Sushiswap Smart Contract Bug Results in Over $3M in Losses; Head Chef Says Hundreds of ETH Recovered
According to several reports, a bug introduced to the decentralized exchange (dex) protocol Sushiswap’s smart contract has resulted in more than $3 million in losses. The blockchain and smart contract security firm Peckshield explained the exploited contract was “deployed in multiple blockchains.” Dex Platform Sushiswap Suffers From Smart Contract Exploit
Over the weekend, the dex platform Sushiswap saw its RouteProcess02 contract exploited and then distributed across various blockchain networks. Blockchain security firm Certik published an alert after discovering the exploit. The company Peckshield also updated the crypto community via Twitter, noting that Sushiswap’s “RouterProcessor2 contract has an approve-related bug.” It has also been reported that the victim was a well-known crypto advocate called Sifu, who reportedly lost 1,800 ether.
Sifu may not have been the only victim, as Certik’s alert mentions that a few USDC users may have been affected. “We have detected suspicious activity on [0x15d], which is a malicious router,” Certik tweeted. “Revoke permissions if you have approved this router to spend your tokens. Stay safe. Multiple users who had approved the malicious contract have seen their USDC being transferred to [0x29e]. The wallet has taken about $20,000 in the last two hours,” the company added.
A developer known as 0xngmi has detailed that the exploit should only be problematic for those who used Sushiswap during the last four days. “Only users impacted by Sushiswap hack should be those that swapped on Sushiswap in the last 4 days. If you did so, revert approvals ASAP or move your funds in the affected wallet to a new wallet,” 0xngmi tweeted. Sushiswap’s head chef Jared Grey also confirmed the exploit and later detailed that “recovery efforts were underway.”
“We’ve secured a large portion of affected funds in a whitehat security process. If you have performed a whitehat recovery please contact security@sushi.com for next steps,” Grey said at 9:42 a.m. Eastern Time on April 9. “We’ve confirmed recovery of more than 300 ETH from Coffeebabe of Sifu’s stolen funds. We’re in contact with Lido’s team regarding 700 more ETH,” Grey added. Sushiswap’s CTO, Matthew Lilley, followed up later in the day and said that there are currently no issues with using the Sushiswap dex platform.
“There is no risk at this time with using Sushi Protocol, and the UI. All exposure to RouterProcessor2 has been removed from the front end, and all LPing / current swap activity is safe to do,” the Sushiswap CTO explained. “We do ask that all users double-check their approvals, and if an address within this list below has an allowance for any of your tokens to please unapprove as soon as you can,” Lilley added. Just recently, Grey told the community that the Sushiswap team received a subpoena from the U.S. Securities and Exchange Commission (SEC). Tags in this story 2023 defi hack, Advocate, approval, Blockchain, certik, Coffeebabe, Crypto, CTO, decentralized exchange, decentralized finance, DeFi, Defi Hack, DEX, ether, Exploit, Funds, Hacker, Head Chef, Jared Grey, Lido, LPing, Matthew Lilley, Peckshield, recovery, RouteProcess02, RouterProcessor2, SEC, Security, Sifu, Smart Contract, Subpoena, Sushi Protocol, Sushiswap, swap, UI, USDC, Vulnerability, vulnerability disclosure, whitehat
What do you think can be done to prevent smart contract bugs like this in the future? Share your thoughts in the comments below. Jamie Redman
Jamie Redman is the News Lead at Bitcoin.com News and a financial tech journalist living in Florida. Redman has been an active member of the cryptocurrency community since 2011. He has a passion for Bitcoin, open-source code, and decentralized applications. Since September 2015, Redman has written more than 6,000 articles for Bitcoin.com News about the disruptive protocols emerging today. US Treasury Report Warns of Defi"s Threat to National Security, Authors Conclude Fiat Is Used in Illicit Finance More Than Crypto DEFI | 4 days ago Pancakeswap Launches Version 3 of Protocol on BNB and Ethereum Blockchains DEFI | 7 days ago
Image Credits: Shutterstock, Pixabay, Wiki Commons Previous articleUS Economy at Risk of Crash Landing, Allianz Warns Next articleDollar to Play Lesser Role Due to Its Weaponization, Digital Currencies, Economist Jeffrey Sachs Says Disclaimer: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article. Read disclaimerShow comments More Popular NewsIn Case You Missed ItRipple CEO: SEC Lawsuit Over XRP "Has Gone Exceedingly Well"
The CEO of Ripple Labs says that the lawsuit brought by the U.S. Securities and Exchange Commission (SEC) against him and his company over XRP "has gone exceedingly well." He stressed: "This case is important, not just for Ripple, it’s ... read more.Draft Law Regulating Aspects of Crypto Taxation Submitted to Russian Parliament NFT Sales Volume Saw a Small Uptick This Week — Moonbirds, Mutant Apes Take Top Sales Privacy-Centric Monero Plans for July Hard Fork, Plans Include Ring Signature, Bulletproof Upgrade Survey: Adoption in Argentina Grows, With 12 out of 100 Adults Having Invested in Crypto