Avalanche-based Stablecoin Exchange Platypus Reportedly Loses $8.5M in an Exploit

On the 17^th of February, an exploit was reportedly witnessed on the Avalanche-based stablecoin alternate named Platypus. The exploiter reportedly took away a revenue of almost $8.5M. The blockchain safety platform SlowMist reported the incident on its official Twitter channel. The firm moreover shared a report on the respective exploit in short to warning the group.

Platypus Suffers a Loss of $8.5M by way of an Exploit, Says SlowMist

The blockchain safety discussion board wrote a thread of tweets to focus on what happened within the exploit. It said that the attacker initially borrowed almost 44M USDC tokens from the AAVE platform by utilizing the flash mortgage technique. In the subsequent step, the malicious actor deposited the borrowed funds right into a Platypus-based pool to amass deposit receipts within the type of LP-USDC. SlowMist talked about that the entire respective deposit receipts had been then deposited by the exploiter into the contract referred to as MasterChef.

After doing that, the exploiter utilized the “borrow” operation for borrowing everything of the USP tokens current available in the market. In addition to this, the exploiter up to date the place in addition to the debt data thereof. Next to that, the attacker used the MasterChef contract’s “emergencyWithdraw” operation to extract the funds without delay. Nonetheless, throughout this operate, the “isSolvent” operation was activated for the “platypusTreasur contract” to verify the buyer collateral’s well being.

Exploiter Calls Diverse Functions to Exploit the Exchange

Since the debt of the attacker was decrease than the height borrowing quantity, approval was offered. Without the deduction of the exploiter’s debt, everything of the receipts current within the respective contract was straightly transacted to the consumer.

In the tip, the exploiter used the Platypus pool’s withdrawal operate for burning the deposit receipts in addition to extracting the USDC tokens. In addition to this, the exploiter utilized the borrowed USP tokens to swap for the remainder of the stablecoins. Following that, the flash mortgage was repaid in addition to revenue was earned by the attacker.