Rescuing over $600,000 of SushiSwap user funds
On the evening of 8 April 2023, HYDN monitoring caught an approval bug in SushiSwap's RouteProcessor2 contract being exploited. Weak input validation let an attacker impersonate a pool and move tokens from any account that had approved the router. HYDN opened a war room with the Sushi team that night and deployed a cross-chain watcher to front-run the attackers across eight chains, rescuing over $600,000 of user funds.
The situation
RouteProcessor2 was a SushiSwap router contract. Users granted it approvals to trade their tokens. A flaw in how it validated input to processRoute() meant an attacker could pass in a fake pool address and have the router move tokens from any account that had approved it.
What HYDN did
- Detection. HYDN’s monitoring caught the exploit as it happened.
- War room. We opened a joint war room with the Sushi team that same night.
- Rescue. We deployed a cross-chain watcher contract that front-ran the attackers across eight chains, moving funds that were already being drained.
- Result. Over $600,000 of user funds was rescued before it could be taken.
Lessons
- Router approvals are a high-value target. We now check them first in every DEX audit.
- Monitoring and fast response save money that audits alone cannot.
- Users should revoke approvals they no longer need.
Read the full write-up.
Frequently asked questions
What was the vulnerability?
Weak input validation in the processRoute() function of SushiSwap's RouteProcessor2 contract allowed an attacker to impersonate a V3 pool address and move tokens out of any account that had granted the router an approval.
How was the money rescued?
HYDN deployed a watcher contract across eight chains that front-ran the attackers, moving at-risk funds to safety before they could be taken.
Published Updated