SushiSwap
DAMASCUSDEX / AMM · Multi-chain · $500M+ TVL · 25 contracts
Public risk assessment — scores are produced with the same methodology as monitored protocols
Security Profile
72
78
82
65
55
82
68
75
65
72
78
82
65
55
82
68
75
65
Audit History
Bug Bounty Program
Assessment
Uniswap V2 fork with 67+ months live and battle-tested core AMM. Historical governance turbulence and the 2023 RouteProcessor exploit on periphery contracts reduce confidence. BentoBox ecosystem adds significant composition complexity.
Dimension Breakdown
How scores work →- Multisig admin control
- Router contracts with broad permissions
- BentoBox vault has complex access model
- Historical governance turbulence
- Proven AMM model (Uniswap V2 fork)
- xSUSHI staking model straightforward
- Trident multi-pool architecture adds complexity
- Fee distribution well-tested
- TWAP oracle from Uniswap V2 model
- No external oracle dependency in core
- BentoBox strategies may use external oracles
- Oracle manipulation resistant via time-weighting
- Live since September 2020 (67+ months)
- Survived governance crises
- Uniswap V2 fork means core AMM code is battle-tested
- Multiple products have varying maturity levels
- Historical governance instability (chef controversy)
- Multisig controls significant parameters
- SUSHI token governance maturing
- No meaningful timelock on many operations
- RouteProcessor exploit in 2023 ($3.3M)
- Active bug bounty program
- Core AMM unaffected by exploits (periphery was hit)
- Multiple audit firms across products
- Team restructuring affected ops continuity
- Multi-chain deployments increase ops surface
- Incident response demonstrated in RouteProcessor exploit
- Community-driven monitoring
- BentoBox adds deep composition surface
- Kashi lending on BentoBox
- Cross-chain deployments with varying security
- Multiple product lines increase surface area
- Standard Solidity
- Fork of audited Uniswap V2 code
- BentoBox adds dependencies
- Verified on multiple chains
Additional Dimensions
- Not assessed — excluded from BRI computation
Risk Drivers
Primary risk factors driving this score, ordered by severity.
Adversarial Risk Signals
Observable security posture indicators. These signals reflect publicly verifiable information and responsible disclosure outcomes. No specific vulnerability details are exposed.
Score History & Verification
Score provenance tracking begins with the next reassessment.
On-Chain Data
- Protocol Slug
- "sushiswap"
- Oracle
- BRORegistry (Base)
- Evidence
- IPFS (pinned)
- Staleness Threshold
- 24 hours
registry.getScore("sushiswap")Reduce exploitable risk
BlackHart Monitoring provides continuous adversarial analysis, vulnerability detection, remediation support, and verified reassessment when your risk posture improves.