💸 $230M Poof! 🚨

by

It was a dark day, May 22nd, in the wild west of the SUI blockchain. The sun was setting, and the prices on the Cetus decentralized exchange (DEX) were plummeting like a cowboy’s hat in a gust of wind. The liquidity pools were drained, and the total estimated loss was a whopping $230 million. 🤑

That’s when the cavalry, SlowMist, a well-known blockchain security team, rode into town and launched an analysis of what they uncovered was both shocking and technical. It was like finding a rattlesnake in your boot – you don’t expect it, but it’s there, waiting to strike.

The Root of All Evil

According to SlowMist’s deep dive analysis, the core of the issue was a vulnerability in Cetus’ smart contract code, specifically, a function called checked_shlw that failed to properly detect an overflow in another function named get_delta_a. It’s like a tiny crack in a dam, but eventually, the whole thing comes crashing down.

the bug caused the system to calculate token amounts incorrectly. It didn’t realize when the numbers got too big, so it assumed the attacker was adding a huge amount of liquidity, when in reality, they only added 1 token. It’s like thinking you’re rich because you found a penny on the ground.

That tiny flaw gave the attacker a massive opportunity, like a key to the kingdom.

The Heist

Here’s how the attacker carried out the exploit, step by step:

Flash Loan Trigger: The attacker borrowed over 10 million haSUI tokens using a flash loan. This move caused the token price in the pool to drop by 99.9%. It’s like a bank heist, but instead of guns and masks, they used code and cunning.

Trick Setup: They then created a very narrow liquidity position — a tiny window in the price range — which made the system believe a huge amount of liquidity was being added. It’s like setting up a trap, waiting for the perfect moment to strike.

The Exploit: Using the overflow flaw, they claimed to add trillions worth of liquidity, but only submitted 1 token. The contract didn’t catch the mismatch. It’s like a magic trick, where the attacker makes the money disappear.

Cashing Out: The attacker removed the fake liquidity in three stages and repaid the flash loan. It’s like a getaway car, speeding away from the scene of the crime.

Huge Profit: They walked away with 10 million haSUI and 5.7 million SUI, with almost no real investment. It’s like winning the lottery, but instead of luck, they used brains and code.

A Warning to DeFi Developers

This incident shows how a small coding mistake can lead to huge financial losses, especially in DeFi platforms where smart contracts run everything. It’s like a ticking time bomb, waiting to go off.

According to SlowMist, if a critical function like checked_shlw doesn’t correctly detect errors like overflows, attackers can break the system logic entirely. It’s like a house of cards, waiting to be knocked down.

SlowMist warns all DeFi developers to double-check their math functions, especially in areas involving token calculations and liquidity formulas. One unchecked line of code was all it took to let someone walk away with millions. It’s like a wake-up call, a reminder to always be vigilant.

Read More

2025-05-26 11:25