Benzinga - Over the weekend, SushiSwap suffered a major security breach when a bug in its RouterProcessor2 contract was exploited, leading to the theft of approximately $3.3 million worth of Ethereum (CRYPTO: ETH) from a user's wallet.
PeckShield, a blockchain security and data analytics company, confirmed that the "approve-related bug" in the contract allowed the attacker to steal 1,800 ETH from the victim's wallet.
It seems the @SushiSwap RouterProcessor2 contact has an approve-related bug, which leads to the loss of >$3.3M loss (about 1800 eth) from @0xSifu.Binance-backed (CRYPTO: BNB) cybersecurity firm Ancilia conducted a separate analysis and found that the flaw resulted from a failure to validate access permissions during a swap transaction.If you have approved https://t.co/E1YvC6VZsP, please *REVOKE* ASAP!
One example hack tx: https://t.co/ldg0ww3hAN pic.twitter.com/OauLbIgE0Q
— PeckShield Inc. (@peckshield) April 9, 2023
3/ Root cause is because in the internal swap() function, it will call swapUniV3() to set variable "lastCalledPool" which is at storage slot 0x00. Later on in the swap3callback function the permission check get bypassed. pic.twitter.com/LN0Ppsob9aThe vulnerable contract was also discovered on the Polygon network.— Ancilia, Inc. (@AnciliaInc) April 9, 2023
Also Read: BRICS Currency Game-Changer: Impact Of Financial Earthquake On Global Economic Dynamics
Jared Grey, SushiSwap's "head chef," confirmed the bug and urged users who had interacted with the blockchain to revoke all permissions granted to the exchange's contracts.
CTO Matthew Lilley also followed up with more details, stating that the company was identifying all affected addresses and working to rescue funds as they become available.
Lilley also provided a tool to help users check for exposure across various networks.
Despite the hack, the price of SushiSwap's (CRYPTO: SUSHI) token has only dropped slightly in the past 24 hours.
It is worth noting that SushiSwap narrowly avoided a major hack earlier this year when a "white hat" crypto researcher discovered a bidding bug that could have resulted in a loss of $350 million.
Read Next: DOGE's Dramatic Dive After Twitter Logo Reversal: Has The Meme Coin Bubble Burst?
Photo: Shutterstock
© 2023 Benzinga.com. Benzinga does not provide investment advice. All rights reserved.