Platypus Finance Hack

On July 11, 2023, Platypus Finance, a stableswap DEX on Avalanche, lost roughly $50,000 to an attacker who exploited how its pools priced one stablecoin against another. It was the second of three Platypus exploits in 2023.

Platypus valued the stablecoins in its pools as if they were worth exactly the same. The attacker deposited USDC, received LP-USDC, and withdrew that position as a different stablecoin asset in the pool, getting back more than the value put in. Verichains described the flaw this way: _deposit accepted the attacker's USDC, but _withdrawFrom returned more tokens than were deposited because of a logical error in the exchange-rate calculation. BlockSec described the same root cause as the protocol assuming a 1:1 ratio between stablecoins and ignoring their market price gap.

The team acknowledged the issue and paused pool operations. CertiK later put Platypus's total July 11 losses at about $157,000, because several addresses took the same arbitrage, not just the one attacker covered here.

Attacker address: 0xc64afc460290ed3df848f378621b96cb7179521a

Attack contract: 0x16a3c9e492dee1503f46dea84c52c6a0608f1ed8

Example attack transaction: 0x5e785b87e62252b1fff3283ce260d74cb5b3efc4588d7a0297f505482cbab388