Blockchain security firm CertiK tweeted that it has spotted a flash loan attack on Avalanche-based stableswap platform Platypus DeFi. 

Platypus has not yet made a public statement on the incident.

A flash loan attack is a type of exploit that takes advantage of a feature offered by some decentralized finance (DeFi) protocols that allows users to borrow funds without collateral for a brief period. The attacker uses this feature to borrow a large amount of funds, which they then use to manipulate the price of a specific asset on a DeFi platform. Once the price is manipulated in their favor, the attacker repays the loan and keeps the profit. Flash loan attacks can be difficult to detect and prevent because they occur within a single transaction on a blockchain, and do not require any upfront investment or collateral.

Update: CertiK published analysis on Platypus DeFi exploit, claming the total losses are around $9M worth of assets.

#CertiKSkynet Analysis Today @Platypusdefi project was attacked via flash loans on AVAX resulting in total losses of ~$9M worth of assets. At this time, most of the stolen funds remain in the attacker’s contract address, with some sent to an EOA and AAVE pool.   

1/ The vulnerability appears to lie in the emergencyWithdraw function's validation of the MasterPlatypusV4 contract, which only fails if the borrowed assets exceed the borrowing limit.

2/ The function then proceeds to transfer all of the user's deposit assets without accounting for the value of assets borrowed by the user.

3/ The attacker deposited 44M USDC to the Platypus USDC Asset (LP-USDC) and gained 44M LP-USD. The attacker then deposited the LP-USD to MasterPlatypusV4.

4/ The attacker called the function borrow() to mint around 41.79M USP in the contract PlatypusTreasure. This is the maximum amount allowed by the borrow limit, which is set at 95% of the user’s collateral.14451

5/ Because the attacker didn’t borrow over the 95% cap, the isSolvent value returned as “true” which enabled the attacker to call the EmergencyWithdraw function and the full amount of 44M LP-USDC.

6/ The attacker then withdrew the 44M USDC from the Platypus USDC Asset (LP-USDC) and started swapping USP for multiple assets via the Platypus Finance Pool. After repaying the flash loan, the total loss to the Platypus platform was approximately $9 million.