The flaw in plain language
Deep inside the liquidity-math library lurked an unchecked integer overflow. By nudging that weakness the attacker could inflate the pool’s virtual reserves, then withdraw genuine tokens against phantom balances. Because the contract let several steps run inside one transaction, the entire exploit fit into a single block.
What was frozen
Validators on Sui reacted within minutes, halting suspicious transfers and freezing about $163 million of the stolen value. The remaining ± $60 million escaped before the net closed.
Cetus’ response blueprint
- Post-mortem first. Two days later the team laid out the bug line-by-line and took public blame.
- Make LPs whole. A reimbursement plan—funded partly by the Sui security fund—is now circulating for community vote.
- Audit, then relaunch. Halborn and Dedaub are re-auditing every contract; pools will reopen only after test-net trials with withdrawal caps.
Market ripple
SUI briefly slipped below $3.50 on the news, but clawed back most of the loss once the freeze and compensation plan were confirmed. Network TVL, however, remains down about 18 percent.
Takeaways for builders and users
- Third-party code isn’t “safe by default.” Open source still needs a fresh audit every release.
- One action, one critical step. Long atomic chains are catnip for attackers.
- Live on-chain monitoring pays. Catching the exploit fast is the reason two-thirds of the funds stayed put.
What’s next
- Validators will vote in early June on how to redistribute the frozen tokens to affected LPs.
- Cetus pools will stay offline until the new audits clear and hard limits on single-tx withdrawals are in place.
- The team is coordinating with exchanges and chain-analysis firms to trace the missing $60 million and prepare a civil claim.
Bottom line
Even “next-gen” blockchains can stumble over a classic overflow. While projects race to ship new features, basic math remains the soft spot attackers probe first. For anyone providing liquidity, the safest wager is still diversification—and a close eye on audit reports, not just juicy APR figures.
