SushiSwap Allowances Hack 3.3 million dollars lost
Last month someone or some persons stole cryptocurrency from the wallets of crypto DeFi investors, using a vulnerability know as Allowances or sometimes called Permissions.
Allowances are something you allow or permit to happen formally via transaction.
The software code of a trading site where you have connected your wallet will ask you to Allow it to remove a particular cryptocurrency from your wallet.
For example you have BNB token in your wallet and you connect your MetaMask wallet to the decentralized exchange PanCakeSwap because you want to buy Leo. Once you connect your wallet, select swap, select the two tokens BNB & LEO and then select swap, the site will ask you for permission to access the BNB in your wallet. It will open a box called Allowances and ask you to click a box Allowing it to remove a token, BNB from your wallet.
You click Yes, then the box closes, and now every time you connect your wallet to PanCakeSwap and want to use your BNB to buy another cryptocurrency PamCakeSwap doesn’t ask you to Allow it to remove BNB from your wallet, it uses the original Allowance decision.
This results in quick and efficient trading. However it is possible to use that Allowance permission to take crypto out of your wallet when you are trading,
This is called an EXPLOIT, the use of a feature, as a vulnerability, and stealing someone’s crypto.
So last month someone or some persons figured out how to use the Allowances permissions on SushiSwap to allow them to remove crypto from investors wallets who had given this Allowance Permission to SushiSwap.
The result was over 3 million dollars in stolen cryptocurrency.
Fixing the problem
The good news is that you can revoke this Allowance and Stop Allowing SushiSwap to remove cryptocurrency from your wallet.
And if you want to trade on SushiSwap in the future, you connect your wallet and give SushiSwap these Allowances again.
UniSwap
This attack is unconfirmed.
I would suggest investigating this further.
Uniswap is the largest decentralized exchange in existence.
Today I heard a rumor that crypto investors were losing their ETH from their MetaMask Wallets from a hacker using this same type of attack, only now they were using Allowances on Uniswap.
So I suggest you investigate this, and consider revoking your Allowances on Uniswap.
You can get clear step by step instructions from MetaMask Support website.
