SushiSwap dev refutes claims of a $1 billion security risk

The white-hat hacker claims to have gone public after SushiSwap failed to act on the vulnerability

SushiSwap has rejected claims that the decentralised exchange (DEX) platform is at risk of a major security breach that could see more than $1 billion in user funds stolen.

According to a hacker, while the functionality provides for the withdrawal of liquidity provider (LP) tokens, it is shown to fail when the SushiSwap pool holds no rewards.

The hacker alleged that it takes close to 10 hours for the rewards account to refill, with the manual process happening several times a month. As such, over $1 billion in user funds are at risk for about 10 hours.

But according to developer Mudit Gupta, the platform is not currently vulnerable to a security threat and user funds are safe. Reacting to the white-hat hacker's claims on Twitter, the Shadowy Super-Coder noted:

"This is not a vulnerability. No funds at risk. If rewarder runs out of rewards, withdrawing LP will fail but anyone (not just sushi) can top up the rewarder in an emergency."

The developer suggests that the 10-hour timeline the white-hat hacker indicates is not cast in stone and that with anyone being able to refill the pool, no threat exists when the rewarder runs out of funds.

The SushiSwap dev also notes that allegations that a malicious actor can "drain" the rewarder by flooding it with LP were incorrect. He clarified that rewards allocated per liquidity token are reduced when more LP is added.

The claims follow what an anonymous white-hat hacker noted were two instances of vulnerabilities on the SushiSwap platform. Per the hacker, the decentralised finance (DeFi) protocol's emergencyWithdraw function relating to the MasterChef v2 and MiniChef v2 contracts puts users at risk because it doesn't work as intended.

The contracts in question hold rewards and LP token pools hosted on platforms such as Binance Smart Chain (BSC), Avalanche and Polygon.

SushiSwap has not released an official statement about the claims, but will certainly look to assure users of fund safety given the DeFi sector has recently witnessed several instances of attacks.