On May 22, something alarming happened in the SUI blockchain world. Prices on the Cetus decentralized exchange (DEX) suddenly dropped, and its liquidity pools were drained. The total estimated loss was over $230 million.
That’s when SlowMist, a well-known blockchain security team, stepped in and launched an analysis of what they uncovered was both shocking and technical.
What’s the Real Problem?
According to SlowMist’s deep dive analysis, the core of the issue was a vulnerability in Cetus’ smart contract code, specifically, a function called checked_shlw that failed to properly detect an overflow in another function named get_delta_a.
Now, what actually mean in simple terms?
This bug caused the system to calculate token amounts incorrectly. It didn’t realize when the numbers got too big, so it assumed the attacker was adding a huge amount of liquidity, when in reality, they only added 1 token.
That tiny flaw gave the attacker a massive opportunity.
How the Attacker Took Advantage
Here’s how the attacker carried out the exploit, step by step:
Flash Loan Trigger: The attacker borrowed over 10 million haSUI tokens using a flash loan. This move caused the token price in the pool to drop by 99.9%.
Trick Setup: They then created a very narrow liquidity position — a tiny window in the price range — which made the system believe a huge amount of liquidity was being added.
The Exploit: Using the overflow flaw, they claimed to add trillions worth of liquidity, but only submitted 1 token. The contract didn’t catch the mismatch.
Cashing Out: The attacker removed the fake liquidity in three stages and repaid the flash loan.
Huge Profit: They walked away with 10 million haSUI and 5.7 million SUI, with almost no real investment.
SlowMist Warning To Defi Developers
This incident shows how a small coding mistake can lead to huge financial losses, especially in DeFi platforms where smart contracts run everything.
According to SlowMist, if a critical function like checked_shlw doesn’t correctly detect errors like overflows, attackers can break the system logic entirely.
SlowMist warns all DeFi developers to double-check their math functions, especially in areas involving token calculations and liquidity formulas. One unchecked line of code was all it took to let someone walk away with millions.
