# \[ARC\] Recover exploited assets stuck on Aave V3 for Platypus Finance on Avalanche **URL:** \ **Category:** Governance\ **Created:** [February 21, 2023, 10:36am UTC](https://governance.aave.com/t/arc-recover-exploited-assets-stuck-on-aave-v3-for-platypus-finance-on-avalanche/12000 "2023-02-21T10:36:05Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![Anatinus\_Platypus](https://avatars.discourse-cdn.com/v4/letter/a/71c47a/32.png) [@Anatinus\_Platypus](https://governance.aave.com/u/Anatinus_Platypus)\ **Post date:** [February 21, 2023, 10:36am UTC](https://governance.aave.com/t/arc-recover-exploited-assets-stuck-on-aave-v3-for-platypus-finance-on-avalanche/12000/1 "2023-02-21T10:36:05Z")
# ARC rationale On February 16, 2023 at approximately 7 PM UTC, Platypus Finance, a stableswap protocol on Avalanche, was exploited through a flaw in its USP stablecoin solvency check mechanism and resulted in 9 million in stablecoins stolen from the users and pool depositors of the protocol in a series of three attacks. In one of the three attacks, the attacker mistakenly implemented a logic in the exploit contract such that around $381k worth of stablecoins were directly transferred to Aave V3’s Pool contract deployed on Avalanche. Currently, the Pool contract has implemented a `rescueTokens()` function, which will allow the function caller, who must be granted the `Pool_Admin` role in Aave V3’s access control system, to transfer any stuck ERC-20 tokens to designated addresses, including the stablecoins transferred to the Pool contract by the attacker. This ARC is inspired by the previous discussions between Aave contributors, the Platypus team & its community, and various blockchain security organizations and individuals on the possible recovery of the funds sent to the Pool contract. This ARC’s objective is to gather community sentiment and consensus to form and publish a formal AIP proposal vote for a community vote to approve the recovery actions on the stolen user assets stuck in the Pool contract. To be discussed and decided: - The technical implementation of the recovery actions: Platypus team and the Aave core contributors will work on a recovery contract to call the `rescueTokens()` function of the Pool contract and transfer the exploited funds stuck in the Pool contract to Platypus team’s multi-sig, subject to governance voting which will grant the recovery contract the `Pool_Admin` role access. The contract will follow Aave’s `StewardBase` pattern, which specifies the logic for handling Aave’s Pool access control logic and automatically renounce the admin roles once the recovery actions are fully executed. # ARC content in short - Platypus/ Aave team to deploy a recovery contract with the sole goal to recover exploited assets stuck in Aave V3’s Pool contract. - Aave community to vote on granting the recovery contract’s `Pool_Admin` permission to execute the recovery logic. - Guardians to execute the permission grant should the voting is passed. - Platypus/ Aave team to execute the recovery contract. # Relevant Links - Attacker’s transfer transaction of the exploited tokens to Pool contract address: [SnowTrace](https://snowtrace.io/tx/0x919266aa66d7c9a6af02dead5effc1cc68ab7b87890b52e5fc1e20a7041aa84d) - Aave V3’s Pool address on Avalanche: [SnowTrace](https://snowtrace.io/address/0x794a61358d6845594f94dc1db02a252b5b4814ad) - Platypus Finance’s announcement of the exploit: [https://twitter.com/Platypusdefi/status/1626396538611310592](https://twitter.com/Platypusdefi/status/1626396538611310592) --- _[View the full topic](https://governance.aave.com/t/arc-recover-exploited-assets-stuck-on-aave-v3-for-platypus-finance-on-avalanche/12000)._