Slow Fog: SUSHI RouteProcessor2 is under attack, please revoke its authorization in a timely manner
ChainCatcher message, according to the intelligence from the SlowMist security team, the SUSHI RouteProcessor2 has been attacked. The SlowMist security team shared the following in a brief:The root cause is that ProcessRoute did not perform any checks on the user-provided route parameter, allowing the attacker to exploit this issue to construct a malicious route parameter that made the contract read a Pool created by the attacker.Since there was no check in the contract to verify the legitimacy of the Pool, the lastCalledPool variable was directly set to the Pool, and the Pool's swap function was called.The malicious Pool called the RouteProcessor2's uniswapV3SwapCallback function in its swap function. Since the lastCalledPool variable had been set to the Pool, the check on msg.sender in uniswapV3SwapCallback was bypassed.The attacker exploited this issue to construct token transfer parameters when the malicious Pool called the uniswapV3SwapCallback function, in order to steal tokens from other users who had authorized RouteProcessor2.Fortunately, some users' funds have been rescued by white hats and are expected to be recovered. The SlowMist security team advises users of RouteProcessor2 to promptly revoke their authorization for 0x044b75f554b886a065b9567891e45c79542d7357.
