Platypus Finance Hack

Reported loss $2.2M
Avalanche
Flash-loan-enabled pool price manipulation

What happened

Platypus Finance is a stableswap AMM on Avalanche. On October 12, 2023, it was exploited in three flash-loan transactions from two addresses, and about $2.23 million was taken from its WAVAX and sAVAX pools. The attacks brought roughly $1.2M, $575k and $450k. The flaw was in the pools' coverage-ratio accounting. When a withdrawal exceeded the pool's available cash, the contract cut the full liability but only part of the assets. That skewed the cash-to-liability ratio used to price swaps, so the attacker could swap on favorable terms in both directions. About $575k (the second attack's proceeds) was recovered early and moved to a Platypus-controlled Safe. On October 17, Platypus said it had negotiated with the exploiter and recovered about 90% of the stolen funds, putting the net loss at about 18,000 AVAX. This was Platypus's third exploit of 2023, after an $8.5M attack in February and a smaller one in July.

Attacker addresses: 0x0cd4fd0eecd2c5ad24de7f17ae35f9db6ac51ee7, 0x464073f659591507d9255b833d163ef1af5ccc2c First attack transaction: 0xab5f6242fb073af1bb3cd6e891bc93d247e748a69e599a3744ff070447acb20f

How it happened

  1. The attacker flash-borrowed about 1.1M WAVAX and 991k sAVAX.
  2. They deposited WAVAX into LP-AVAX and sAVAX into LP-sAVAX, which raised each pool's recorded liability.
  3. They swapped sAVAX for WAVAX to drain the WAVAX pool's cash, then withdrew their WAVAX deposit. Cash could not cover the withdrawal, but the contract still reduced the full liability while reducing assets only partly, which left the coverage ratio distorted.
  4. With the ratio skewed, the attacker swapped back, sending about 700k sAVAX in and getting about 992k WAVAX out, and made a smaller follow-up swap.
  5. They repaid the flash loans and kept about 111k WAVAX and 20k sAVAX in the first transaction. The pattern was repeated twice more, once from a second address.

Protocol details

Classification Protocol Logic / Oracle Manipulation
Protocol Type DEX
Implementation language Solidity
Protocol links Website @Platypusdefi

Security review history

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation Reentrancy

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes