Platypus Finance

Platypus USD

<p>On the 17th of February, an exploit was reportedly witnessed on the Avalanche-based <a href="https://blockchainreporter.net/glossary/stablecoin/" rel="noopener noreferrer nofollow">stablecoin</a> exchange named Platypus. The exploiter reportedly took away a profit of nearly $8.5M. The <a href="https://blockchainreporter.net/glossary/blockchain-3-0/" rel="noopener noreferrer nofollow">blockchain</a> security platform SlowMist reported the incident on its official Twitter channel. The company additionally shared a report on the respective exploit in brief to caution the community.</p><h2 id="header-0">Platypus Suffers a Loss of $8.5M via an Exploit, Says SlowMist</h2><p>The <a href="https://blockchainreporter.net/blockchain/" rel="noopener noreferrer nofollow">blockchain</a> security forum wrote a thread of tweets to highlight what took place in the exploit. It stated that the attacker initially borrowed nearly 44M USDC tokens from the AAVE platform by using the flash loan method. In the next step, the malicious actor deposited the borrowed funds into a Platypus-based pool to acquire deposit receipts in the form of LP-USDC. SlowMist mentioned that all of the respective deposit receipts were then deposited by the exploiter into the contract called MasterChef.</p><p>After doing that, the exploiter utilized the “borrow” operation for borrowing the entirety of the USP tokens existing in the <a href="https://blockchainreporter.net/tag/market/" rel="noopener noreferrer nofollow">market</a>. In addition to this, the exploiter updated the position as well as the debt information thereof. Next to that, the attacker used the MasterChef contract’s “emergencyWithdraw” operation to extract the funds at once. Nonetheless, during this function, the “isSolvent” operation was activated for the “platypusTreasur contract” to confirm the consumer collateral’s health.</p><p><img src="https://academy-public.coinmarketcap.com/optimized-uploads/6c90050444c649389b89422c1d15eb0b.png"></p><h2 id="header-1">Exploiter Calls Diverse Functions to Exploit the Exchange</h2><p>Since the debt of the attacker was lower than the peak borrowing amount, approval was provided. Without the deduction of the exploiter’s debt, the entirety of the receipts present in the respective contract was straightly transacted to the user.</p><p>In the end, the exploiter used the <a href="https://platypus.finance/" rel="noopener noreferrer nofollow">Platypus</a> pool’s withdrawal function for burning the deposit receipts as well as extracting the <a href="https://blockchainreporter.net/tag/USDC/" rel="noopener noreferrer nofollow">USDC</a> tokens. In addition to this, the exploiter utilized the borrowed USP tokens to swap for the rest of the stablecoins. Following that, the flash loan was repaid as well as profit was earned by the attacker.</p>

Avalanche-based Stablecoin Exchange Platypus Reportedly Loses $8.5M in an Exploit

Table of Contents

BlockchainReporter

Other articles published on Feb 17, 2023

SEC Sues Terraform Labs and Do Kwon for alleged cryptocurrency fraud

Reasons that support bitcoin over the currencies!

Multi-Chain Options Protocol Optix Launches With $1.8M Investment Boost

How to Revolutionise Loyalty Programs with Crypto?

Binance Mints 50M TrueUSD Days after Paxos Ordered Stop Issuing BUSD

BelNet: The Free & Fast dVPN

Join our free newsletter for daily crypto updates!