What happened
SushiSwap's MISO launchpad suffered a supply-chain attack when a contractor inserted a malicious change into its front end. The change substituted the beneficiary address for the Jay Pegs Auto Mart auction, diverting its proceeds.
The front-end release process allowed a contributor's malicious payout-address change to reach production. The reported mechanism was tampering with the auction's configuration through trusted code access.
How it happened
- A contractor with repository access submitted front-end code that substituted an attacker-controlled auction wallet.
- The altered payout configuration reached the live launchpad.
- Proceeds from the affected auction were directed to the substituted wallet.
Protocol details
Security review history
- PeckShield View report
Funds Recovery
Recovered
$3.0M
Net Loss
$0
Evidence
- report Report decrypt.co
- report Post-mortem rekt.news
- report JayPegs Automart - REKT rekt.news
- analysis DeFiLlama defillama.com
- analysis The SushiSwap MISO Insider Attack: How One Malicious Commit Diverted ~$3M From a Token Auction namefi.io
- analysis Cryptocurrency launchpad hit by $3 million supply chain attack arstechnica.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
