Platypus Finance (October 2023) hack — October 2023

Platypus Finance, a stableswap automated market maker on Avalanche, lost about $2.23 million on 12 October 2023 in three flash-loan-funded transactions against its WAVAX and sAVAX pools, sent from two externally owned addresses. It was the protocol's third incident of the year, after an $8.5 million loss in February and a $157,000 loss in July.

The attacks manipulated pricing rather than bypassing authentication. CertiK's analysis describes the first attacker flash-borrowing 1.1 million WAVAX and 991,000 sAVAX, depositing them to receive Platypus LP tokens, then routing swaps between the two pools and withdrawing in a sequence that distorted each pool's cash-to-liability coverage ratio. Platypus prices swaps and slippage from that ratio, so the distortion made subsequent swaps settle in the attacker's favour; CertiK put the residue after repaying the loans at about 111,000 WAVAX, roughly $1 million, and 20,000 sAVAX, roughly $200,000. Neptune Mutual's write-up traces the same behaviour to the _quoteFrom and _swappingSlippage functions.

Crypto Times, citing CertiK, reported the three transactions individually at $1.2 million, $575,000 and $450,000. One of the attacker's contracts was left callable by others, and the security firm Supremacy used that mistake to recover about $575,000 for Platypus, which it announced publicly. Halborn gives the recovered amount as roughly $575,000 and Neptune Mutual as about $567,000, tied to a residue of 50,000 sAVAX and 7,000 AVAX, leaving around $1.6 million unrecovered.

Platypus suspended all pools while it investigated and said it would resume trading once the issues were resolved. Totals published by security firms range from about $2.2 million to $2.23 million. No arrests connected to the October incidents have been reported.