Sushi MISO

Summary

MISO ("Minimal Initial SushiSwap Offering") was SushiSwap's open-source token launchpad: a factory of audited, composable smart contracts that let both technical and non-technical founders mint a token, sell it via one of three auction formats, lock proceeds and team tokens in vaults, bootstrap farming incentives, and migrate liquidity into SushiSwap pools. Proposed on the Sushi forum in late 2020, announced in February 2021, and launched on May 17, 2021 with the sale of SAK3 (888 tokens each redeemable for a physical bottle of sake), MISO's flagship moment came in August 2021 when BitDAO's Dutch auction raised roughly 112,000 ETH ($340M) from 9,200+ participants — one of the largest permissionless token sales conducted on Ethereum to date. The platform's security history is equally notable: a whitehat team led by Paradigm's samczsun defused a bug that put ~109,000 ETH ($350M) of BitDAO auction proceeds at risk, and a month later a frontend supply-chain attack diverted 865 ETH (~$3M) from the Jay Pegs Auto Mart (DONA) sale before the attacker returned the funds under legal pressure. MISO v2 relaunched as a permissionless product, but Sushi announced deprecation in December 2022, citing lack of resources, and wound it down in Q1 2023.

Design (Mechanism)

MISO was structured as a menu of "recipes" assembled from modular contract groups (credited in-source to pseudonymous developers Chef Gonpachi, Kusatoshi, and SSMikazu, with the Dutch auction explicitly "inspired by DutchSwap's Dutch Auctions"):

• Token factory: deploy a fixed-supply, mintable, or SushiToken-style ERC-20 without writing code.
• Three market types:
  • Dutch auction — price starts high and declines linearly over the sale window; the sale clears at the lowest price at which all tokens are committed, giving every buyer the same clearing price and discouraging gas-war sniping.
  • Batch auction (IBCO-style) — a fixed token amount is divided pro-rata across all ETH committed during the window, so there is no race and no per-buyer price discrimination.
  • Fixed-price crowdsale — a classic capped sale for teams that want price certainty.
• Vaults and lockups: proceeds and team allocations could be escrowed/locked to signal commitment.
• Farming and liquidity migration: post-sale recipes seeded SushiSwap pools and yield farms, closing the loop from fundraise to liquid market on the host DEX.

The design intent was vertical integration: launches happen on Sushi's contracts, liquidity lands in Sushi's AMM, and the DEX captures the trading activity — a launchpad as a customer-acquisition funnel for the exchange rather than a standalone fee business.

Outcome

• Headline success: the BitDAO sale (Aug 2021) raised 112,000 ETH ($341.7M) from 9,200+ participants, validating that a DEX-native, self-serve launchpad could execute institution-scale raises.
• Near-catastrophe (Aug 2021): samczsun found that MISO's batch multicall used delegatecall, which persists msg.value — so a user could batch multiple commitEth calls and reuse a single ETH payment across all of them, buying the auction for free and, at max commitment, draining refunds. A whitehat "war room" (documented by samczsun and Sushi's Mudit Gupta) rescued the ~109,000 ETH at risk in under five hours; no funds were lost. Sushi subsequently ran a Code4rena audit contest (Sept 2021).
• Actual exploit (Sept 17, 2021): a contractor using the GitHub handle "AristoK3" injected malicious code into the MISO frontend, swapping the Jay Pegs Auto Mart (DONA) auction's recipient address for their own and diverting 864.8 ETH (~$3M). Then-CTO Joseph Delong publicly identified a suspect and threatened an FBI complaint; the funds were returned within a day. The episode fed internal turmoil that preceded Delong's December 2021 resignation.
• Wind-down: MISO v2 shipped as a permissionless multichain product, but on Dec 29, 2022 Sushi (via CTO Matthew Lilley and Head Chef Jared Grey's restructuring) announced MISO would be deprecated in Q1 2023 — explicitly for "lack of resources," not design failure — as Sushi refocused on its core DEX.

Why it worked

• Fair-launch mechanisms as products: packaging Dutch and batch auctions as no-code recipes gave founders credible, gas-war-resistant price discovery that whitelisted launchpads of the era did not offer; BitDAO's raise proved the ceiling was very high.
• Vertical integration with the DEX: launch → vault → farm → Sushi liquidity was a coherent funnel; the launchpad's success directly fed the exchange's core business.
• Open-source, forkable contracts (GPL-3.0) built trust and let the community audit mechanics — and, in the samczsun incident, enabled outside researchers to find and fix a critical bug before an attacker did.

Where the design broke

• Security debt from composability: the $350M near-miss came from two individually safe patterns (multicall batching + payable commitments) composing unsafely — a hazard intrinsic to MISO's "mix-and-match recipe" architecture.
• The trust perimeter was bigger than the contracts: the real loss came through the frontend deploy pipeline via a short-term contractor — a supply-chain vector the on-chain design could not defend against — and it damaged the platform's launch-partner credibility at exactly the moment it needed momentum.
• No durable revenue model: MISO generated launches episodically, not fees continuously; when bear-market resource cuts came (Dec 2022), a product that was "solely" a resource sink with no self-sustaining economics was cut, per Sushi's own stated rationale.
• Reputational drag and organizational churn: the hack, the public FBI-threat handling, and leadership departures (Delong, and earlier 0xMaki's move to an advisory role) left MISO without a committed internal champion.

Lessons

• Composable "recipe" architectures multiply audit surface: every combination of modules (here, delegatecall multicall × payable commitEth) is its own attack surface; audit the compositions, not just the components.
• A launchpad's security perimeter includes its web stack: the only realized loss ($3M) came from frontend deploy permissions given to a pseudonymous contractor, not from contract code. Signing/verification of frontend builds and least-privilege repo access are as load-bearing as Solidity audits.
• Whitehat relationships are a real security layer: the difference between a $350M loss and zero loss was that Paradigm researchers read the code and Sushi had a functioning war-room process — open source plus responsive maintainers is a defense in depth.
• Uniform-clearing-price auctions (Dutch/batch) demonstrably scale to nine-figure raises without gas wars — the mechanism outlived the platform and was widely imitated.
• A strategically "free" product needs an explicit subsidy decision: if a launchpad exists to feed the DEX rather than earn fees, its funding must be tied to that strategic value, or it will be first on the chopping block in a downturn.

Redesign (EDITORIAL — hypothesis, not fact)

The following is editorial analysis — a hypothesis, not established fact. A revived MISO would likely have kept the auction mechanics (which were sound and battle-tested) and changed everything around them. First, fund it with a protocol-level take rate — e.g., 1-2% of raise proceeds streamed to the treasury plus a mandatory seed-liquidity lock in Sushi pools — so the product has a P&L that survives bear markets instead of being a discretionary cost center. Second, treat the frontend as consensus-critical infrastructure: reproducible builds, on-chain (ENS/IPFS) pinned frontends, contract-address allowlists rendered from an on-chain registry rather than a repo JSON, and no deploy rights for short-term contractors — any one of these would likely have prevented the DONA hack. Third, replace the delegatecall-based multicall with a non-payable batcher or per-call value accounting, and require an invariant test suite ("total commitments equal contract ETH balance") as a listing precondition. Finally, lean into what BitDAO proved: the durable market was large, credibly-neutral treasury-scale auctions (the niche later served by sealed-bid and gradual Dutch auction venues), not long-tail meme launches — a curated "institutional fair-launch venue" positioning might have justified the maintenance investment Sushi ultimately declined to make.