A potential attack on the SushiSwap DeFi farming protocol has been thwarted by vigilant developers who managed to patch the vulnerability before any real damage could be done.
Developer and SushiSwap ‘chef’ who goes by the Twitter handle ‘0xMaki’ reported the findings after the exploiter contacted him revealing details of the smart contract bug.
An apparent smart contract flaw allowed a user to start claiming liquidity pool tokens from the Sushibar. A number of spurious transactions were noticed though the amounts were relatively small.
0xMaki confirmed that the exploiter got around $10,000-$15,000 from the 0.05% fee cut of SushiSwap before the vulnerability was patched.
Breaking it Down
The Rekt DeFi blog broke down the incident saying that:
“Late last night, an anonymous actor poked a hole in their smart contracts and stole ~$15k before the team of Sushi chefs chased them out of the kitchen.”
A handful of developers aided in the fix which took 3-4 hours and the damage was limited since the Sushibar only accrues $20-$30k per day. The developers that were up at the time of the exploit managed to reproduce it.
0xMaki added that it was an exploit, not a hack, and the exploiter deserved the funds for finding the vulnerability.
“I’m impressed totally! There is no way I’m embarrassed! It’s fascinating to see all these hacks / exploits happening, even with robust audits there’s always some sort of new scenario emerging that we wouldn’t necessarily have planned or thought about.”
He continued to state that nobody lost any funds since the money was pure profits destined to Sushi holders. The lost $15k will be replaced from the Sushi Treasury.
No real damage was done since the contract had access to limited funds but the incident highlights that there are still flaws to be found in the design of smart contracts regardless of whether the protocols have been officially audited or not.
SUSHI Price Outlook
SUSHI token prices are up 7% since yesterday’s open and there was no impact on markets from this relatively minor incursion.
Trading at $1.48, SUSHI is still at a loss from the same time last week and a long way down from its all-time high of over $8 which occurred just after the protocol was launched in early September.
In terms of total value locked, SushiSwap has $680 million, an increase of 6% on the day placing the protocol at ninth place in the DeFi Pulse TVL charts.
Disclaimer
All the information contained on our website is published in good faith and for general information purposes only. Any action the reader takes upon the information found on our website is strictly at their own risk.
