News View Non-AMP

SlowMist Breaks Down How a Tiny Code Flaw Led to Cetus’ $230M Collapse

Published by
Mustafa Mulla

On May 22, something alarming happened in the SUI blockchain world. Prices on the Cetus decentralized exchange (DEX) suddenly dropped, and its liquidity pools were drained. The total estimated loss was over $230 million.

That’s when SlowMist, a well-known blockchain security team, stepped in and launched an analysis of what they uncovered was both shocking and technical.

What’s the Real Problem?

According to SlowMist’s deep dive analysis, the core of the issue was a vulnerability in Cetus’ smart contract code, specifically, a function called checked_shlw that failed to properly detect an overflow in another function named get_delta_a.

Now, what actually mean in simple terms?

This bug caused the system to calculate token amounts incorrectly. It didn’t realize when the numbers got too big, so it assumed the attacker was adding a huge amount of liquidity, when in reality, they only added 1 token.

That tiny flaw gave the attacker a massive opportunity.

How the Attacker Took Advantage

Here’s how the attacker carried out the exploit, step by step:

Flash Loan Trigger: The attacker borrowed over 10 million haSUI tokens using a flash loan. This move caused the token price in the pool to drop by 99.9%.

Trick Setup: They then created a very narrow liquidity position — a tiny window in the price range — which made the system believe a huge amount of liquidity was being added.

The Exploit: Using the overflow flaw, they claimed to add trillions worth of liquidity, but only submitted 1 token. The contract didn’t catch the mismatch.

Cashing Out: The attacker removed the fake liquidity in three stages and repaid the flash loan.

Huge Profit: They walked away with 10 million haSUI and 5.7 million SUI, with almost no real investment.

SlowMist Warning To Defi Developers

This incident shows how a small coding mistake can lead to huge financial losses, especially in DeFi platforms where smart contracts run everything. 

According to SlowMist, if a critical function like checked_shlw doesn’t correctly detect errors like overflows, attackers can break the system logic entirely.

SlowMist warns all DeFi developers to double-check their math functions, especially in areas involving token calculations and liquidity formulas. One unchecked line of code was all it took to let someone walk away with millions.

FAQs

What caused the Cetus DEX exploit?

A bug in Cetus’ smart contract, specifically an overflow in the get_delta_a function undetected by checked_shlw, caused incorrect token calculations.

How did the attacker exploit Cetus DEX?

The attacker used a flash loan to drop prices, then exploited the overflow flaw to claim massive liquidity with minimal tokens, draining funds.

Mustafa Mulla

Mustafa has been writing about Blockchain and crypto since many years. He has previous trading experience and has been working in the Fintech industry since 2017.

Recent Posts

Bitcoin Price Tumbles While Fed Rates Remain Flat—Opportunity or Red Flag?

Ever since the Fed's rates were slashed below 5% back in October 2024, they have…

July 31, 2025

Bitcoin (BTC) Price Falters as Fed and BoC Hold Interest Rates Steady

Bitcoin (BTC) price has gradually lost its initial July bullish momentum during the past three…

July 31, 2025

Solana Enters a Crucial Zone: Here’s When the SOL Price May Hit a New ATH Above $300

Solana (SOL) is navigating a pivotal market phase as it hovers near a critical resistance…

July 31, 2025

Fed Holds Interest Rates Steady, Citing Trump’s Tariffs Despite Push for Cuts

The Federal Reserve has decided to keep its key interest rate steady at around 4.25%-4.5%,…

July 31, 2025

This Altcoin is at the Foothill of a Massive Explosion—Will it Follow Bitcoin & Smash a New ATH in 2025?

Litecoin (LTC) price has shown renewed momentum in recent sessions, staging a steady upward move…

July 30, 2025

Pump.fun (PUMP) Price Prediction: Can Solana Memecoin Rebound Toward $0.004 in 2025?

Pump.fun’s native token, PUMP coin, is currently trading near $0.0026, following a volatile post-ICO phase.…

July 30, 2025