Feb 2023 - Platypus Finance Unchecked Stablecoin Collateral - $8.5m (Global)
"This Changes Everything. A whole new kind of AMM for stableswap. Lower Slippage. Simpler UX."
"One of the major problems found in the first generation stableswaps’ Closed liquidity pools is liquidity fragmentation, where the liquidity of different pools cannot be shared with one another, resulting in higher slippage."
"The design of other stableswaps requires multiple tokens of equal value within a pool, often complicating its pool compositions (pairing up LP token with new tokens). It significantly hinders the scalability of the protocol and leads to bad user experience."
"Platypus invents a whole new AMM on Avalanche - Open liquidity single-sided AMM managing risk autonomously based on the coverage ratio, allowing maximal capital efficiency."
"The key concept underpinning Platypus’ design is asset liability management (ALM). Platypus is the first of its kind to use a single-variant slippage function instead of invariant curves."
"A highly-specialised creature may be well suited to its own habitat, but Platypus’ attempts to adapt have ended up dead in the water.
Adding to its existing stableswap AMM platform, Platypus recently launched its own stablecoin, USP. However, just 10 days after launch, the new mechanism was attacked, depegging USP and leaving it heavily undercollateralised."
"Dear Community,
We regret to inform you that our protocol was hacked recently, and the attacker took advantage of a flaw in our USP solvency check mechanism. They used a flashloan to exploit a logic error in the USP solvency check mechanism in the contract holding the collateral."
"The attacker first took a flash loan of 44M USDC which was deposited into Platypus. The resulting LP tokens were then used as collateral to borrow 41.7M USP.
The emergencyWithdraw() function only checks whether the user’s position is currently solvent, but neglects to first check against any the effect of any borrowed funds. This allows the attacker to withdraw the supplied collateral while keeping the borrowed USP.
The collateral was then withdrawn to repay the flash loan, and the USP was swapped via Platypus pools, draining the existing liquidity of other stables (USDC, USDT, DAI, BUSD, etc.)."
"The hack has left USP depegged by over 50% as the attacker swapped the USP for other stables. The stolen $8.5M remain in the hacker’s contract, of which, $1.5M of stolen USDT has been blacklisted."
"The rather simple vulnerability, combined with the loot being left (or possibly trapped) as freezable, centralised stables suggests this heist may have been pulled off by a relatively inexperienced amateur."
"After just a few hours, fellow platypus ZachXBT managed to identify the culprit via their ENS address, linked to the exploiter’s transaction history. The same alias was used for now-deleted Twitter and Instagram accounts. The Platypus team have since appealed to the doxxed exploiter:
We're in the process of setting up a bounty & encourage the hacker to reach out to us. We also welcome anyone with useful information to come forward to us."
Further Analysis
Platypus has introduced a new kind of AMM for stableswap that manages risk autonomously based on the coverage ratio. The new design is intended to solve the problem of liquidity fragmentation and to simplify pool compositions, leading to a better user experience. Platypus recently launched its own stablecoin, USP, but the mechanism was attacked, depegging USP and leaving it heavily undercollateralized. The hack was due to a flaw in USP's solvency check mechanism that allowed the attacker to withdraw the supplied collateral while keeping the borrowed USP. The stolen $8.5M remain in the hacker's contract, of which, $1.5M of stolen USDT has been blacklisted. The culprit has been identified, and the Platypus team is setting up a bounty and encouraging the hacker to reach out to them.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
Dexible DEX Aggregator SelfSwap Exploit > > < < OASIS Application Wallet Software Exploited
Sources/Further Reading
Platypus - A Novel StableSwap: simple, flexible and scalable (Dec 31)
Rekt - Platypus Finance - REKT (Dec 31)
@Platypusdefi Twitter (Dec 31)
Avalanche Transaction Hash (Txhash) Details | SnowTrace
(Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|