SushiSwap approval bug leads to $3.3 million exploit