How a Single Integer Overflow in Cetus Protocol Drained Million From Sui Liquidity Pools

The decentralized finance ecosystem suffered one of its most technically sophisticated exploits when Cetus Protocol, the largest concentrated liquidity DEX on the Sui blockchain, lost approximately $223 million to a vulnerability hidden in a widely-used math library. The attack demonstrated how a single flawed overflow check in low-level arithmetic can cascade through an entire protocol, emptying liquidity pools and destabilizing an entire blockchain ecosystem within minutes.

The Exploit Mechanics

The root cause traced back to a faulty function called checked_shlw in the open-source integer-mate u256 math library that Cetus relied upon for its Concentrated Liquidity Market Maker calculations. The function was designed to safely shift a 256-bit value left by 64 bits — a critical scaling operation used when converting between token amounts and liquidity positions in CLMM pools. However, the overflow condition was implemented incorrectly. Instead of rejecting any value with non-zero bits in the top 64 positions, the function used a comparison threshold that allowed certain values to pass through and get truncated during the shift operation.

The attacker exploited this with surgical precision. First, they used flash swaps to source temporary balances, executing the entire sequence atomically. They opened a concentrated liquidity position in an extremely narrow tick range — roughly 200 ticks wide — then triggered the add-liquidity path in a way that forced execution through the vulnerable u256 scaling branch. Because the overflow check failed, the protocol undercharged the required token deposit while simultaneously crediting a massively inflated liquidity amount. The attacker then called remove-liquidity, withdrawing real reserves against the artificially inflated position, repaid the flash swap component, and kept the remainder as profit. This sequence was repeated across multiple pools.

Affected Systems

The impact extended well beyond Cetus itself. Approximately $60 million was quickly bridged to Ethereum, while $162 million remained on Sui and was frozen through emergency validator coordination. The resulting liquidity vacuum was devastating: USDC liquidity practically disappeared, routing across the entire Sui ecosystem degraded, and token prices experienced extreme drawdowns within minutes. Protocols that depended on Cetus for price feeds and swap routing were effectively paralyzed.

Critically, the vulnerable integer-mate library was shared across multiple Sui ecosystem projects. Kriya, Momentum, and Bluefin were all reported as having related exposure to the same flawed math primitive, forcing emergency audits and patches across the ecosystem. This was not a single-protocol failure — it was a shared-library vulnerability that threatened every project using the same code.

The Mitigation Strategy

Cetus paused affected contracts immediately to prevent further extraction. In parallel, Sui validators coordinated an unprecedented emergency action to block attacker-controlled addresses at the network level. This on-chain intervention preserved the majority of stolen funds that had not yet been bridged out. The Sui community then conducted an on-chain governance vote to reclaim the frozen assets, with validators representing 90.9% of stake voting in favor. Recovered funds were moved to a multisig trust account for redistribution to affected users.

The incident prompted a broader ecosystem hardening effort. Shared math libraries across the Move ecosystem received emergency audits, and protocols were advised to implement independent verification of critical arithmetic operations rather than relying solely on shared dependencies.

Lessons Learned

First, shared library vulnerabilities represent systemic risk that multiplies damage exponentially. A single flawed function in integer-mate threatened every protocol using it, not just Cetus. Second, overflow checks in fixed-point arithmetic require extreme scrutiny — the difference between a correct and incorrect threshold check is the difference between a secure protocol and a nine-figure loss. Third, the speed of response matters enormously. Sui validators freezing funds within hours prevented the attacker from bridging out the full amount. Fourth, concentrated liquidity designs amplify the impact of arithmetic bugs because of the complex math involved in tick-based position management.

User Action Required

Users who held positions in Cetus Protocol pools should verify whether they are eligible for reimbursement through the community recovery process. Developers building on any blockchain should audit all shared math libraries in their dependency tree, paying particular attention to fixed-point scaling operations and overflow guards. Projects using the integer-mate library or similar u256 utilities should implement independent mathematical verification of critical code paths. With Bitcoin trading around $77,800 and the broader crypto market holding significant value, the incentive for sophisticated attacks continues to grow, making rigorous security practices non-negotiable.

Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always conduct your own research before engaging with any DeFi protocol.