Delay in SushiSwap Listing. Security Breach Averted!

We have had to delay the Listing Announcement on SushiSwap due to a breach in our Eth. token contracts. The details of the contract breach have been mentioned below.

Bridging contract for Poly <> Eth. worked with a lock/unlock, burn/mint functionality.

  1. If the user wants to bridge their tokens from the Ethereum chain to the Polygon chain, they will have to call the [deposit()](<>) function in the FxBaseRootTunnel contract.
  2. The deposit() function will call the [burn()](<>) function from the Ethereum token contract.
  3. The burn(address, amount) should accept the address from where the tokens are to be burnt and the amount of tokens to be burnt.
  4. The burn(address, amount) function should have a condition check to allow only the FxBaseRootTunnel contract to call that function and that check that was not present.

On Monday January 17, 2022 we deployed test liquidity on SushiSwap Liquidity Pool. Within minutes the attacker burnt SAFLE tokens in the SushiSwap Liquidity Pool in multiple transactions, draining 480,853 SAFLE


This inflated the price of SAFLE and the attacker swapped SAFLE/WETH in a transaction. Since the tokens had been burned, the attacker was able to convert 56.88 SAFLE to 16.04 WETH.

Here are more details of the incident as captured by the blockchain explorer: of the Exchange — Address of The Attacker Money on the Attacker Account Call

Figure- Bridging-contract/contracts/eth token/Safle.sol.

The burn method used for an attack. Due to lack of the ‘caller checking’ it can be called by anyone.

There was a lapse in the audit by Smart State as they were unable to flag the vulnerability in the token contract. They didn’t point to that part so this is the communication level issue.

The best part is that the vulnerability has now been resolved. More details are given here —

Figure- The vulnerability resolved.

Even though the SushiSwap Liquidity Pool deployment was never officially announced or promoted by our channels. We apologise for any inconveniences caused in the process. This can be avoided with more eyes on, as well as a re-think in developer procedures and peer-review. We assure our community that we will further investigate and compensate for any personal losses.

Figure- Hacker’s Track

We’ll announce a new date for SushiSwap Listing soon. It won’t take too long! Thanks all for your patience and support once again, there’s only one way forward.

Team Safle



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store