Briefing
The Cetus Protocol, a major concentrated liquidity Automated Market Maker (AMM) on the Sui network, was compromised via a sophisticated integer overflow exploit. This critical vulnerability in the core liquidity calculation function led to an immediate liquidity drain, causing severe price volatility for the CETUS and SUI tokens and disrupting integrated DApps across the ecosystem. The attack vector leveraged a flash loan to manipulate the contract’s state, resulting in an estimated total loss of $223 million, of which approximately $162 million was subsequently frozen by Sui validators.
Context
The prevailing risk in concentrated liquidity AMMs centers on the extreme complexity of their internal mathematical logic, where large-integer precision is paramount for maintaining protocol invariants. Prior to this event, the security posture of many new-generation DEXs was challenged by a reliance on complex, unaudited, or insufficiently tested arithmetic functions, making them susceptible to manipulation via flash loans and edge-case inputs. This incident specifically highlights the risk of custom arithmetic functions in newer smart contract languages like Move.
Analysis
The attack vector leveraged a flaw in the checked_shlw operation, a custom function intended to prevent integer overflow during liquidity calculations. By utilizing a flash loan and opening a position within an extremely narrow price range, the attacker provided a minimal token input that, due to a faulty overflow check, triggered an arithmetic error in the internal calculation. This overflow caused the system to assign a massive, unbacked amount of liquidity to the attacker’s position, which was then immediately redeemed for real assets, effectively draining the protocol’s pools in a single, atomic transaction chain.
Parameters
- Total Value Lost → $223 Million USD – The estimated total value of assets drained from the concentrated liquidity pools.
- Vulnerability Type → Integer Overflow – A critical arithmetic error in the smart contract’s liquidity calculation function.
- Funds Frozen → $162 Million USD – The amount of stolen assets successfully frozen by the Sui validator set post-exploit.
- Affected Protocol Type → Concentrated Liquidity AMM – A decentralized exchange utilizing complex, tick-based pricing logic.
Outlook
Immediate mitigation requires all protocols utilizing complex, concentrated liquidity mathematics to conduct a zero-tolerance audit of all arithmetic operations, specifically focusing on integer boundary conditions and overflow checks. The primary second-order effect is a renewed scrutiny of the Move smart contract language’s native overflow protections and the centralized power of validator sets to freeze funds. This incident establishes a new security best practice mandating formal verification of all core AMM invariant logic before deployment to prevent mathematical edge-case exploitation.
Verdict
This catastrophic loss confirms that fundamental arithmetic flaws in concentrated liquidity AMMs remain the single greatest systemic risk to the DeFi ecosystem, necessitating immediate, rigorous formal verification.
