This article is meant to analyze the Platypus Finance incident that occurred on the 17th of February 2023 at approximately 19:16 UTC¹ in an impartial way and identify the root cause.

Vulnerability Analysis

The vulnerability that was exploited stems from incorrect integration between the PlatypusTreasure² ³ and the MasterPlatypusV4⁴ ⁵contracts of the Platypus Finance ecosystem and namely an improper logical check being present in the MasterPlatypusV4 contract.

The PlatypusTreasure contract was recently launched⁶ ⁷ to support the USP stablecoin of Platypus Finance. The contract contains a mechanism that allows borrowing the USP stablecoin with assets that are presently staked in the IMasterPlatypus implementation referenced by the collateral settings of an LP asset (PlatypusTreasure::_getCollateralAmount).

While this by itself is not a vulnerable feature, the problem arises in how the outdated MasterPlatypusV4 implementation integrates with the an IPlatypusTreasure contract. The MasterPlatypusV4 contract implementation that was referenced by the proxy at the time of the attack was deployed on the 14th of November, 2022⁸, and contained a fatal misconception in its emergencyWithdraw mechanism.

The contract was built with the integration of IPlatypusTreasure at a later point as evidenced by its platypusTreasure member and its optionality in the codebase. Within the withdrawal workflows of the MasterPlatypusV4 contract, the IPlatypusTreasure::isSolvent function is invoked to perform a debt solvency evaluation.

Core Problem

The MasterPlatypusV4::emergencyWithdraw function performs its solvency check before updating the LP tokens associated with the stake position. As a result, it is possible for a user to withdraw their funds while they are being utilized as collateral for a debt position in PlatypusTreasure as the solvency check will succeed in all circumstances.

The MasterPlatypusV4::withdraw function is not susceptible to the same attack vector as it performs a solvency check after the stake position has been updated, ensuring that the PlatypusTreasure::isSolvent function takes into account the stake position with reduced LP tokens.

The issue could have been prevented by re-ordering the MasterPlatypusV4::emergencyWithdraw statements and performing the solvency check after the user’s amount entry has been set to 0 which would have prohibited the attack from taking place.

Alternatively, the MasterPlatypusV4::emergencyWithdraw could utilize the debtAmount variable yielded by PlatypusTreasure::isSolvent and ensured that it is 0, preventing emergency withdrawals with active debt positions.

Attack Scenario

Given that it is possible to provide collateral for a debt and proceed to withdraw it without repaying the debt, the exploiter is able to create what is known as “bad debt” in the system and acquire the debt’s upside.

The attack was executed in a single transaction which was submitted at approximately 2023–02–17 19:16:54 UTC¹ in which they performed the following:

Interestingly, the attacker’s contract performed multiple staticcall operations to the 0x000000000000000000636F6e736F6c652e6c6f67 address during the transaction’s execution. This address is in fact the “console” address in use by the hardhat toolkit⁹, indicating that the attacker used the hardhat toolkit to produce their contract.

The attacker did not liquidate the full ~41,794,533 amount of USP tokens they acquired, instead opting for smaller trades presumably due to insufficient liquidity in the USP pools they utilized. In detail, the transaction performed the following swaps before repaying the flash-loan:

Ultimately, the attacker was able to retain the following assets post-execution:

As the value of the USP asset is no longer considered canonical, we can assess the financial impact of the stablecoin assets it was liquidated to and sum a total estimated profit of roughly ~8,529,854 USD as of 2023-02-17 15:20:00 UTC.

Security Audit

Omniscia performed two security audits of the Platypus Finance platform simultaneously on November 21st, 2021 with a conclusion date of December 5th, 2021 and a final delivery date of December 24th, 2021. The publicly available audits¹⁰ ¹¹ did not cover the USP stablecoin or the PlatypusTreasure implementation.

While the MasterPlatypus implementation was in scope in the “governance” audit of the protocol, we performed an audit of the V1 implementation which contained no integration points with an external platypusTreasure system.

The Platypus Finance protocol has introduced numerous updates since the time the audit was finalized, including all contracts involved in the vulnerability (MasterPlatypusV4, USP, and PlatypusTreasure). These contracts were never in scope of any audit conducted by us and thus are considered to be unaudited code by our team.

Conclusion

The attack ultimately arose from improper integration of the MasterPlatypusV4 contract with PlatypusTreasure and did not perform its solvency check in the correct order, enabling collateral to be withdrawn with an active debt. As a result, “bad debt” could be created in the system at the expense of the protocol’s USP token which was then exchanged for multiple stablecoins.

Sources

https://medium.com/@omniscia.io/platypus-finance-incident-post-mortem-7b71a0a47a5e