![](\"https:\/\/s3.cointelegraph.com\/uploads\/2023-02\/a7424c5a-232f-490b-b762-caa4e76fcbc4.png\")
<\/p>\nDecentralized finance (DeFi) firm Platypus is working on a compensation plan for user’s losses after a flash loan attack drained nearly $8.5 million from the protocol, affecting its stablecoin dollar-peg.\u00a0<\/p>\n
In a Tweet on Feb. 18, Platypus disclosed to be working on a plan to compensate the damages and asked users not to realize their losses in the protocol, saying this would make it harder for the company to manage the issue. Assets liquidation are also paused, said the protocol:<\/p>\n
According to the firm, different parties are currently involved in the funds’ recovery process, including legal enforcement officials. Further details about the next steps will be disclosed soon, noted Platypus.\u00a0<\/p>\n
Part of the funds are locked up in the Aave protocol. Platypus is exploring a method to potentially recover the funds, which would require the approval of a recovery proposal Aave\u2019s governance forum.<\/p>\n
Blockchain security firm CertiK first reported the flash loan attack on the platform through a tweet on Feb.16, along with the alleged attacker’s contract address. Nearly $8.5 million was moved from the protocol, and as a result, the Platypus USD stablecoin became de-pegged from the U.S. dollar, dropping to $0.33 at the time of writing.<\/p>\n
<\/p>\n
“The attacker used a flashloan to exploit a logic error in the USP solvency check mechanism in the contract holding the collateral,\u201d said the company. A potential suspect has been identified.\u00a0<\/p>\n
A technical post-mortem analysis conducted by auditing company Omniscia revealed the attack was made possible by incorrectly placed code after it was audited. Omniscia audited a version of the MasterPlatypusV1 contract from Nov. 21 to Dec. 5, 2021. The version, however, \u201ccontained no integration points with an external platypusTreasure system\u201d and therefore did not contain the misordered lines of code.<\/p>\n
The flash loan attack exploits the smart contract security of a platform to borrow large amounts of money without collateral. Once a cryptocurrency asset has been manipulated on one exchange, it is quickly sold on another, allowing the exploiter to profit from the price manipulation.<\/p>\n