Platypus to work on compensation plan after $8.5M attack

Decentralized concern (DeFi) steadfast Platypus is moving connected a compensation program for user's losses aft a flash indebtedness attack drained astir $8.5 cardinal from the protocol, affecting its stablecoin dollar-peg. 

In a Tweet connected Feb. 18, Platypus disclosed to beryllium moving connected a program to compensate the damages and asked users not to recognize their losses successful the protocol, saying this would marque it harder for the institution to negociate the issue. Assets liquidation are besides paused, said the protocol:

2/ We are moving connected a program to compensate the losses, delight DO NOT repay your USP and recognize the losses. It would beryllium easier for america to negociate the damage. Also, you don’t person to interest astir liquidation arsenic liquidation is paused, stableness interest aft the onslaught volition not beryllium counted

According to the firm, antithetic parties are presently progressive successful the funds' betterment process, including ineligible enforcement officials. Further details astir the adjacent steps volition beryllium disclosed soon, noted Platypus. 

Part of the funds are locked up successful the Aave protocol. Platypus is exploring a method to perchance retrieve the funds, which would necessitate the support of a betterment connection Aave’s governance forum.

Blockchain information steadfast CertiK first reported the flash indebtedness attack connected the level done a tweet connected Feb.16, on with the alleged attacker's declaration address. Nearly $8.5 cardinal was moved from the protocol, and arsenic a result, the Platypus USD stablecoin became de-pegged from the U.S. dollar, dropping to $0.33 astatine the clip of writing.

Platypus USD Price Chart (USP) - 7 days. Source: CoinGecko

"The attacker utilized a flashloan to exploit a logic mistake successful the USP solvency cheque mechanics successful the declaration holding the collateral,” said the company. A imaginable fishy has been identified. 

A method post-mortem investigation conducted by auditing institution Omniscia revealed the onslaught was made possible by incorrectly placed codification aft it was audited. Omniscia audited a mentation of the MasterPlatypusV1 declaration from Nov. 21 to Dec. 5, 2021. The version, however, “contained nary integration points with an outer platypusTreasure system” and truthful did not incorporate the misordered lines of code.

The flash indebtedness onslaught exploits the astute declaration information of a level to get ample amounts of wealth without collateral. Once a cryptocurrency plus has been manipulated connected 1 exchange, it is rapidly sold connected another, allowing the exploiter to nett from the terms manipulation.