Incident Report (12/10/2021)

Incident Report: Integrating the new SushiMaker contract

While testing efforts to improve the operations of bridging of LP fees back to SushiMaker on Ethereum Mainnet from an expansive list of networks, a portion of fees was sent to the pool itself resulting in a loss of $400,000 fees from Polygon to the SushiBar.

The new SushiMaker offers a variety of advantages including prevention of potential sandwich attacks when unwinding LP positions to buy SUSHI.

During a particular unwinding action to deal with an edge case, $600k worth of fees were sent back to the pool address, due to wrongful encoding.

The relevant transaction can be found here:
https://polygonscan.com/tx/0x5610e8b733e371c1277458cf860a600f6c39c35f79fb2b7358d69118d27771cf

An active MEV bot extracted the liquidity and swapped the two tokens. However during this swap, the bot suffered a loss of $240k as one of the tokens had no liquid market. The token in question should have been redeemed for its underlying backed asset instead, hence the original edge case in unwinding operations and reason for the initial withdrawing of LP tokens from the SushiMaker contract, which led to the encoding error.

Sushi contributors involved in this testing sent an onchain message to the MEV bot asking for a return of the lost fees:
https://polygonscan.com/tx/0xd960a4ecdc5b6b4aceeea1a8c0cc54ccc29563fff913babef9541ab3e0c3ee0f

The bot subsequently returned $200k, which was then appropriately bridged back to Ethereum mainnet and served to the SushiBar.

In light of these errors, contributors have taken several steps to mitigate future errors. Inclusive of those steps is a new withdraw method enabling the owner (multisig) to withdraw without performing any special encoding was implemented to reduce complexity and chance of mistakes.