SushiSwap’s big BitDAO token sale could have been stymied, but a researcher discovered the exploit before an attacker could.