Ethereum

Arbitrum

Kevin

SushiSwap

April

<div class="playHtListenArea" style="display:none;margin: 0;">
		<div id="playht-audioplayer-element" data-play-article="https://crypto.ro/en/?p=20552" data-play-audio="https://media.play.ht/full_-NSfNiokHyPfuytCIUol.mp3?generation=1681133867123098&alt=media">
		</div>
	</div>
	<p>SushiSwap, a popular decentralized exchange, has experienced an exploit that led to a loss of over $3.3 million for at least one user, identified as 0xSifu on Twitter.</p>
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
<p lang="en" dir="ltr">It seems the <a href="https://twitter.com/SushiSwap?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@SushiSwap</a>  RouterProcessor2 contact has an approve-related bug, which leads to the loss of  &gt;$3.3M loss (about 1800 eth)  from <a href="https://twitter.com/0xSifu?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@0xSifu</a>. </p>
<p>If you have approved <a href="https://t.co/E1YvC6VZsP" rel="nofollow" target="_blank">https://t.co/E1YvC6VZsP</a>, please *REVOKE* ASAP!</p>
<p>One example hack tx: <a href="https://t.co/ldg0ww3hAN" rel="nofollow" target="_blank">https://t.co/ldg0ww3hAN</a> <a href="https://t.co/OauLbIgE0Q" rel="nofollow" target="_blank">pic.twitter.com/OauLbIgE0Q</a></p>
<p>&mdash; PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1644907207530774530?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 9, 2023</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<p>The exploit originates from an approve-related bug in the RouterProcessor2 contract, and both PeckShield and SushiSwap Head Chef Jared Grey have <a href="https://twitter.com/jaredgrey/status/1644925766696677376" rel="nofollow noopener" target="_blank">advised</a> users to revoke the contract across all chains.</p>
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
<p lang="en" dir="ltr">Additionally, from Peckshield, revoke all chains:<a href="https://t.co/GcCuY0OEb5" rel="nofollow" target="_blank">https://t.co/GcCuY0OEb5</a></p>
<p>&mdash; Jared Grey (@jaredgrey) <a href="https://twitter.com/jaredgrey/status/1644925766696677376?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">April 9, 2023</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<p>The root cause of the exploit, as identified by cybersecurity company <a href="https://twitter.com/AnciliaInc/status/1644929849218469888" rel="nofollow noopener" target="_blank">Ancilia</a>, Inc., is a flaw in the internal swap() function of the SushiSwap contract. When executed, this function calls the swapUniV3() function, which sets the &#8220;lastCalledPool&#8221; variable at storage slot 0x00. As a result, the permission check is bypassed in the subsequent swap3callback function.</p>
<p>This malfunction in the &#8220;approve&#8221; mechanism allows unauthorized parties to seize users&#8217; tokens without obtaining the necessary approval, a process informally referred to as &#8220;yoinking.&#8221;</p>
<p>According to Brad Kay, a research analyst at The Block, <a href="https://twitter.com/trust__90/status/1644895249058131971?s=20" rel="nofollow noopener" target="_blank">an attacker first</a> exploited the &#8220;yoink&#8221; function and stole 100 ETH and could have been a white hat hacker. Following this, <a href="https://twitter.com/trust__90/status/1644900643608358913?s=20" rel="nofollow noopener" target="_blank">another hacker</a> managed to steal around 1800 ETH using the same contract but with a function named &#8220;notyoink.&#8221;</p>
<p>Despite the significant loss, early reports suggest that only a limited number of SushiSwap users are at risk.</p>
<p>DeFi Llama&#8217;s @0xngmi <a href="https://twitter.com/0xngmi/status/1644927715923963904" rel="nofollow noopener" target="_blank">claims</a> that only those who swapped on SushiSwap within the last four days should be affected. The platform has published a <a href="https://gist.github.com/0xngmi/40c530a6dc219e62939ed911b5d5ac70" rel="nofollow noopener" target="_blank">list of contracts</a> across all chains that should be revoked and created a tool to <a href="https://0xngmi.github.io/sushi-test-hack/" rel="nofollow noopener" target="_blank">check</a> if any user addresses have been impacted.</p>
<p>Kevin Peng, another research analyst at The Block, estimates that 190 Ethereum addresses and over 2000 Layer 2 Arbitrum addresses have approved the problematic contract. Despite the exploit, the price of Sushi&#8217;s governance token experienced only a slight 0.6% decline within an hour of the news becoming public.</p>
<p>In the wake of the exploit, Grey, who is also seeking a $3 million legal defense fund from Sushi DAO after the platform was hit with a subpoena from the U.S. Securities and Exchange Commission, announced that SushiSwap is &#8220;working with security teams to mitigate the issue.&#8221;</p>
<p>Users are urged to follow the recommendations from PeckShield and Grey to protect their assets.</p>

SushiSwap suffers $3.3 million loss in exploit

crypto.ro global

Other articles published on Apr 10, 2023

Upgrade Your Digital Lifestyle with Fantastic Deals from Alpha Digital Shop on Binance Marketplace

Gemini Allegedly Borrowed $100M From Winklevoss Twins

BUIDL-Weekly: 03APR23 - 09APR23

Casa CTO Jameson Lopp Slams FTX’s Poor Security

Folagade Banks wanted to celebrate mothers with Mama Adeola, he became Instagram’s next star

PoS: What is Proof of Stake, and how does it work?

Join our free newsletter for daily crypto updates!