What happened
On December 30, 2021, an attacker used flash-loaned WETH and self-made tokens to drain SashimiSwap, an AMM DEX deployed on several chains. CertiK analyzed the attack on Ethereum and SolidityScan a transaction on BSC; the previously published record also lists an attack transaction on HECO.
SashimiSwap differed from Uniswap in two ways that mattered. Its router held funds in a shared vault and could withdraw from it when the router's own balance ran short. And its swapExactTokensForETHSupportingFeeOnTransferTokens() computed the WETH output from the balance of the first pair in the swap path, not the last. By building a multi-hop path through pairs of worthless tokens, the attacker got the router to pay out WETH based on the wrong pair. In SolidityScan's walkthrough, about 151 WETH was deducted where 1 WETH should have been. The router then topped itself up from the vault. The attacker swapped the extra WETH for real assets, repaid the flash loan and sent proceeds to Tornado Cash.
The totals differ by source. CertiK puts the loss at about $210,000 (6,261 UNI, 4,466,096 SASHIMI and 63,762 USDT). The previously published record lists 80 ETH and 10,000 DAI on Ethereum plus 45,000 USDT on HECO.
Attacker: 0xa8189407a37001260975b9da61a81c3bd9f55908
Attack transactions (the HECO one is from the previously published record and was not independently verified):
- Ethereum:
0x713c2ce2cb424eb746083c25b7e48c368bb64f587c2d77b5c474a307a79bf069 - BSC:
0xdf719d2535be32e302c1670a7453bdf648101a43b412e44d9e7e3e3754cc3387 - HECO:
0xecde0b3821a8d250810db91d7ef82acced1eaf28324807bdbdfd755537366438
How it happened
- The attacker flash-borrowed about 400 WETH from a DODO DVM pool.
- They deployed three worthless tokens (A, B, C) and created SashimiSwap pairs among them and against WETH, seeding the pairs with liquidity.
- They called
swapExactTokensForETHSupportingFeeOnTransferTokens()with a multi-hop path through the fake-token pairs. The router computed the WETH to pay out from the first pair's WETH balance, so it paid far more WETH than the input justified (SolidityScan counts about 151 WETH where 1 was due). - When the router's own balance could not cover the payout, it withdrew the shortfall from the shared vault, which held other users' liquidity.
- The attacker swapped WETH for real assets such as UNI, repeated the cycle, removed liquidity, repaid the flash loan, and sent the proceeds to Tornado Cash.
Protocol details
Evidence
- report Report sashimisashimi5.medium.com
- report @BlockSecTeam incident report twitter.com
- transaction Etherscan transaction 0x713c2ce2...f069 etherscan.io
- transaction bscscan.com transaction 0xdf71…3387 bscscan.com
- transaction hecoinfo.com transaction 0xecde…6438 hecoinfo.com
- address etherscan.io address 0xa818…5908 etherscan.io
- analysis DeFiLlama defillama.com
- analysis Sashimi Swap Exploit certik.com
- analysis Sashimi Swap Hack Analysis - Improper Swap & Router Design blog.solidityscan.com
- analysis bloxy.info page 0xa818…5908 bloxy.info
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
