# Postmortem (26/04/2022)

Postmortem: 26th April, 2022

Participant: Sushi Core Team (Sarang, Matthew, Ramin, Jiro), Synthetix (JJ, Ethernaut)

On April 26, 2022 at 11:33 PM UTC Sushi was alerted of a bug at handling of SNX token inside Bentobox.

**TLDR: ALL USER FUNDS ARE SAFE. DON'T DEPOSIT SNX OR ANY SYNTHETIX BASED ASSETS ON BENTOBOX**

Bentobox Contract: https://etherscan.io/address/0xf5bce5077908a1b7370b9ae04adc565ebd643966

The SNX token had two contracts, *Target* and *Proxy*.
These contracts mirrored the balances of SNX within each other, as they share the same storage.
Bentobox allows users to deposit via sending tokens directly to the contract (skimming).

SNX Target Token Contract: https://etherscan.io/address/0xE95A536cF5C7384FF1ef54819Dc54E03d0FF1979

SNX Proxy Token Contract: https://etherscan.io/address/0xc011a73ee8576fb46f5e1c5751ca3b9fe0af2a6f

As per the SNX recommendation, Bentobox and Kashi were using the Proxy token contract on the Sushiswap UI.

However, the bug arises when the user deposits using the Target token contract, which bentobox treats as a different token as expected.
When the Target token contract SNX is withdrawn, it also updates the Proxy token contract balance, and the user receives both Target and Proxy tokens, instead of just Target Token Contract SNX.
However, as this is not registered inside the Bentobox, it would ultimately allow for draining the entire Proxy Contract SNX tokens.

I.e. Anyone could deposit 0 SNX Target tokens. As Bentobox has the unskimmed balance of SNX target tokens, you can deposit the entire amount of Proxy SNX tokens, without depositing any actual tokens. Were the user to withdraw, it would withdraw both SNX Target and Proxy tokens, leaving the Bentobox balance as 0 in both the contracts, hence draining the entire vault.

This issue was present with every Synthetix based asset. So, any SNX tokens for Synthetix based assets on Bentobox would be at risk.
On further investigation we found that only SNX and sUSD were deposited on Bentobox.

Most of these tokens were being used at Kashi for Lending and Borrowing.

Using the above exploit anyone could have drained the respective Kashi Pairs, causing loss of funds to the lenders and borrowers.

**Bentobox is safe for the Standard ERC20 Tokens. However, it can act not as expected in case of tokens that use older proxy patterns, such as SNX.
Other proxy patterns, such as eip-1167 (utilized by MISO) are unaffected.**

**As Kashi is an isolate lending market, only these markets were affected and other markets are completely safe.**

In order to rescue the funds, the Sushi Team created a Whitehat Rescue Contract, which rescued the SNX and Synthetix based tokens inside Bentobox and Kashi.

While executing the whitehat, one of the transactions got relayed to the public mem pool, and it was frontran by a MEV bot. We requested the MEV bot to return the funds, their response was very quick and they returned the tokens to Sushiswap Operations Multisig.
We appreciate and thank them for returning the funds.

All the funds were rescued and were sent back to the affected users.

SNX Distribution Transaction: https://etherscan.io/tx/0xf6825ce58f2bbee0de1d1df0e7a5cb94b3d0b7b02bc0c69e81dfcd94c6a8bc9d

USDC Distribution Transaction: https://etherscan.io/tx/0x1697f7bf07e06f8e716e9d7b18bc48933a3359196642dcf55e2f037a1eff5b2d

sUSD Distribution Transaction:
https://etherscan.io/tx/0x3635ad5a9f2b4ec6bb81b3e362185a87fd5adf05110da1b8f0ce07090731c143

**NOTE:
DO NOT DEPOSIT ANY REBASING TOKENS, SNX OR ANY SYNTHETIX BASED ASSETS ON BENTOBOX. ALL REBASING TOKENS, SNX or SYNTHETIX BASED ASSETS DEPOSITED WILL BE LOST.**

We are taking the following steps to mitigate this issue.

Firstly, by not allowing the SNX or Synthetix based tokens to be deposited via the Sushiswap UI on Bentobox.

Secondly, all the Kashi Pairs with SNX or Synthetix based tokens are also disabled from the Sushiswap UI.

Total amount of SNX rescued: 7,150 SNX
Total amount of USDC rescued: 14369 USDC
Total amount of sUSD rescued: 1083 sUSD

All other Kashi Pairs and Sushiswap products are unaffected from this incident.

We'd also like to thank Immunefi, Synthetix Team and Vahid from Flipside.

Thank You,

Sushiswap Team