Decentralized finance (DeFi) protocol Sushi suffered exploitation of its smart contract early on Sunday, according to a tweet from PeckShield. The attack was reportedly carried out through the use of a flash loan, resulting in a loss of approximately $3.3 million worth of cryptocurrency. The developers have advised users to avoid interacting with the platform while they investigate the incident. This is the latest in a string of security breaches that have plagued the DeFi space, highlighting the need for improved security measures in the sector.
It seems the @SushiSwap RouterProcessor2 contact has an approve-related bug, which leads to the loss of >$3.3M loss (about 1800 eth) from @0xSifu.
If you have approved https://t.co/E1YvC6VZsP, please *REVOKE* ASAP!
One example hack tx: https://t.co/ldg0ww3hAN pic.twitter.com/OauLbIgE0Q
— PeckShield Inc. (@peckshield) April 9, 2023
Hackers Set Sights on ‘RouterProcessor2’ Contract in Latest Exploit
A Security company PeckShield noticed the $3.3M loss on Sunday morning in Asia, and Sushi engineers subsequently verified that the RouterProcessor2 interface for SushiSwap appears to have a problem connected to approval that causes it.
A RouterProcessor2 contract of SushiSwap, which is used for routing trade on their exchange, has just been found to have an exploit. This error might have cost the company $3.3 million if it had gone uncorrected. Fortunately, quick action was made to stop losses from happening and to find a solution as quickly as feasible. Lead developer for SushiSwap Jared Gray encouraged users to remove access for each contract on the platform when the contract risk was found as a safety measure. To fix the problem, both sides are collaborating with security teams, he continued.
Trending Now: Binance.US Unable to Find Bank Collaborators in the US
According to many tweets from several security companies, the $3.3 million appears to have come from a single person, @0xsifu, a well-known trader in the Crypto Twitter community. Moreover, The issue only appeared to affect customers who had accepted Sushiswap transactions in the previous four days, according to DefiLlama creator @0xngmi on Sunday.
As a security precaution, Sushi chief developer Jared Grey encouraged users to cancel rights for every contract on the platform while the company collaborated with security organizations to address the problem. Developer of DefiLlama @0xngmi noted on Sunday that it appeared that the issue only affected customers who have accepted Sushiswap agreements in the previous four days.
Twitter User Trust Admits to White-Hat Hack on 0xsifu for 100 $ETH
A Twitter user by the name of Trust has admitted to performing a white-hat hack on 0xsifu in exchange for 100 $ETH and has expressed their intention to return the funds. However, Trust revealed that the attack had already been replicated by MEV bots, as they had already deployed contracts and copied the attack before Trust could secure everything. Moreover, Trust expressed disbelief at the situation, calling it “insane”.