Sashimi Swap Exploit

On 30 December 2021 an unknown attacker executed two flash-loan transactions against Sashimi Swap’s UniswapV2Router02, exploiting a bug in swapExactTokensForETHSupportingFeeOnTransferTokens and weaknesses in the router–vault design to extract approximately $210,000; the attacker converted proceeds and funneled funds through Tornado Cash. The report outlines the loan and swap sequence, created token pairs, contract-level root cause analysis, and the laundering of UNI, Sashimi and USDT, and warns that flash-loan attacks are increasing in frequency.