Incident Overview
SushiSwap experienced an approval related bug, which led to a loss of nearly 3,505,000 $USD from the user's wallet.
SushiSwap, a cross-chain decentralized exchange, experienced an exploit due to a bug related to approvals of its RouterProcessor2 contract. The vulnerability led to losses of nearly 3,505,000 $USD from the user named sifuvision.eth .
The hack was caused by a smart contract bug on SushiSwap's RouterProcessor2 contract, which allowed attackers to pass security checks and withdrew affected user's approved tokens. The incident affected users who swapped on the platform within four days before detection.
After detecting the exploit, Jared Grey, head developer at SushiSwap urged users to revoke permissions for all contracts on their platform while they worked with security teams to mitigate issues.
An interesting part of the story is, the initial hack of 100 $ETH was performed by white hat, that tweeted about the vulnerability and returned 90 $ETH back. But several EOA addresses used the same vulnerability to exploit the same user for bigger amount of 1,790 $ETH.
Jared Grey, announced the returning of 300 $ETH with the help of the community, and is working on to return 700 $ETH from Lido Vault.
Attacker addresses:
https://etherscan.io/address/0xfde0d157…81455a
https://etherscan.io/address/0xc0ffeeba…f29671
Malicious Transaction examples:
https://etherscan.io/tx/0x04b166e7…02bc32
https://etherscan.io/tx/0xea3480f1…5c45e8
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to SushiSwap, these are the critical security checks that could have prevented this incident (April 2023).
- Verify all logic paths related to Missing Input Validation / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$723K
Net Loss
2783724
Security Audit History
- Audit Report 1 Report
Proof-of-Concept Exploits
On-Chain Evidence & References
- Twitter/X Alert https://twitter.com/peckshield/status/1644907207530774530
- Twitter/X Alert https://twitter.com/SlowMist_Team/status/1644936375924584449
- Twitter/X Alert https://twitter.com/AnciliaInc/status/1644925421006520320
Sources & References
Learn to Prevent the Next SushiSwap
The SushiSwap hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.