Platypus Finance emergency-withdrawal logic flaw — Avalanche — 2023-02-16

Summary

Platypus Finance was an Avalanche-native AMM/stablecoin protocol implementing a single-side liquidity model with USP as its native stablecoin. On 2023-02-16, an attacker exploited a logic flaw in Platypus's emergencyWithdraw function to drain approximately $8.5M from the protocol's USDC, USDT, DAI, and BUSD pools.

The proximate cause — per PeckShield, Halborn, BlockSec, and Avalanche-team post-incident write-ups, all converging on the same root-cause description — was that the emergencyWithdraw function in Platypus's MasterPlatypusV4 contract was a "rescue path" intended to allow users to retrieve collateral in pause/emergency conditions. The function bypassed the standard solvency check that the primary withdraw function applied. Crucially, it did not verify that the caller had no outstanding borrow position against the collateral being withdrawn. An attacker, using flash-loaned working capital, was able to (i) deposit collateral, (ii) take a USP borrow position against the deposited collateral, (iii) call emergencyWithdraw to retrieve the collateral while the borrow remained outstanding (because the function did not check), and (iv) keep the borrowed USP minus the deposited collateral as net profit. Repeated across the affected pools and scaled by flash-loaned working capital, the cycle drained ~$8.5M before Platypus paused.

For OAK's purposes the incident is a clean T9.004 (access-control / logic misconfiguration) extraction with a T9.002 (flash-loan) precondition. The novel OAK contribution of the worked example is twofold: first, the emergency-withdrawal-function-as-T9.004-surface sub-pattern — structurally analogous to Euler's donateToReserves (March 2023, one month later, on the same access-control-misconfiguration class) — and second, the attribution-by-arrest-within-defender-relevant-timeline outcome, which makes Platypus the OAK v0.1 reference case for arrest-as-recovery-channel.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Platypus's MasterPlatypusV4 contract deployed with emergencyWithdraw as a rescue-path function bypassing the borrow-position-cleared check	T9.004 surface (latent)
2023-02-16 (attack tx window)	Attacker takes flash loan from Aave on Avalanche; deposits collateral into Platypus pools; opens USP borrow against the collateral; calls emergencyWithdraw retrieving the collateral while the borrow remains outstanding; repays flash loan; nets the borrowed USP across affected pools	T9.004 + T9.002 extraction
2023-02-16 (within hour)	Platypus operations team detects the drain; pauses affected pools; communicates with Avalanche team and forensic firms	(operator response)
2023-02-16 onward	PeckShield, Halborn, BlockSec, Avalanche team publish post-incident write-ups converging on the same emergency-withdrawal-function root cause	(transparency)
2023-02-16 → 2023-02-23	Forensic firms and law enforcement collaborate on on-chain attribution leads matching off-chain identifiers; lead routed to French Police Judiciaire	(attribution chain)
2023-02-23	French Police Judiciaire de Montpellier arrest two suspects (brothers); on-chain controlled addresses identified	(law-enforcement-mediated attribution)
2023-02-23 onward	Suspects' controlled addresses begin returning residual funds as part of negotiated proceedings	(recovery channel)
2023-Q2	French prosecutors file charges under French cybercrime statutes	(legal-process state)
Continuing	~$2.4M residual unrecovered; protocol-level remediation includes patching the emergencyWithdraw function and re-auditing all rescue-path entry points	(recovery / remediation state)

What defenders observed

• The bug shape is structurally identical to Euler's donateToReserves (March 2023). In both cases, an entry point intended for a non-attack use case (donation in Euler; emergency-rescue in Platypus) bypassed a solvency check that every other balance-affecting entry point on the same protocol enforced. The two incidents are one month apart in 2023; their proximity argues for OAK Mitigations treating "post-condition uniformity across all balance-affecting entry points" as a category-level audit-checklist criterion rather than as an individual finding. Diff-based audit reviews focused on the most recently changed code miss this class because the omission is a sin-of-omission on a previously-deployed function, not a line of new code.
• Emergency-withdrawal / rescue-path functions are a high-prevalence sub-pattern of T9.004. A non-trivial fraction of audited DeFi protocols ship with a rescue-path function whose original design intent was operational-safety (e.g., let users get out if the protocol is paused) but whose adversarial-use threat model was under-developed during initial review. Defenders auditing a new protocol should explicitly enumerate every rescue-path / emergency / admin-bypass entry point and verify that each one carries the same post-conditions as the corresponding primary entry point — or, where deliberate bypass is required, that the bypass cannot be combined with a borrow position to construct an extraction loop.
• Flash-loaned working capital was the precondition that scaled the attack to its useful size. The per-iteration profit from a single deposit-borrow-emergencyWithdraw cycle is bounded by the user's own capital. T9.002 converts the per-iteration profit into a single-transaction-window multi-million-dollar extraction. Defender monitoring focused only on the extraction Technique (T9.004) without the precondition (T9.002) misses half the structure.
• The arrest outcome is unusually fast and is partly attributable to the funding chain. French law enforcement's ability to arrest within seven days reflects a combination of (i) on-chain forensic firms providing attribution leads to off-chain identifiers within days of the attack, (ii) the suspects' funding chain not routing through high-effort obfuscation primitives (notably no Tornado Cash front-loaded laundering through privacy mixers prior to arrest), and (iii) French law-enforcement institutional capability with cybercrime cases. Worked examples should report arrest-as-recovery-channel as a factual outcome but should not let arrest soften the Technique's standing severity rating. The base rate for T9.004 incidents remains total or near-total loss; Platypus and Euler are the visible 2023 exceptions and the structural reasons for their exceptional outcomes are different (arrest in Platypus; conscience-return in Euler).
• Detection latency was operator-acceptable; recovery-by-arrest latency was a week. The on-chain pause was within an hour. The arrest was within seven days. The combination is the realistic upper-bound on what 2023 defender practice could achieve against a moderately-prepared attacker; below that threshold (e.g., Tornado Cash routing pre-event, attribution leads not converging on identifiable individuals) the recovery-by-arrest channel does not engage.

What this example tells contributors writing future Technique pages

• T9.004 (Access-Control / Logic Misconfiguration) needs explicit sub-classification for the rescue-path-function sub-pattern. Canonical T9.004 (Parity multisig 2017, Wormhole guardian-set 2022) is "the access-control modifier was missing or misconfigured on a primary entry point". The Platypus / Euler 2023 sub-pattern is "the access-control or solvency post-condition was deliberately bypassed on a rescue-path / donation-path / emergency entry point, and the bypass became weaponisable when combined with another protocol primitive (borrow position; pair-token relationship)". T9.004 contributors should distinguish primary-entry-point misconfiguration from rescue-path-function misconfiguration explicitly, and link Platypus and Euler as the v0.1 reference cases for the latter sub-pattern.
• The defender-side Mitigation for the rescue-path-function sub-pattern is post-condition uniformity. The audit-checklist framing: enumerate every state-mutating entry point; verify each one calls the same post-conditions as the corresponding primary entry point; treat post-condition uniformity as a pass criterion of the audit, not a default assumption. This Mitigation is shared with the Euler example and should be cross-referenced; if an OAK Mitigation entry exists for "post-condition uniformity in audit-checklist", Platypus and Euler should be the primary worked-example references on it.
• Attribution-by-arrest is a recovery channel that contributors should report when applicable, but should not generalise. The Platypus arrest is the OAK v0.1 reference case. The Inferno Drainer indictments (2024+) are an emerging precedent for a different sub-class. The Lazarus / OFAC sanctions-and-indictments process for state-actor attribution (Ronin, Atomic, others) is yet a different sub-class. Worked examples should report attribution-by-arrest as a per-incident outcome and should not imply a "typical" arrest-rate exists across T9.004 cases.
• Speed-of-attribution is partly a function of attacker operational discipline. Platypus attackers did not front-load laundering through Tornado Cash before drawing law-enforcement attention; the proceeds remained in attribution-trackable form long enough for forensic firms and French police to converge. Worked examples documenting cases with similar arrest outcomes should note the attacker's operational-discipline state explicitly, because the difference between "arrest in seven days" and "no arrest in three years" is substantially the attacker's pre-attack laundering preparation, not the defender's response capability alone.

Public references

• [peckshieldplatypus2023] — PeckShield post-incident analysis covering the emergencyWithdraw-function exploit chain.
• [halbornplatypus2023] — Halborn post-incident technical write-up of the Platypus exploit.
• [blocksecplatypus2023] — BlockSec forensic analysis of the Platypus attack including the flash-loan + emergency-withdrawal transaction-trace breakdown.
• [platypuspostmortem2023] — Platypus operations-team post-incident statement on the affected pools, the patch, and the negotiated restitution.
• [avalancheplatypus2023] — Avalanche team / Ava Labs technical statement on the incident.
• [platypusarrest2023] — French Police Judiciaire / public-prosecutor reporting on the arrest of the two suspects.
• [zhou2023sok] — academic taxonomy classifying logic-misconfiguration as a primary DeFi vulnerability class.

Citations

• [peckshieldplatypus2023] — PeckShield Platypus write-up.
• [halbornplatypus2023] — Halborn Platypus post-mortem.
• [blocksecplatypus2023] — BlockSec Platypus forensic.
• [platypuspostmortem2023] — Platypus operator post-mortem.
• [avalancheplatypus2023] — Avalanche / Ava Labs statement.
• [platypusarrest2023] — French law-enforcement arrest reporting.
• [zhou2023sok] — academic SoK classification.

Discussion

Platypus is OAK's reference case for two structurally distinct features held in the same incident: the rescue-path-function sub-pattern of T9.004, and the attribution-by-arrest recovery channel.

On the Technique side, Platypus and Euler (March 2023) are one month apart and share the same access-control-misconfiguration shape: an entry point intended for a non-attack use case omitted a post-condition that the primary entry points enforced, and the omission became weaponisable when combined with a borrow position (Platypus) or a paired debt-token (Euler). Treating these two as a sub-pattern rather than as independent incidents argues for OAK Mitigations to elevate "post-condition uniformity across all balance-affecting entry points, including rescue-path functions" to a category-level audit-checklist criterion. The 2023 cohort makes the point clearly; subsequent 2024–2025 incidents in the same shape (where they exist) should be cross-referenced into the same Mitigation entry as additional evidence rather than as separate findings.

On the recovery side, the law-enforcement-mediated outcome is OAK's first cleanly-documented arrest-as-recovery-channel case in the v0.1 corpus. The structural reasons are partly law-enforcement institutional capability (French Police Judiciaire de Montpellier with a cybercrime mandate, in coordination with on-chain forensic firms) and partly attacker operational discipline (the suspects did not front-load laundering through privacy mixers, leaving proceeds in attribution-trackable form). Worked examples should report this outcome as factually noteworthy without generalising it; the base-rate expectation for T9.004 incidents is total loss with no arrest, and the cases where arrest within a defender-relevant timeline is achievable are the exceptions, not the rule.

Two open questions remain for OAK v0.x. First, whether attribution-by-arrest warrants a dedicated Mitigation entry (in the sense of "law-enforcement-coordination-readiness as a defender-side capability") or whether it remains a per-incident outcome reporting field. The author's lean is the former for v0.x given the small but growing arrest cohort across 2023–2025. Second, whether the rescue-path-function sub-pattern of T9.004 warrants its own Technique ID or stays within the broad T9.004 construction. The author's lean is the latter for v0.1 with sub-class footnoting on the T9.004 page; if the cohort grows further, v0.x can revisit promotion.