SashimiSwap's Investment Router exploited via logic error in swap accounting, allowing attacker to drain $51.8K in WETH from lending vault using Morpho flash loan.
Security & Exploits ·
SashimiSwap's Investment Router suffered a logic error on July 26 that allowed an attacker to drain approximately 27.08 WETH (worth $51.8K) from its lending vault. The router maintains virtual reserves internally but sources actual output tokens from a shared SashimiInvestment lending vault by calling withdrawals when its own balance runs low. An attacker exploited this design by obtaining a Morpho flash loan of 27 WETH, borrowing roughly 6.2 million SASHIMI tokens, and swapping them through the router at artificially favorable rates.
The vulnerability centered on a pricing mismatch: the router valued swaps using a thin SASHIMI-WETH pair while the lending vault handed over WETH directly from its underlying position. Because the swap accounting did not properly reconcile these two pricing sources, the attacker forced the vault to redeem far more WETH than the SASHIMI collateral was worth. The victim contract transferred 27.08 WETH in a single transaction.
The attack demonstrates a shared-vault design flaw in which the router's internal accounting and the lending vault's redemption logic operated independently. No disclosure has yet addressed whether other pools rely on the same mechanism or what recovery steps, if any, the team intends to pursue.