Advertise
Mustafa Mulla
Mustafa Mulla
Author
Mustafa has been writing about Blockchain and crypto since many years. He has previous trading experience and has been working in the Fintech industry since 2017.
- May 26, 2025 08:07 UTC
-
SlowMist Breaks Down How a Tiny Code Flaw Led to Cetus’ $230M Collapse
SlowMist confirmed bug in checked_shlw function was root cause of $230M DeFi loss.
Tiny overflow bug in Cetus smart contract allowed attacker to fake massive liquidity deposits.
Attacker used flash loan and narrow range trick to crash token price instantly.
On May 22, something alarming happened in the SUI blockchain world. Prices on the Cetus decentralized exchange (DEX) suddenly dropped, and its liquidity pools were drained. The total estimated loss was over $230 million.
That’s when SlowMist, a well-known blockchain security team, stepped in and launched an analysis of what they uncovered was both shocking and technical.
What’s the Real Problem?
According to SlowMist’s deep dive analysis, the core of the issue was a vulnerability in Cetus’ smart contract code, specifically, a function called checked_shlw that failed to properly detect an overflow in another function named get_delta_a.
Now, what actually mean in simple terms?
This bug caused the system to calculate token amounts incorrectly. It didn’t realize when the numbers got too big, so it assumed the attacker was adding a huge amount of liquidity, when in reality, they only added 1 token.
That tiny flaw gave the attacker a massive opportunity.
How the Attacker Took Advantage
Here’s how the attacker carried out the exploit, step by step:
Flash Loan Trigger: The attacker borrowed over 10 million haSUI tokens using a flash loan. This move caused the token price in the pool to drop by 99.9%.
Trick Setup: They then created a very narrow liquidity position — a tiny window in the price range — which made the system believe a huge amount of liquidity was being added.
The Exploit: Using the overflow flaw, they claimed to add trillions worth of liquidity, but only submitted 1 token. The contract didn’t catch the mismatch.
Cashing Out: The attacker removed the fake liquidity in three stages and repaid the flash loan.
Huge Profit: They walked away with 10 million haSUI and 5.7 million SUI, with almost no real investment.
SlowMist Warning To Defi Developers
This incident shows how a small coding mistake can lead to huge financial losses, especially in DeFi platforms where smart contracts run everything.
According to SlowMist, if a critical function like checked_shlw doesn’t correctly detect errors like overflows, attackers can break the system logic entirely.
SlowMist warns all DeFi developers to double-check their math functions, especially in areas involving token calculations and liquidity formulas. One unchecked line of code was all it took to let someone walk away with millions.
Never Miss a Beat in the Crypto World!
Stay ahead with breaking news, expert analysis, and real-time updates on the latest trends in Bitcoin, altcoins, DeFi, NFTs, and more.
FAQs
A bug in Cetus’ smart contract, specifically an overflow in the get_delta_a function undetected by checked_shlw, caused incorrect token calculations.
The attacker used a flash loan to drop prices, then exploited the overflow flaw to claim massive liquidity with minimal tokens, draining funds.
Yes 
No 
