Platypus Finance Hack
Reported loss
$9.2M
Collateral Withdrawal Solvency Error
What happened
On February 16, 2023, Platypus Finance's USP collateral system was exploited on Avalanche. The protocol reported $9.19 million across three attacks, with about $8.5 million involved in the first. A withdrawal logic error allowed collateral to leave while debt remained.
Technical root cause
MasterPlatypusV4.emergencyWithdraw checked solvency before reducing the staked balance. The ordinary withdrawal path checked after updating it. Omniscia said its earlier audits did not cover the exploited USP integration.
How it happened
- A 44 million USDC flash loan funded a liquidity deposit and LP-token stake.
- The attacker borrowed roughly 41.79 million USP against that stake.
emergencyWithdrawreturned the collateral while the USP debt remained outstanding.- The attacker redeemed the LP tokens and exchanged part of the unsupported USP for other stablecoins.
- Platypus's February 23 update reported approximately $2.4 million USDC recovered with BlockSec's assistance and $1.5 million USDT frozen. Those were different recovery states.
Protocol details
Classification
Protocol Logic
Protocol Type
DEX
Affected asset / contract
PTP
Implementation language
Solidity
Protocol links
Website
@Platypusdefi
Security review history
- Omniscia View report
- Hacken View report
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert twitter.com
- report Twitter/X Alert twitter.com
- report @CertiKAlert incident report twitter.com
- report @Platypusdefi incident report twitter.com
- report Platypus Finance Incident Post-Mortem medium.com
- report Update on Recovery Efforts After The Exploitation medium.com
- analysis Website reference cryptoslate.com
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
