Earlier Friday, a flaw in an important pricing mechanism caused Platypus Finance's USP stablecoin to lose more than 50% of its original link to the dollar, real estate developers said.

Platypus tweeted: "it is a pity to inform you that our own agreement has recently been hacked and the attacker took advantage of a flaw in our USP solvency check mechanism." "they used lightning loans to take advantage of a logic error in the USP solvency check mechanism in mortgage-owning contracts."

The solvency check mechanism deceived Platypus smart contracts and made it feel improperly that USP had been applied in all aspects as expected. This is the beginning of exploiting system vulnerabilities.

Like many decentralized stable currency exchanges, platypus finance depends on smart contracts rather than retailers to swap stable currencies and high slip rates cheaply. This product is so popular that as of Thursday, the value of locked tokens exceeded $50 million.

In a foreign attack late Thursday, exploiters used flash memory chips to borrow money to steal more than $8.5 million from Platypus, WJB reported.

Things to remember.

USP is a thickener. Its price is jeopardized by how many are available in an area called Main Pool. When more people convert other types of digital currencies to USP, the price may be slightly lower.

When there is less USP in the main pool, prices also pick up. To stabilize the price at $1, charge people who use USP, and the cost increases as there is more USP in the main pool. This encourages people to borrow more money or pay off debts.

Flash chip borrowing is a fragmented financial industry (Defi) special system that allows users to raise a lot of assets with very little collateral, as long as the loan is repaid in the same transaction.

Lightning loans are not bad debt losses in themselves: traders generally use lightning loans, but poor participants may use lightning loans to deceive smart contracts, control the price of the liquidity pool, and take over the property of the pool.

How the Marauders stole millions of dollars

Blockchain data show that the attacker borrowed more than $44 million from the borrowing platform AAVE to borrow money for flash chips, used the loan to give liquidity to the trading pool in Platypus, and tricked the smart contract into launching a $44 million Platypus LP token, called LP-USDC, in return.

All this happened in the course of several deals. The LP tokens were then deposited into the platypus's chip agreement, which launched 11000 PTP tokens as a bet reward.

An attacker can also use $44 million worth of LP tokens as collateral to get 41 million USP tokens-since Platypus allows users to raise funds against their LP trading positions, USP smooth tokens.

At this point, the attacker activated the "EmergencyRetriding" role in a Platypus smart contract to obtain the $44 million initially allocated to the Platypus working capital pool. The incorrect solvency check in the code does not deter such a move-allowing an attacker to obtain tokens and repay AAVE flash chip loans.

However, the system does not revoke 41 million publicly issued USP tokens-instead, it allows attackers to swap them for the $8.5 million liquidity previously available on Platypus.

As of Friday, Platypus indicated that it had contacted the looters to negotiate a reward mission in exchange for a refund.

It added that it had already contacted the security party and the exchange of login passwords. We are now working with... These aspects of the collaboration include Binance, Tether and Circle to freeze and clean the funds of network hackers and prevent further damage. At this stage, the United Nations Food and Agriculture Organization has been frozen.

"We are also exploring plans to provide compensation and repayment to affected investors," the real estate developer wrote on Twitter. "

In writing, USP dropped again, trading at 47 cents as of Friday morning.