A complete analysis of Sushi liquidity mining data: SushiSwap’s whales and thieves

Original title: "SushiSwap Farming Analysis"

Original source: Nanse, Akshay Ramasubramanian

Original translation: 0x26

Note: This article is a liquidity mining analysis report sponsored by SushiSwap and written by Nansen. As of now, SushiSwap's new UI v1.0.1 has been launched. The BUG (thief) section can be moved to the last section of the mysterious SushiBar.

Full text abstract

This article analyzes SushiSwap’s liquidity providers and how they handle the mined SUSHI tokens.

The first choice for mining SUSHI tokens is SushiBar, and the largest one is the SUSHI-WETH pool of SushiSwap. Cream and Uniswap are other preferred choices for obtaining SushiShi.

The Nansen team also noticed some vulnerabilities in the SushiBar contract, which will be discussed in depth later.

introduction

SushiSwap is a decentralized AMM (automated market making) trading platform based on Ethereum.

In this article, we will take a deep dive into SushiSwap and focus on three main things:

1. Liquidity providers: Identify liquidity providers and see how they handle the mined SUSHI tokens.

2. Liquidity providers in different pools, especially Uniswap, Balancer and Cream.

3. Based on the data from previous research, delve into some interesting things about SushiBar.

Liquidity Provider Behavior

Number of SushiSwap liquidity providers

As of the time of writing, there are approximately 10,176 unique wallet addresses providing liquidity to SushiSwap. These are different Ethereum addresses that interact with the Sushi liquidity pool and lock two tokens in order to receive Sushi Liquidity Pool Tokens, SLP tokens that are a token for providing liquidity to the protocol. Note that these addresses are not necessarily staking their SLP tokens.

Number of liquidity providers per pool

If we analyze the previous data carefully by the number of LPs providing liquidity to each pool, we can come up with a simple data summary table.

Most LPs (66.2%) provide liquidity for only one liquidity pool. Only a small number of LPs, accounting for about 4.2%, provide liquidity for more than 5 addresses.

Tags can help us identify well-known addresses that provide liquidity. These tags also include ENS domains registered by users. Digging deeper into the tags of each limited partner in Figure 2 below, we notice that most of the tags have Dex Trader. All of this means that these addresses frequently trade on decentralized exchanges (DEX).

We also found prominent addresses that are well known to the community, such as SBF (17 pools) and boringcrypto.eth (15 pools). Ok, keeping this in mind, let’s continue our analysis.

Based on this, it’s fair to assume that these addresses will appear again when we look at returns per LP or total liquidity locked per LP as they appear to interact with multiple pools.

What percentage of total liquidity do LPs account for?

In this section, we will look at the total liquidity provided by LPs. We will focus on all transfers (ETH and tokens) from LP addresses to SushiSwap pools to calculate the total liquidity of each LP. Note that if an LP provides $10,000 of liquidity to the SUSHI-WETH pool, withdraws it a few days later, and then repeats the same process, this will be counted as 20k in the total liquidity.

From the image below we can see that the most eye-catching tags are Alameda and Three Arrows Capital, both of which provide more than $35 million in liquidity. Note that this is not the SBF MultiSigner address from Alameda that we mentioned in the previous section. This may mean that Alameda appears to use multiple wallets to interact with SushiSwap.

Most of these addresses have the label Heavy Dex Trader. This means these addresses have made more than 500 trades on DEX.

To better understand the distribution, we can plot a histogram. We divide all the liquidity into several groups, which makes things much simpler. The figure below shows the total liquidity range in USD and the percentage of LPs that fall into this category.

From this, it can be clearly seen that for a long time, most LPs (70.9%) provided liquidity between $100-100,000. Some LPs provided liquidity between $100,000-1,000,000. Finally, only about 2.6% provided liquidity of more than $1 million.

How many LPs are providing liquidity elsewhere?

As you can see, the majority (40%+) of SushiSwap LPs also provide liquidity to Uniswap. Surprisingly, a large portion (24.2%) also provide liquidity to Balancer. A similar percentage (22.5%) of addresses only provide liquidity to SushiSwap.

This is interesting because one might have expected that most of SushiSwap’s LPs already provide liquidity elsewhere and would be interested in moving due to higher annual yields on other platforms, but based on the data, it appears that a significant portion of users (22.5%) only provide liquidity to SushiSwap.

Note that since we only focus on Cream, Balancer, Uniswap, and SushiSwap in this section, these users may be interacting with some other protocols that we are not aware of.

What is the distribution of SUSHI tokens per address?

About 11.9% of the addresses have mined 1,000 to 10,000 SUSHI. Only a few (2.9%) have mined more than 10,000 SUSHI. Most (68.5%) have mined 10 to 1,000 SUSHI.

Using the Nansen tag, we dig deeper into the addresses of these SUSHI farmers to see if we can find anything interesting.

In the table above, we can see that Alameda is one of the largest “farmers”. Although the SBF MultiSigner address and boringcrypto.eth appear to provide liquidity to most pools, the same address does not appear in the top 35 list above. (SBF is the CEO of Alameda and may just use multiple different wallets, as the Nansen tag appears to use multiple addresses labeled Alameda)

It is worth noting that there are a few addresses that seem to have received a lot of rewards from SushiBar liquidity mining. You might think that all the addresses that have made a lot of money belong to MasterChef (Lytonic Note, add link) who mined SUSHI tokens in the early days, but from the table above, you can see that this is wrong. Compared with MasterChef, several "farmers" are producing more tokens with SushiBar.

MasterChef uses locked SLP tokens (liquidity tokens) to mine SUSHI tokens, while SushiBar involves locking sushi. A more detailed explanation is here.

Note that if a user has not claimed SUSHI tokens on SushiBar, they will not appear in the analysis.

We’ll dive into this in more detail in the final section to discover what’s really going on here.

Where did the SUSHI tokens mined by LP go?

To determine this, we can again leverage Nansen’s tags. To get a more comprehensive picture, we can try to group all of the tags together to try to understand where most of the SUSHI tokens went.

Note that these amounts may be higher than the total supply of SUSHI, as it is the sum of each entity received by SushiSwap. Additionally, grouping the tags does not tell us the specific actions users are taking. Because they may either lock their tokens in SushiSwap or directly exchange them for other coins. A more detailed classification will be provided below so that we can distinguish these actions.

The best known places to mine SUSHI are SushiSwap (23.5%), Cream (18%), and Uniswap (16.4%).

If we look at centralized exchanges, Binance is first on the list, but only accounts for 3.6% compared to DeFi platforms (SushiSwap, Uniswap, and Cream), which received much more SUSHI.

We can look at the addresses where ENS names have been registered to see if anything interesting shows up. This is shown in the table below.

Here you can see some famous addresses in the Sushi community, such as zippoxer.eth.

To find out more about transfers to SushiSwap, especially the actions taken by users, and to dig deeper into more details, the following uses addresses and tags ranked in top positions rather than categorized by platform.

As you can see from the pie chart below, the majority of SUSHI tokens transferred to (29.7%) were to SushiBar. The second largest recipient was the SUSHI-WETH SushiSwap pool (22.8%). After diving into more details in this section, it appears that all of these transactions to the SUSHI-WETH pool were actually liquidity mining events, meaning they were actually LPs locking SUSHI + WETH in the liquidity pool.

The third largest is Cream, at 18.1%, which we’ll discuss in more detail in the next section.

We can summarize the above information and conclude that a large amount of SUSHI liquidity follows this path:

1. Lock SUSHI in SushiBar;

2. Increase liquidity for the SUHI-WETH pool;

3. Send LP tokens to Cream.

Mysterious SushiBar

As mentioned earlier, there are some addresses that are not MasterChef that received a large amount of SUSHI from SushiBar.

Digging deeper into these addresses, we noticed a series of really profitable transactions. Let’s take a look at more details of one of the top SushiBar liquidity mining addresses.

This externally owned account (EOA) appears to be moving in and out of SushiBar frequently and has made 10+ ETH in profit in less than 12 minutes of entering SushiBar. Below is a quick breakdown of what they are doing.

1. Get Sushi from Cream;

2. Stake Sushi to get xSushi (enter SushiBar);

3.12 minutes later;

4.xSushi gets Sushi (leaves);

5. Repay Sushi's loan at Cream;

6. Convert the obtained Sushi profits into WETH.

Let’s explore this issue in more detail using the number of tokens.

You can track these transactions by clicking on the Etherscan timestamps below.

1.Oct-06-2020 11:30:51 PM +UTC October 6 - 202011:30:51 PM + UTC: Call CreamFinance's "borrow" function to obtain 5,700,000 SUSHI tokens

2.Oct-06-2020 11:31:32 PM +UTC: By calling the contract, stake 5,700,000 SUSHI and get 5,479,364 XSUSHI.

3.Oct-06-2020 11:38:41 PM +UTC: 7 minutes and 7 seconds later, the leave function of SushiBar is called to change 5479364 XSUSHI into 5705876 SUSHI and leave.

4.Oct-06-2020 11:39:37 PM +UTC: Send SUSHI back to Cream, call the repayment contract, and repay 5700097 SUSHI loans (net profit is 5779SUSHI).

5.Oct-06-2020 11:42:49 PM +UTC: Convert all profits into WETH (5779 SUSHI into 10.8 WETH).

The wallet then repeated a similar action the next day. The first step of the coin transaction link is here. If we look closely, we can see that the time span is slightly different, from 10:46:51 on October 7, 2020 to 10:57:17 on October 7, 2020, UTC.

At first we thought there might be a spike in volume during that time, but looking more closely at the volume during that time, we found that only about 553 ETH equivalents were trading during that time, and this trader borrowed SUSHI, staked the tokens, and then exchanged them back to SUSHI.

In these 7 minutes, the theoretical reward number is about 5553.53 * 30bps * 5bps = 0.000083295 ETH. This is based on the rewards shown in the Sushi document.

This means that this EOA actually appears to be taking advantage of SushiBar and earning huge rewards. If we look at the source code of the SushiBar contract, it looks like anyone can call the convert function and distribute the rewards.

Let's try to get a more complete picture of SushiBar and see what the users actually gain.

From the chart above, we can see that jokap.eth seems to have received the most rewards from SushiBar. This is also the address that received rewards from SushiBar using Cream loans. Let’s split it into several groups to better understand the distribution.

Only a small number of addresses (0.18%) received more than 10,000 SUSHI from SushiBar, and most received 0-100 SUSHI tokens (94.8%).

After looking at the above vulnerability (if it can be defined as such), it seems necessary to rewrite the SushiBar logic to take into account the lock duration of the SUSHI token. It would make more sense to reward users who lock up SUSHI for a longer period of time (more blocks) compared to those who lock up SUSHI for fewer blocks. This would also make it harder for users to exploit the system (vulnerability) seen in the example above.