sushiswap-exploit

SushiSwap RouteProcessor2 exploit reproduction + supporting data useful for whitehat rescue.

Exploit reproduction

Found in src/CounterExploit.sol. Exploits pool re-entrancy to arbitrarily transfer approved tokens.

The Tenderly debugger is useful in understanding the exploit path.

# Get dependencies
forge update

# Run tests
forge test --fork-url MAINNET_RPC --fork-block-number 17007460

Whitehat data

With the RouteProcessor2 contract deployed across 14 chains, users are susceptible to allowance drainage across many networks. ./data contains code and allowance mappings used to generate and whitehat balances.

Note:

1. These allowances are only based on addresses that interacted with the RouteProcessor2 contract (and do not include allowances approved indepdently of a swap or other interaction), except for mainnet, where I bruteforced approvals in all blocks since the router was deployed.
2. Although I have whitehatted all possible non-zero balances today, there may exist more in the future, as users with non-zero approvals but zero balances add pre-approved tokens to their wallets.

License

GNU Affero GPL v3.0