SushiSwap denies "billion dollar vulnerability" in protocol – Bits Media

The developer of the decentralized exchange SushiSwap denies the discovery by the "white hacker" of the alleged vulnerability, which can get by with the protocol $1 billion.

Tonight the white hat hacker CryptoWilfred published
on his Twitter several posts about what he discovered vulnerabilities on the SushiSwap platform, which may jeopardize the crypto assets of users on $1 billion. He declared, that he decided to make the information public after, how attempts to contact the developers of SushiSwap led nowhere.

Hacker claims, that he discovered a vulnerability in the emergencyWithdraw function in two SushiSwap smart contracts, MasterChefV2 and MiniChefV2, which regulate the operation of double reward farms, exchanges and pools in SushiSwap deployments on Polygon, Binance Smart Chain и Avalanche.

The emergencyWithdraw function allows liquidity providers to immediately withdraw their crypto assets, while losing rewards in the event of an emergency. However, the hacker claims, that this function will not work, if there are no rewards in the SushiSwap pool. The consequence of this will be a long wait for liquidity providers for that moment, when will the pool be replenished manually, which can take about ten hours. Only after this, the withdrawal of crypto assets within the function will become available.

"It may take about ten hours for all signature holders to, to agree to top up your rewards account, and some reward pools are empty several times a month.”, – said the hacker. “Deployment of SushiSwap without using Ethereum and double rewards (all using vulnerable MiniChefV2 and MasterChefV2 contracts) have crypto assets worth more than $1 billion. It means, that all this money could essentially be blocked from users for ten hours several times a month".

One of the anonymous SushiSwap developers wrote:
on twitter, that the threat "does not constitute a vulnerability" and that users' money is safe. He explained, that any signature holder can replenish the reward pool in case of emergency, bypassing most of the ten-hour, multi-signature process. According to the developer:

"The hacker's claim that, that someone can add many liquidity providers, to get rewards faster, wrong. The more liquidity providers, the less the reward for each of them".

Hacker stated, what he said about the vulnerability in the Immunefi error detection platform, where SushiSwap offers to pay rewards of up to $40 000 for reporting critical errors in the protocol. However, the application was closed without payment of compensation – SushiSwap developers responded, that they are aware of the situation.

Last week, the developers of the decentralized exchange SushiSwap reported, that as a result of a hacker attack, MISO tokens were stolen from the platform for selling tokens 864 ETH. Previously, the MISO platform had already identified
vulnerability. In August, SushiSwap escaped a hack on $365 million thanks to a “white hacker”.