{"investigation":{"slug":"super-sushi-samurai","entity_name":"Super Sushi Samurai","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Super Sushi Samurai (SSS) is a Telegram-based blockchain game launched on the Blast layer-2 network in March 2024. On March 21, 2024 — four days after launch — a critical infinite-mint vulnerability in the SSS token contract was exploited, draining approximately $4.6–4.8 million (1,310 ETH) from its liquidity pool and causing the token to lose over 99% of its value. The attacker claimed to be a white-hat actor, and most funds were returned minus a 5% bounty; however, approximately 40 ETH were separately stolen by a distinct black-hat actor and the failed audit by Verichains raises material security governance concerns.","sections":[{"content":"On March 21, 2024, at approximately 19:45 UTC, a critical flaw in the Super Sushi Samurai (SSS) token contract on the Blast network was exploited. The vulnerability resided in the token's transfer function: when a user transferred their entire balance to their own address (i.e., sender and recipient were identical), the contract's internal accounting failed to deduct the outgoing amount before crediting the incoming amount, effectively doubling the holder's balance with each self-transfer. An attacker (contract: 0xDed85d83Bf06069c0bD5AA792234b5015D5410A9; address: 0x6a89a8c67b5066d59bf4d81d59f70c3976facd0a) began with approximately $35 in SSS tokens, executed the self-transfer loop 25 times to inflate their balance to approximately 11.5 trillion SSS tokens, then sold the entire inflated position into the liquidity pool, extracting approximately 1,310 ETH (valued at roughly $4.6–4.8 million at the time). The SSS token price collapsed by over 99% within the exploit window. The Blast network's own prior audit of the contract by Verichains failed to detect the vulnerability before deployment. Notably, an identical exploit had been used against a token called MINER just one month prior, making the miss by Verichains especially significant.","heading":"Smart Contract Exploit — Infinite Mint Vulnerability","sources":[{"url":"https://blockapex.io/super-sushi-samurai-hack-analysis/","name":"blockapex.io","type":"other","credibility":3},{"url":"https://protos.com/crypto-game-exploited-for-4-6m-hacker-claims-to-be-white-hat/","name":"protos.com","type":"other","credibility":3},{"url":"https://rekt.news/sss-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2024/03/21/newly-issued-gaming-token-exploited-on-blast-with-46m-drained","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=super-sushi-samurai-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the attacker contacted the Super Sushi Samurai team via an on-chain message on BlastScan, stating: 'Hi team, this is a whitehat rescue hack. Let's work on reimbursing the users.' The team confirmed they were 'in touch with the exploiter' and paused token transfers during investigation. The Super Sushi Samurai team later confirmed that the majority of funds were returned. The team elected to reward the white-hat actor with a 5% bounty in ETH and an additional 2.5% in SSS tokens and in-game land, and subsequently brought them on as a technical adviser to the project. However, a separate black-hat actor stole approximately 40.28 ETH during the same window, and those funds were not recovered. The white-hat framing is unverified by any independent third party and relies solely on the attacker's own on-chain statement and the project team's acceptance of that framing.","heading":"White-Hat Rescue Claim and Fund Recovery","sources":[{"url":"https://x.com/SSS_HQ/status/1771168070054375596","name":"x.com","type":"other","credibility":3},{"url":"https://decrypt.co/222833/ethereum-game-blast-suffers-4-6-million-hack-white-hat","name":"decrypt.co","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/white-hat-hacker-offers-to-reimburse-users-after-4-6-million-exploit/","name":"unchainedcrypto.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=super-sushi-samurai-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://protos.com/crypto-game-exploited-for-4-6m-hacker-claims-to-be-white-hat/","name":"protos.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Super Sushi Samurai's smart contract was audited by Verichains prior to deployment. The audit failed to identify the infinite-mint vulnerability in the transfer function — a flaw that had already been exploited against at least one other token (MINER) approximately one month before the SSS launch. Security researchers at Rekt News and Protos noted that this represented a significant failure of the auditing process. The missed vulnerability raises questions about the thoroughness of the pre-launch security review and about the adequacy of the project team's own internal code review. Verichains has not issued a public post-mortem addressing the missed vulnerability as of available reporting.","heading":"Audit Failure by Verichains","sources":[{"url":"https://rekt.news/sss-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://protos.com/crypto-game-exploited-for-4-6m-hacker-claims-to-be-white-hat/","name":"protos.com","type":"other","credibility":3},{"url":"https://blockapex.io/super-sushi-samurai-hack-analysis/","name":"blockapex.io","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/supersushisamuraimintingexploit.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The SSS token launched on approximately March 17, 2024, on the Blast layer-2 network and had a pre-exploit market capitalization of approximately $27.75 million. At its all-time high on March 21, 2024, SSS reached approximately $0.00000004995. Following the exploit and subsequent liquidity drain, the token price fell by more than 99%. As of early 2025, the token traded at approximately $0.000000001978, representing a near-total loss of value for holders. The total token supply is 555.56 trillion SSS tokens. The project continues to operate under the branding 'Super Sushi Samurai Reloaded' with an expected application relaunch in early 2026, accompanied by a token migration: holders were instructed to burn SSS tokens by sending them to a burn address in exchange for future airdrop eligibility under a new token (SSR), with a migration deadline extended to November 30, 2025.","heading":"Token Economics and Market Impact","sources":[{"url":"https://www.cryptopolitan.com/super-sushi-samurai-exploited-for-4-6m/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/super-sushi-samurai-token-crashes-by-99-after-critical-exploit/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://cryptorank.io/price/super-sushi-samurai","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://x.com/sss_hq?lang=en","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Super Sushi Samurai is a social strategy idle game designed to be played on Telegram and powered by the Blast layer-2 network. The project is built by the same team behind Crabada, a prior blockchain game. The project claims to implement a 'fair launch' model with no pre-mining or private sales, distributing tokens exclusively through gameplay and public participation. The team's identities are not publicly disclosed in available reporting. The project's official channels are operated under the handle @SSS_HQ on X (formerly Twitter). Following the exploit, the white-hat actor who performed the alleged rescue was recruited as a technical adviser.","heading":"Project Background and Team","sources":[{"url":"https://docs.sss.game/quick-info/about-super-sushi-samurai","name":"docs.sss.game","type":"other","credibility":3},{"url":"https://dappradar.com/dapp/super-sushi-samurai-sss","name":"dappradar.com","type":"other","credibility":3},{"url":"https://www.bitrue.com/blog/super-sushi-samurai-airdrop-earn-sss-tokens","name":"bitrue.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The SSS Reloaded token migration requires holders to irreversibly burn their SSS tokens by sending them to a burn address, in exchange for future airdrop eligibility under a replacement token. No independent escrow or third-party verification of this migration process has been identified in available reporting. The project's token currently trades at near-zero prices with very low liquidity. The combination of a prior critical exploit, anonymous team, near-zero token value, and a migration requiring users to permanently destroy existing tokens represents elevated risk for any current or prospective holders. No regulatory actions against the project have been identified in available sources.","heading":"Ongoing Project Risks","sources":[{"url":"https://x.com/sss_hq?lang=en","name":"x.com","type":"other","credibility":3},{"url":"https://cryptorank.io/price/super-sushi-samurai","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-03-17","event":"Super Sushi Samurai (SSS) token launches on the Blast layer-2 network with a market cap of approximately $27.75 million.","source":""},{"date":"2024-03-21","event":"An attacker exploits an infinite-mint vulnerability in the SSS token contract, draining approximately 1,310 ETH ($4.6–4.8 million) from the liquidity pool. The SSS token price drops over 99%.","source":""},{"date":"2024-03-21","event":"The attacker contacts the Super Sushi Samurai team via on-chain message, claiming the exploit was a 'whitehat rescue hack' and offering to work on reimbursement.","source":""},{"date":"2024-03-21","event":"A separate black-hat actor steals approximately 40.28 ETH during the same exploit window; those funds are not recovered.","source":""},{"date":"2024-03-22","event":"The Super Sushi Samurai team confirms they are in contact with the alleged white-hat exploiter and are working toward fund recovery.","source":""},{"date":"2024-03-22","event":"Super Sushi Samurai team announces funds are 'safu,' confirming a positive outcome. The white-hat actor is awarded a 5% ETH bounty and 2.5% in SSS tokens and in-game land, and is brought on as technical adviser.","source":""},{"date":"2025-05-13","event":"SSS Reloaded announces migration of protocol-owned liquidity in ETH to Ethereum mainnet; holders begin burn-for-airdrop migration process.","source":""},{"date":"2025-11-30","event":"Extended deadline for SSS-to-SSR token burn migration.","source":""}],"sources_used":[{"url":"https://blockapex.io/super-sushi-samurai-hack-analysis/","name":"blockapex.io","type":"other","archive_url":"http://web.archive.org/web/20260413235324/https://blockapex.io/super-sushi-samurai-hack-analysis/","credibility":3,"archive_timestamp":"2026-04-13T23:53:24+00:00"},{"url":"https://protos.com/crypto-game-exploited-for-4-6m-hacker-claims-to-be-white-hat/","name":"protos.com","type":"other","archive_url":"http://web.archive.org/web/20260611002533/https://protos.com/crypto-game-exploited-for-4-6m-hacker-claims-to-be-white-hat/","credibility":3,"archive_timestamp":"2026-06-11T00:25:33+00:00"},{"url":"https://rekt.news/sss-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260322055932/https://rekt.news/sss-rekt","credibility":3,"archive_timestamp":"2026-03-22T05:59:32+00:00"},{"url":"https://www.coindesk.com/business/2024/03/21/newly-issued-gaming-token-exploited-on-blast-with-46m-drained","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251116185326/https://www.coindesk.com/business/2024/03/21/newly-issued-gaming-token-exploited-on-blast-with-46m-drained","credibility":3,"archive_timestamp":"2025-11-16T18:53:26+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=super-sushi-samurai-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260413104146/https://www.web3isgoinggreat.com/?id=super-sushi-samurai-exploit","credibility":3,"archive_timestamp":"2026-04-13T10:41:46+00:00"},{"url":"https://x.com/SSS_HQ/status/1771168070054375596","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://decrypt.co/222833/ethereum-game-blast-suffers-4-6-million-hack-white-hat","name":"decrypt.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://unchainedcrypto.com/white-hat-hacker-offers-to-reimburse-users-after-4-6-million-exploit/","name":"unchainedcrypto.com","type":"other","archive_url":"https://web.archive.org/web/20260829184905/https://unchainedcrypto.com/white-hat-hacker-offers-to-reimburse-users-after-4-6-million-exploit/","credibility":3,"archive_timestamp":"2026-08-29T18:49:05+00:00"},{"url":"https://www.quadrigainitiative.com/hackfraudscam/supersushisamuraimintingexploit.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260829152927/https://www.quadrigainitiative.com/hackfraudscam/supersushisamuraimintingexploit.php","credibility":3,"archive_timestamp":"2026-08-29T15:29:27+00:00"},{"url":"https://www.cryptopolitan.com/super-sushi-samurai-exploited-for-4-6m/","name":"cryptopolitan.com","type":"other","archive_url":"https://web.archive.org/web/20260830005000/https://www.cryptopolitan.com/super-sushi-samurai-exploited-for-4-6m/","credibility":3,"archive_timestamp":"2026-08-30T00:50:00+00:00"},{"url":"https://cryptonews.com/news/super-sushi-samurai-token-crashes-by-99-after-critical-exploit/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cryptorank.io/price/super-sushi-samurai","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260830042212/https://cryptorank.io/price/super-sushi-samurai","credibility":3,"archive_timestamp":"2026-08-30T04:22:12+00:00"},{"url":"https://x.com/sss_hq?lang=en","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://docs.sss.game/quick-info/about-super-sushi-samurai","name":"docs.sss.game","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://dappradar.com/dapp/super-sushi-samurai-sss","name":"dappradar.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.bitrue.com/blog/super-sushi-samurai-airdrop-earn-sss-tokens","name":"bitrue.com","type":"other","archive_url":"https://web.archive.org/web/20260830045148/https://www.bitrue.com/blog/super-sushi-samurai-airdrop-earn-sss-tokens","credibility":3,"archive_timestamp":"2026-08-30T04:51:48+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:34.13701+00:00","updated_at":"2026-08-30T05:14:08.211656+00:00"}}