<p>I'm approaching the tool so I would not consider myself a Plutarch expert</p>
<p>however to my understanding, Plutarch is designed to be compatible with the entire PlutusTx API</p>
<p>since the real code of smart contracts (that goes on-chain) is Untyped  Plutus Core (UPLC) and both PlutusTx and Plutarch do fully cover UPLC Abstract Syntax Tree Plutarch should be equivalent in terms of expressiveness to PlutusTx.</p>
<p>regarding security what Plutarch does more than PlutusTx is just being strictly-evaluated so the underlying logic should not be different, only the way to get to the final result changes</p>
<p>MinSwap did used both PlutusTx and Plutarch for the smart contracts, and <a href="https://github.com/CatspersCoffee/contracts/blob/main/dex/src/Minswap/ConstantProductPoolNFT/OnChain.hs#L60" rel="nofollow noreferrer">the incriminated code (<code>validateMintNFT</code>)</a> was written using PlutusTx</p>
<p>in particular the function <code>isUnity</code> was allowing to duplicate (not so much) Non Fungible Tokens</p>
<p>tweag (the company that audited the smart-contracts prior releasing them) has an entire <a href="https://www.tweag.io/blog/2022-03-25-minswap-lp-vulnerability/" rel="nofollow noreferrer">dedicated article</a></p>

CC BY-SA 4.0
2022-06-20T15:31:38.687Z
2022-06-20T15:31:38.687Z
Michele Nuzzi
<p>The Plutarch eDSL tries to control how plutus core is generated to create a smaller and thus a more efficient validator script <a href="https://github.com/Plutonomicon/plutarch" rel="nofollow noreferrer">(their GitHub)</a>.</p>
<p>I am not an in depth user of this tool. Does its approach reduce the expressiveness of the validator script? Moreover, does it reduce the intention of the script and thus lead to a loss of security?</p>
<p>This question is especially relevant due to recent MinSwap exploit (they use Plutarch).</p>

<plutus><smart-contract><plutustx><security>
How expressive & secure is the Plutarch eDSL?
# How expressive & secure is the Plutarch eDSL?

(Asked by: username_0 on 2022-03-25)

The Plutarch eDSL tries to control how plutus core is generated to create a smaller and thus a more efficient validator script [(their GitHub)](https://github.com/Plutonomicon/plutarch).

I am not an in depth user of this tool. Does its approach reduce the expressiveness of the validator script? Moreover, does it reduce the intention of the script and thus lead to a loss of security?

This question is especially relevant due to recent MinSwap exploit (they use Plutarch).

**Tags:** plutus, smart-contract, plutustx, security

---

## 1 answers

### Answer by username_1 on 2022-06-20. Score: 1

I'm approaching the tool so I would not consider myself a Plutarch expert

however to my understanding, Plutarch is designed to be compatible with the entire PlutusTx API

since the real code of smart contracts (that goes on-chain) is Untyped Plutus Core (UPLC) and both PlutusTx and Plutarch do fully cover UPLC Abstract Syntax Tree Plutarch should be equivalent in terms of expressiveness to PlutusTx.

regarding security what Plutarch does more than PlutusTx is just being strictly-evaluated so the underlying logic should not be different, only the way to get to the final result changes

MinSwap did used both PlutusTx and Plutarch for the smart contracts, and [the incriminated code (`validateMintNFT`)](https://github.com/CatspersCoffee/contracts/blob/main/dex/src/Minswap/ConstantProductPoolNFT/OnChain.hs#L60) was written using PlutusTx

in particular the function `isUnity` was allowing to duplicate (not so much) Non Fungible Tokens

tweag (the company that audited the smart-contracts prior releasing them) has an entire [dedicated article](https://www.tweag.io/blog/2022-03-25-minswap-lp-vulnerability/)


---

