# Platypus: LP price manipulation via cash/liability imbalance

Platypus pool's cash/liability accounting was manipulated via flash-loan-funded deposits and swaps, inflating LP token value to drain ~$2M.

- Payout: Real-world hack
- Severity: high
- Program: Platypus
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/Platypus03_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231012-platypus03
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:flash-loan vuln:oracle-manipulation

**Target:** Platypus AMM liquidity pool on Avalanche
**Root cause:** The pool's LP token price is derived from cash and liabilities; large deposits and swaps can skew these values, allowing an attacker to mint LP tokens cheaply and withdraw at an inflated price.
**Steps:**
1. Flash loan 1,054,969 WAVAX and 950,996 sAVAX from Aave V3.
2. Approve Platypus pool to spend WAVAX and sAVAX.
3. Deposit all WAVAX and 1/3 of sAVAX into Platypus pool to mint LP_AVAX and LP_sAVAX.
4. Swap 600,000 sAVAX for WAVAX to manipulate cash and liabilities of the LP_AVAX pool.
5. Withdraw 1,020,000 WAVAX worth of LP_AVAX to inflate WAVAX price in the pool.
6. Swap 1,200,000 WAVAX for sAVAX to earn more sAVAX.
7. Withdraw remaining LP_AVAX balance.
8. Swap 600,000 sAVAX for WAVAX.
9. Withdraw remaining LP_sAVAX balance.
10. Repay flash loan and keep profit.
**Exploitation:** Attacker used Aave V3 flash loans to obtain large amounts of WAVAX and sAVAX, then deposited and swapped within the Platypus pool to manipulate the cash and liability ratios, inflating the value of LP tokens. By withdrawing LP tokens at the inflated price, the attacker extracted more tokens than deposited, netting ~$2M.
**Insight:** AMMs that price LP tokens based on cash and liabilities are vulnerable to manipulation via large deposits and swaps; check if LP token minting/burning uses spot reserves that can be skewed by flash loans.