Recent Sushi Exploit, mid exploit summary. Four moon holders have had Moons in wallets drained totaling 57,148 Moons. Make sure to Revoke permissions for Sushi if you haven't already.

I'm sure as you all know by now, SushiSwap had an exploit in a Route Processing contract that went live 4 days ago, so anyone who interacted with the platform and didn't set a custom spending limit or didn't revoke permissions could be at risk of having funds drained. Having a hardware wallet does not protect you from this type of exploit.

If you haven't already removed permissions you can do that from Revoke Cash. Another user made a quick guide here.

So far the exact details are a Route Processor Contract was exploited. This dealt with WETH/USDC/DAI on Arbitrum Nova, but other chains are exploited as well. No liquidity pools are exploited. Just users funds who approved unlimited withdrawals from this contract.

/u/ZoomerCoomer9000 gathered the following information about Moons that were drained in what appears to be a result of this exploit.

56,373 moons stolen from 3 addresses by this contract:

https://nova-explorer.arbitrum.io/address/0x04FE41C2aD4dFAEeAf8b59A1F72917cCB7D7a164/token-transfers#address-tabs

775 moons stolen from 1 address by this contract:

https://nova-explorer.arbitrum.io/address/0x3168e3489d8A0fd1781D8FF4098a53B3bAf4Af27/token-transfers#address-tabs

So ~57K Moons have been stolen as a result of this exploit. Considering the total userbase of this sub that interacts with Sushi that's not nearly as bad as it could be - but that doesn't mean it's over. It's possible other users could still be vulnerable to the exploit that haven't yet been drained.

You're at risk if you interacted with this contract in the last 4 days on SushiSwap, but it's a good idea to clear your "unlimited" permissions regardless so you're not vulnerable to any potential future exploits from any source.

The Sushi display for the Moon/ETH liquidity pool is not correctly showing all the information about user holdings, however it's still there and you do not need to worry about it. If you connect your wallet and press "withdrawal" you'll be able to see your liquidity tokens.