Attacker exploited SushiMaker's fee-conversion mechanism by creating a fake DIGG/WETH trading pair with minimal liquidity. By routing 0.05% of DIGG/WBTC swap fees through this illiquid pool, the attacker caused massive slippage and captured 81 ETH in outsized fees that should have gone to xSUSHI stakers.

On January 27, 2021, SushiSwap was attacked again. This attack took advantage of the fact that DIGG itself did not have a WETH trading pair, and the attacker created this trading pair and manipulated the initial transaction price, resulting in a huge slippage during the fee exchange process. The attacker only needs to use a small amount of DIGG and WETH provide initial liquidity to obtain huge profits.