
        authorizer: address,
        vault: address,
        account: address
    }

    pub fn authorize() -> bool {
        return authorizedBy(parameters.authorizer);
    }

    fn main() -> bool {
        if (context.target != parameters.vault) {
            return false;
        }

        if (context.selector == Euler.deposit) {
            return Euler.deposit.receiver == parameters.account;
        }

        return false;
    }
}

2. Operational Limits (Fixed Deposit)

Restrict a bot to one exact deposit amount for a single vault.

policies/euler-capped.matador

import "abis/EulerVault.json" as Euler;

permission CappedDeposit -> 1.0.0 {
    parameters: {
        authorizer: address,
        vault: address,
        depositAmount: uint256
    }

    pub fn authorize() -> bool {
        return authorizedBy(parameters.authorizer);
    }

    fn main() -> bool {
        if (context.target != parameters.vault) {
            return false;
        }

        if (context.selector == Euler.deposit) {
            return Euler.deposit.assets == parameters.depositAmount;
        }

        return false;
    }
}

3. Flash Loan Protection (Fixed Amount)

Euler EVault flash loans expose the borrowed amount and opaque callback data in calldata. This policy fixes the borrowed amount field and leaves callback-data validation to the delegated contract.

policies/euler-flash.matador

import "abis/EulerVault.json" as Euler;

permission SafeFlashLoan -> 1.0.0 {
    parameters: {
        authorizer: address,
        vault: address,
        amount: uint256
    }

    pub fn authorize() -> bool {
        return authorizedBy(parameters.authorizer);
    }

    fn main() -> bool {
        if (context.target != parameters.vault) {
            return false;
        }

        if (context.selector == Euler.flashLoan) {
            return Euler.flashLoan.amount == parameters.amount;
        }

        return false;
    }
}

Integration Tutorial

Setup Project

Install the CLI and download the Euler Vault ABI.

npm install -D @steerprotocol/matador-cli
mkdir abis
# Download Euler Vault ABI to ./abis/EulerVault.json

Write the Policy

Create policies/euler-guard.matador.

import "abis/EulerVault.json" as Euler;

permission EulerGuard -> 1.0.0 {
    parameters: {
        vault: address,
        account: address
    }

    fn main() -> bool {
        if (context.target != parameters.vault) {
            return false;
        }

        if (context.selector == Euler.deposit) {
            return Euler.deposit.receiver == parameters.account;
        } else if (context.selector == Euler.withdraw) {
            return Euler.withdraw.receiver == parameters.account;
        }

        return false;
    }
}

Compile & Deploy

Compile the policy and provision it to your smart account.

npx --package @steerprotocol/matador-cli matador-policy-cli compile policies/euler-guard.matador

Gas Optimization

Selector First: Always check context.selector == Euler.deposit or context.selector == Euler.withdraw before checking arguments. This fails fast if the function is wrong.
Batching: If you are performing multiple operations (e.g. approve + deposit), consider wrapping them in a MultiCall and using a policy that inspects the MultiCall data (advanced).

Troubleshooting

Issue	Cause	Fix
`PermissionViolation`	`receiver` mismatch.	Ensure your bot sends `receiver` as the smart account address, not `msg.sender` (which might be the bot EOA).
`Invalid Target`	Wrong vault address.	Euler has many vaults (one per asset). Ensure the policy parameter matches the specific vault you are interacting with.

Euler Finance Integration

On this page