SushiSwap

A SushiSwap exploit has resulted in a single user's account being drained of $3.3 million worth of ETH at a time when the exchange is facing scrutiny from the US Securities &amp; Exchange Commission (SEC).
On Saturday, crypto personality Sifu was reportedly targeted by an "approved-related bug" in SushiSwap's RouterProcessor2 contract, in which 1,800 ETH was stolen. The 'RouterProcessor2' contract is used to conduct trade routing on the SushiSwap exchange.
<blockquote>
 It seems the <a href="https://twitter.com/SushiSwap?ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">@SushiSwap</a> RouterProcessor2 contact has an approve-related bug, which leads to the loss of &gt;$3.3M loss (about 1800 eth) from <a href="https://twitter.com/0xSifu?ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">@0xSifu</a>. If you have approved <a href="https://t.co/E1YvC6VZsP?ref=blockhead.co" rel="noopener noreferrer nofollow">https://t.co/E1YvC6VZsP</a>, please *REVOKE* ASAP! One example hack tx: <a href="https://t.co/ldg0ww3hAN?ref=blockhead.co" rel="noopener noreferrer nofollow">https://t.co/ldg0ww3hAN</a> <a href="https://t.co/OauLbIgE0Q?ref=blockhead.co" rel="noopener noreferrer nofollow">pic.twitter.com/OauLbIgE0Q</a>— PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1644907207530774530?ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">April 9, 2023</a>
</blockquote> 
The exploit came from the failure to validate access permissions during the swap transaction, and is reportedly also found on Polygon.
<blockquote>
 1/ Our system detected ongoing hacks on 0x044b75f554b886a065b9567891e45c79542d7357 <a href="https://twitter.com/hashtag/SushiSwap?src=hash&amp;ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">#SushiSwap</a>. Anyone who has given permission to that addr are potential victims, please check and revoke ASAP. <a href="https://twitter.com/hashtag/web3?src=hash&amp;ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">#web3</a> <a href="https://twitter.com/hashtag/hack?src=hash&amp;ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">#hack</a> <a href="https://t.co/3n0FcbZ3WP?ref=blockhead.co" rel="noopener noreferrer nofollow">pic.twitter.com/3n0FcbZ3WP</a>— Ancilia, Inc. (@AnciliaInc) <a href="https://twitter.com/AnciliaInc/status/1644925421006520320?ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">April 9, 2023</a>
</blockquote> 
<a href="https://www.blockhead.co/2023/03/23/sushiswap-served-with-sec-subpoena/blockhead.co/tag/sushiswap" rel="noopener noreferrer nofollow">SushiSwap</a> CEO Jared Grey confirmed the bug an hour after it had been reported, stating, "Sushi's RouteProcessor2 contract has an approval bug; please revoke approval ASAP. We're working with security teams to mitigate the issue."
On Sunday, SushiSwap CTO Matthew Lille said the team is "all hands on deck working through identifying all addresses that have been affected by the RouterProcessor2 exploit. Several rescues have been initiated, and we are continuing to monitor / rescue funds as they become available."
Lille reassured that "there is no risk at this time with using Sushi Protocol, and the UI. All exposure to RouterProcessor2 has been removed from the front end, and all LPing / current swap activity is safe to do."
<blockquote>
 We’re currently all hands on deck working through identifying all addresses that have been affected by the RouterProcessor2 exploit. Several rescues have been initiated, and we are continuing to monitor / rescue funds as they become available.— I'm Software 🦇🔊 (@MatthewLilley) <a href="https://twitter.com/MatthewLilley/status/1645116270726053890?ref_src=twsrc%5Etfw&amp;ref=blockhead.co" rel="noopener noreferrer nofollow">April 9, 2023</a>
</blockquote> 
<h2 id="header-0">Sushi Subpoena</h2>
In late March, SushiSwap was subpoenaed by the SEC. Grey said at the time that the firm is cooperating with the SEC, which is demanding the production of documents related to a case under investigation.
Read more: <a href="https://www.blockhead.co/2023/03/23/sushiswap-served-with-sec-subpoena/" rel="noopener noreferrer nofollow">SushiSwap Served With SEC Subpoena</a>
SushiSwap said it plans to establish a legal defense fund to "cover legal costs for core contributors and multisig participants."
In the latest update, Grey released an official statement on SushiSwap's <a href="https://forum.sushi.com/t/head-chef-jared-greys-official-sec-statement-faq/11918?ref=blockhead.co" rel="noopener noreferrer nofollow">blog</a>. "I am very limited in the amount and type of information that is appropriate to share publicly," he stated.
"Nevertheless, to give the community more information, my counsel and I have prepared a non-privileged “FAQ” below for the public to answer the most frequently asked questions I have received."
17 questions were listed in the Q&amp;A, through which SushiSwap clarified that Grey is still is "cooperating with the SEC’s subpoena" and that his employer, Internet Three Software Company, "is also responding to the subpoena voluntarily to cooperate with the SEC’s investigation."
Read more: <a href="https://www.blockhead.co/2023/04/05/do-kwons-lawyers-slam-sec-claim-terraform-is-singaporean/" rel="noopener noreferrer nofollow">Do Kwon's Lawyers Slam SEC, Claim Terraform is Singaporean</a>
SushiSwap also reassured that the investigation "does not mean that the SEC has concluded that Jared, Internet Three Software Company, or Sushi has violated any law."
"To the best of our knowledge, the SEC has not (as of this writing) made any conclusions that anyone affiliated with Sushi has violated United States federal securities laws," it added.
To the final question, "Do you think that Sushi has done anything wrong?" The exchange simply responded: "Not to our knowledge."
The world of Web3 can be quite a whirlwind. Whether it’s crypto news in Singapore, South East Asia or even across the globe, we understand how busy the industry is keeping you, so we kindly send out three newsletters each week:
<ul>
 <li><a href="https://blockhead.co/tag/blockbeat?ref=blockhead" rel="noopener noreferrer nofollow">BlockBeat</a> for a wrap-up of the week’s digital assets news</li>
 <li><a href="https://blockhead.co/tag/blockhead-brief?ref=blockhead" rel="noopener noreferrer nofollow">Blockhead Brief</a> for weekend happenings as well as what to look forward to in the week ahead</li>
 <li><a href="https://www.blockhead.co/tag/business-bulletin/" rel="noopener noreferrer nofollow">Business Bulletin</a> for macroeconomic updates and industry developments.</li>
</ul>
To avoid FOMO and access member-only features, click <a href="https://www.blockhead.co/#/portal/" rel="noopener noreferrer nofollow">here</a> to subscribe for FREE.

SushiSwap Loses $3.3M in Exploit, Releases SEC Response

Table of Contents

Blockhead

Other articles published on Apr 10, 2023

BTC/USDT Chart Analysis: Potential Breakout at $28900 Resistance Level

Liquidity Fragmentation: Special Purpose Vehicles (SPVs) in Focus

Coinbase Head of Exchange Announces Departure, Says He Has “A Lot to Build”

Regulatory Restrictions Force dYdX to Wind Down in Canada

More Than Half of All Circulating Bitcoin Is Dormant

[Frutti Dino Stories] Global Beta Launch

Join our free newsletter for daily crypto updates!