According to an autopsy report by Omniscia, a certified public accountant at Platypus, the $8 million Platypus flash chip loan attack is likely because of the incorrect coding order. The financial audit company claimed that there was no problem code in the version they saw.

The Platypus MasterPlatypusV4 contract "contains a fatal misunderstanding in the EmergencyWithDrag system", which allows it to "conduct a solvency check before upgrading the LP dynamic password related to share trading positions," the source said.

The report notes that the code for the EmergencyWithDraw function formula has all the necessary elements to avoid attacks, but as Omniscia states, these elements are only written in the incorrect order:

"reordering according to MasterPlatypusV4::EmergencyWithDraw sentences and implementing a solvency check after the customer amount content is set to 0 can prevent the problem and thus prevent the attack."

Omnisia recognized that these persons had financially audited a version of the MasterPlatypusV4 contract during the period from 21 November to 5 December 2021. However, this version "does not contain comprehensive integration points with the treasure chest of external service platforms" and therefore does not contain disordered lines of code. Omniscia's position represents that developers must initiate a new version of the contract at some point after conducting a financial audit.

Related to:Raydium publishes small details of network hacker attacks and suggests paying compensation to the victims.

The CPA claims that the execution of the contract at the detailed address of 0xc007f27b757a782c833c568f5851ae1dfe0e6ec7 in the landslide C chain was utilized. Lines 582-584 of this contract seem to enable Platypus Zhibao contract book with the name "isSolvent." While lines 599-601 seem to set the user amount, factor, and rewardDebt to zero. However, after the "isSolent" function formula is enabled, this value is set to zero.

The Platypus elite team confirmed on February 16th that the attackers took advantage of "a flaw in the USP solvency check mechanism", but the team initially gave no more details. The new report from the certified public accountant further reveals how attackers are likely to attack.

On February 16th, the platypus elite team announced that the siege had taken place. It tries to contact cyber hackers and retrieve assets in exchange for a reward for system vulnerabilities. Attackers use flash chip loans to carry out system vulnerability attacks, similar to those commonly used to unfreeze financial system vulnerabilities on December 25, 2022.