Cetus Crashes for $230 Million: Small Code Error, Big Consequences

Dangerous On-Chain SUI Issue

On May 22, an alarming incident occurred in the SUI blockchain community. The price on the decentralized exchange Cetus suddenly dropped sharply, and liquidation pools were drained. The total estimated damage exceeded $230 million. SlowMist, a famous blockchain security team, investigated and discovered shocking details.

Core Cause

According to SlowMist's analysis, the problem lies in a vulnerability in Cetus's smart contract code, specifically the checked_shlw function that failed to detect overflow in the get_delta_a function. The system miscalculated Token quantities, confusing small and large amounts. This allowed attackers to exploit the loophole for massive profits.

Exploitation Method

The attacker implemented the attack through several steps:

1. Flash Loan: The attacker borrowed over 10 million haSUI Tokens, causing the Token price to drop 99.9%.

2. Setting a Trap: Creating a narrow liquidation position that makes the system believe a large amount of liquidity is being added.

3. Overflow Exploitation: Using the overflow vulnerability, they claimed to add liquidity of thousands of billions, but actually only added 1 Token.

4. Withdrawal and Profit: The attacker withdrew fake liquidity and repaid the loan, profiting with 10 million haSUI and 5.7 million SUI.

Warning to DeFi Developers

This incident shows that even a small programming error can lead to massive losses, especially on DeFi platforms. SlowMist warns DeFi developers to carefully check mathematical functions, especially those related to Token calculations and liquidity formulas. One inaccurate line of code can lead to serious consequences.