Sui chain's DEX Cetus Protocol was hacked two days ago. Although the Sui team quickly froze most of the stolen assets, how to safely and transparently repay users has become a decentralization debate.
Hacking Details
On May 22, Cetus Protocol was hacked, with estimated losses between $220 million and $260 million. The attack originated from a mathematical calculation flaw in the smart contract, allowing hackers to manipulate liquidity ratios using forged tokens. After the incident, Cetus collaborated with Sui developers and validators to quickly act, successfully freezing about $160 million of stolen assets on the Sui chain.
Asset Repayment Plan
To return the frozen funds, Cetus Protocol proposed a community voting plan aimed at safely repaying assets through protocol upgrades, avoiding on-chain record rollback or transaction cancellation. The Sui official expressed conditional support for this proposal, with the following stance:
Each validator has a profile that allows them to ignore transactions from specific addresses.
Whether to add an address to this profile is entirely up to each validator, and this setting can be revoked at any time.
More than one-third of the staking weight validators choosing to ignore transactions from two addresses suspected of being involved in the attack effectively froze those funds.
The ability of validators to ignore transactions from specific addresses is not unique to Sui - validators on any blockchain can choose to do so, whether for risk tolerance considerations or to comply with laws.
Cetus initiated a community vote to propose a protocol upgrade to return the frozen funds, without rolling back on-chain history or canceling transactions.
The Sui official will remain neutral on the voting results and forgo official voting rights.
Cetus must publicly commit to using all financial resources to recover assets until all users are fully compensated.
The Sui team views this as a contingency measure in a special situation to protect Cetus users' assets. Currently, Sui's co-founders have confirmed they will help repay the $160 million frozen funds to Cetus Protocol to restore liquidity and stabilize the SUI DeFi market.
Still Arguing about 'Decentralization'
The quick push to host a Cetus vote shows the Sui official's urgency to handle the crisis, but the validator blacklist has again sparked discussions about the blockchain's 'decentralization principle' among some community members. With Sui validators quickly freezing assets and potentially introducing a 'whitelist' mechanism for specific transactions in the future, some decentralization purists criticize this as an intervention of centralized power.
However, some community voices believe that recovering assets is the pragmatic approach. The hacking incident has already put short-term pressure on the Cetus Token and SUI token prices and affected market confidence in the Sui DeFi ecosystem. Saving money is like fighting a fire - how can one wait?
