SushiSwap (Vampire Attack)

Summary

SushiSwap launched in late August 2020 (MasterChef staking went live around August 26–28) as a near-exact fork of Uniswap V2 with one decisive addition: a token. Its pseudonymous creator, Chef Nomi, announced that liquidity providers who staked their Uniswap LP tokens in SushiSwap's MasterChef contract would earn SUSHI, and that after roughly two weeks the protocol would atomically "migrate" those LP positions — redeeming the underlying assets out of Uniswap's pools and re-depositing them into identical SushiSwap pools. This "vampire attack" pulled on the order of $800M–$840M of liquidity out of Uniswap on September 9, 2020, at a moment when well over $1B was staked for migration. The episode nearly collapsed days earlier when Chef Nomi sold the entire dev fund (~$14M in ETH), handed admin control to FTX's Sam Bankman-Fried, and then returned the funds on September 11 with a public apology. SushiSwap survived, decentralized to a multisig and DAO, and remains live years later — though Uniswap's UNI airdrop and V3 ultimately reclaimed dominant market share.

Design (Mechanism)

• Fork + token overlay. SushiSwap copied Uniswap V2's AMM contracts. The novel piece was the MasterChef contract (0xc2edad66...888cd), the sole minter of SUSHI (0x6b3595...90fe2). Users staked Uniswap LP tokens into MasterChef pools and earned SUSHI per block.
• Emission schedule. 100 SUSHI minted per block, with a 10x multiplier (1,000/block) for roughly the first 100,000 blocks (~2 weeks) to bootstrap before migration. Rewards were split across whitelisted pools by allocation points, with pools like SUSHI/ETH double-weighted.
• Fee-sharing token. Uniswap V2 charged 0.30% fees, all to LPs. SushiSwap kept 0.25% for LPs and routed 0.05% to SUSHI stakers (later formalized as the xSUSHI SushiBar) — giving the token a cash-flow claim Uniswap lacked at the time.
• The migration. MasterChef included a migrate() function callable by a designated migrator contract: it redeemed staked Uniswap LP tokens for their underlying assets and deposited them into freshly created SushiSwap pairs, minting SushiSwap LP tokens 1:1 to stakers. Liquidity moved wholesale, in one transaction flow, without individual LP action.
• Dev fund. 10% of all SUSHI emissions went to a dev fund controlled by Chef Nomi — a design choice (suggested publicly by @LawMaster, per the launch post) that became the story's central vulnerability.

Outcome

Within days of launch SushiSwap attracted hundreds of millions in staked Uniswap LP tokens (peaking above $1B, briefly making it one of the largest DeFi protocols by TVL). On September 5–6, 2020, Chef Nomi converted the dev fund's SUSHI (2.5M tokens) into ~38,000 ETH ($14M); SUSHI's price crashed amid fears the project was being abandoned. Under pressure, Chef Nomi transferred admin keys to Sam Bankman-Fried, who executed the migration on September 9, moving roughly $800M+ out of Uniswap (cutting Uniswap's liquidity by more than half at the time) and then handing control to a community-elected 9-person multisig. On September 11, Chef Nomi returned the full $14M in ETH, tweeting "I f**ked up." Uniswap answered on September 16 with the retroactive UNI airdrop and its own liquidity mining — a counter-vampire move that pulled much liquidity back. Long term, SushiSwap persisted as a genuine multi-product, multichain protocol (Onsen, BentoBox/Kashi, later leadership under 0xMaki and eventually a formal head chef), but it never overtook Uniswap and endured repeated governance and treasury crises. Verdict: partial_success — the attack itself worked spectacularly; durable market leadership did not follow.

Why it worked

• It weaponized a real gap. Uniswap LPs bore fees and impermanent loss with no ownership claim; SUSHI offered both yield and a share of protocol fees, so defecting was economically rational.
• Zero switching cost by construction. Staking existing Uniswap LP tokens meant participants risked nothing new upfront; the migration then moved everyone at once, solving the liquidity cold-start problem that kills most DEX forks.
• Timing. Launched at the peak of "DeFi summer" yield-farming mania, when four-digit APYs reliably summoned billions in mercenary capital within hours.
• Credible drama resolution. SBF's takeover, the multisig handover, and Nomi's returned $14M converted a likely death spiral into a legitimacy-building founding myth.

Where the design broke

• Centralized dev fund with no vesting or controls let one pseudonymous founder liquidate $14M and nearly destroy the project days before its critical migration.
• Mercenary liquidity is loyal to emissions, not protocols. When Uniswap launched UNI rewards a week later, much of the vampired liquidity flowed straight back; SUSHI's high inflation continually diluted holders.
• No durable moat. A fork's only defense is community and iteration speed; Uniswap V3's concentrated liquidity out-innovated Sushi on the core product, and Sushi's later years were marked by leadership churn and treasury runway crises rather than compounding advantage.

Lessons

• Token incentives can dissolve incumbent network effects — liquidity is not a moat if LPs can be paid to leave; the only defenses are switching costs, superior mechanisms, or your own token (Uniswap needed UNI within three weeks).
• Accepting a competitor's LP tokens as your staking asset is the cheapest possible user-acquisition funnel, and a migration contract turns that funnel into a one-shot mass exodus.
• Any founder-controlled fund is a rug until proven otherwise: vesting, timelocks, and multisigs on privileged funds/roles are not decoration — Sushi's crisis was caused entirely by their absence, not by contract exploits.
• Retroactive counter-incentives work: Uniswap's airdrop showed the incumbent's rational response to a vampire attack is to distribute ownership fast, which arguably accelerated token-distribution norms across all of DeFi.
• Vampired TVL is a vanity metric; retained TVL after emissions normalize is the real result.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial hypothesis, not fact. A redesigned vampire attack would (1) put the dev fund behind a 6–24 month vesting schedule in a timelocked multisig from day one — the mechanism's near-death experience was purely a governance failure; (2) taper emissions against retention metrics (e.g., decaying rewards weighted toward LPs who remain post-migration, or lockup-boosted rewards à la later ve-token designs) to filter mercenary capital instead of renting it; (3) pre-commit the fee-share switch and treasury policy on-chain so the token's cash-flow claim is credible rather than discretionary; and (4) differentiate the product before the migration, not after — a fork that migrates liquidity into an identical AMM invites an incumbent counter-incentive it cannot outspend. The deeper hypothesis: vampire attacks are best understood as forced ownership-distribution events on incumbents, and an incumbent with an already well-distributed token may be largely immune.