Sushi Swap

SushiSwap is one of the oldest and best-known decentralized exchanges (DEXs) in the crypto market, and although today it lags well behind major players such as Uniswap and PancakeSwap in trading volume, it is still considered one of the important protocols in the DeFi ecosystem. Supporting dozens of blockchain networks, the platform has processed billions of dollars in cumulative trading volume since its launch and remains among the active multichain DEXs on the market. However, its daily trading volume has declined compared with the DeFi peak of 2020 and 2021 and, depending on market conditions, usually fluctuates in the range of a few million dollars.

In terms of security, it should also be noted that, unlike centralized exchanges, SushiSwap does not provide users with an account or a custodial wallet. All trades are carried out by connecting personal wallets such as MetaMask, and private keys are never handed over to the protocol. For this reason, the security of assets depends above all on how users store their recovery phrase, manage the permissions (Token Approval) granted to smart contracts, and follow security practices themselves. This self-custody model eliminates the risk of holding assets with an intermediary, but in return places full responsibility for protecting funds on the user.

From a technical security standpoint, SushiSwap's smart contracts have been audited multiple times over the years, and the developers have continuously released new versions of the protocol, the liquidity aggregator and risk management tools.  In recent years, the protocol has also, by transferring part of its management activities to Sushi Labs , tried to build a more coherent operational structure and pursue product development and ecosystem resource management more professionally. 

Nevertheless, like all DeFi protocols, SushiSwap is not completely risk-free; smart contract vulnerabilities, phishing attacks, unlimited approvals (Unlimited Approval) and impermanent loss (Impermanent Loss) for liquidity providers remain among the most important risks of using this platform. At times, some vulnerabilities have even been identified in SushiSwap's contracts and quickly fixed, which shows that users should always use the latest version of the protocol and periodically review their wallet permissions.

Overall, SushiSwap can be considered an established, reputable and technically reliable decentralized exchange; however, unlike centralized exchanges, the security of using it depends above all on the user's own knowledge and care in managing their wallet and interacting with smart contracts.

 

Does SushiSwap have a history of hacks or fraud?

Yes. Over its years of operation, SushiSwap has faced several security incidents and various exploits. However, a distinction should be made between protocol hacks, smart contract vulnerabilities and insider abuse, since these events were not all of the same nature.

SushiSwap's first major crisis occurred in 2020, just a few days after its launch. In this incident, the project's anonymous founder, known by the pseudonym Chef Nomi, converted part of the development fund's tokens into Ethereum and sold them; a move that caused the price of the SUSHI token to crash and destroyed user trust. This was not a hack but an example of insider abuse (Insider Abuse). However, after widespread community backlash, all funds were returned to the project and the founder formally apologized.

A year later, in September 2021, MISO, SushiSwap's dedicated launchpad, was targeted by a supply chain attack (Supply Chain Attack). By tampering with the front-end code, the attacker changed the smart contract address and managed to steal about 865 ETH, worth nearly $3 million at the time, from the sale of an NFT collection. In this incident, the weakness was not in the smart contract itself; rather, the attacker had targeted the website's infrastructure.

SushiSwap's biggest security incident occurred in April 2023, when a vulnerability in the RouteProcessor2 contract, which had been released only a few days earlier, was discovered and exploited. The bug allowed the attacker to withdraw the assets of users who had previously granted approval (Approve) to the contract. The attack affected several blockchain networks and caused about $3.3 million in losses. After the vulnerability was identified, the SushiSwap development team, together with security groups and white-hat hackers, recovered a significant portion of the assets and pledged to compensate affected users for the remaining losses.

Some reports published in later years also mention a slippage-related incident (Slippage Incident), but no documented, clear information is available on the technical details and the extent of losses from this event; therefore, it cannot be confidently included in the list of SushiSwap's confirmed hacks.

Overall, SushiSwap's security record shows that, like many major DeFi projects, the protocol has not been immune to the common risks of smart contracts and decentralized infrastructure. However, the important point is that none of these incidents involved the hacking of user accounts or the theft of assets from exchange-managed wallets, as happens at centralized exchanges.