SushiSwap began in 2020 as a fork of Uniswap that drained its liquidity with token incentives, and for a period it worked. What followed — a founder exit, a treasury crisis, three leadership changes, a legal restructuring and a router exploit — is one of the most instructive governance case studies in DeFi, and it explains why a protocol with such reach commands so little of the market.
Where it still matters
Sushi is deployed across dozens of chains, including small networks where Uniswap has no presence. For a user on such a chain, it may be the deepest available venue by default. It runs classic constant-product pools alongside v3-style concentrated liquidity, plus a lending product and a launchpad in various states of maintenance.
The 2023 exploit
In April 2023 a vulnerability in the RouteProcessor2 contract allowed an attacker to drain funds from users who had granted it approvals — roughly $3.3m in total, with a substantial portion later recovered. The contracts holding pool liquidity were not compromised; the loss fell on users with standing approvals, which is the same failure mode that makes approval hygiene the most important habit in DeFi.
Governance and viability
The protocol has cycled through leadership repeatedly, faced a public treasury shortfall in 2023, and restructured its legal entity in response to regulatory pressure. Development continues, and the protocol has survived where most 2020-era forks did not. But contributors, liquidity and volume have all drifted elsewhere, and there is no sign of that reversing.
Who should use SushiSwap
Users on chains where nothing better is deployed, and only after checking pool depth. On any major chain, Uniswap, Curve, Aerodrome or an aggregator will offer better execution with a cleaner record. If you have historical Sushi approvals from the 2021 cycle, revoke them.