SushiSwap First Attack
Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
The SushiSwap smart contract was exploited and the attacker took the trading fees which were generated over the brief period of the attack.
This is a global/international case not involving a specific country.[1][2][3][4][5][6][7][8][9][10][11][12][13][14][15]
About SushiSwap
"Sushi is a DeFi protocol that is completely community-driven, serving up delicious interest for your held crypto assets." "On Sushi, you can take advantage of passive-income providing DeFi tools such as liquidity providing, yield farming and staking. Furthermore, due to the decentralized nature of being an AMM (Automated Market Maker), Sushi has fewer hurdles to execute your cryptocurrency trades and all fees are paid to the users who provided liquidity, just as it should be!"
“… we have designed SushiSwap as the next step forward in the Uniswap protocol design. Taking Uniswap’s elegant core design, we’ve added community-oriented features that we believe help improve the design of the protocol, as well as provide further benefits to the actors involved.”
"This coin followed in the footsteps of other YFI clones with its low supply and yield farming. When it was listed on Uniswap on August 26, it started at a high of $128 before finding a bottom at $0.69. In less than a week of its launch, it had been listed on Binance peaking at $15.96. On CoinMarketCap, it hit rank 74."
"As reported Monday by CoinDesk’s Will Foxley, a pseudonymous developer who goes by “Chef Nomi” launched the SushiSwap protocol in late August, and it was quickly cast as a “vampire protocol” because its inherent design intended to siphon away liquidity from a competing trading platform, Uniswap."
"The project quickly attracted more than $1 billion of collateral with a technique known as “zombie mining,” The market value of the associated SUSHI tokens surged roughly 500-fold in a matter of days to more than $300 million."
"The anonymous developer 0xMaki took on the lead development of SushiSwap after founder Chef Nomi let greed get the better of him."
"On November 30, 2020, the Sushiswap project was discovered to have been attacked by malicious liquidity providers." "SushiSwap (SUSHI) community governor 0xMaki said that someone made a profit of $10,000 to $15,000 through the vulnerability of SushiSwap, adding that users' funds were safe."
"The liquidity mining project SushiSwap (SUSHI) community governor 0xMaki announced in the Discord group that the SushiSwap vulnerability has been fixed, and the lost funds (approximately US$10,000) will be compensated from the SUSHI asset library. Previously, SushiSwap was attacked by a liquidity provider. The attacker obtained between 10,000 and 15,000 US dollars in a transaction. However, after this operation was discovered by 0xMaki, 0xMaki sent a transaction to the attacker with a message saying "I found you and we are working hard to fix it. Contact me on Discord to get bug bounty-0xMaki"."
"Post-Mortem when I wake up, exploiter got around 10-15k so far from the 0.05% fees cut of Sushiswap." "We only lost 15k from this attacker, maybe there were other individuals doing the same, I’ll need to take a closer look - we spotted this one because he started to affect the whole bar."
"Nobody lost any funds since the money was pure profits destined to xSushi holders. We will be sending from our treasury 15k worth of Sushi divided pro-rata."
This is a global/international case not involving a specific country.
The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.
Include:
- Known history of when and how the service was started.
- What problems does the company or service claim to solve?
- What marketing materials were used by the firm or business?
- Audits performed, and excerpts that may have been included.
- Business registration documents shown (fake or legitimate).
- How were people recruited to participate?
- Public warnings and announcements prior to the event.
Don't Include:
- Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
- Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
| Date | Event | Description |
|---|---|---|
| November 30th, 2020 | Main Event | Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here. |
Technical Details
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?
Total Amount Lost
The total amount lost has been estimated at $15,000 USD.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?
Ultimate Outcome
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
General Prevention Policies
No user funds were lost in this attack.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ SlowMist Hacked - SlowMist Zone (May 18, 2021)
- ↑ First Mover: SushiSwap's Billion-Dollar 'Rug Pull' Is Thriller to Crypto Geeks - CoinDesk (May 24, 2021)
- ↑ Sushi price, chart, market cap and info | CoinGecko (May 24, 2021)
- ↑ The Rise Fall And Rise Of Sushiswap (May 24, 2021)
- ↑ SushiSwap Falls Victim To Attack Again, And Hacker Make A Big Fat Profit - TokenPost (Jul 18, 2021)
- ↑ Rekt - Badgers digg sushi (Jul 22, 2021)
- ↑ @0xMaki Twitter (Jul 23, 2021)
- ↑ Blockchain Hacks: 2020 | $15 billion lost, how can we mitigate hacks in 2021? | CertiK Foundation Blog (Jul 23, 2021)
- ↑ Rekt - SushiSwap Saved - 0xMaki Speaks Out (Jul 24, 2021)
- ↑ @Juan_Snow1 Twitter (Jul 24, 2021)
- ↑ Slowmist A Brief Analysis Of The Story Of The Sushi Swap Attack (Jul 24, 2021)
- ↑ DeFi Protocol SushiSwap Exploited For Up to $15,000 (Jul 24, 2021)
- ↑ @0xMaki Twitter (Jul 24, 2021)
- ↑ Token Price Rises and Reputation Mends, Midnight Exploit, Foiled Quickly by Sushiswap – Inside Crypto Today (Aug 10, 2021)