Background
On May 22nd, according to community information, Cetus, a liquidity provider on the Sui ecosystem, was allegedly attacked, with a significant drop in liquidity pool depth, and multiple token trading pairs on Cetus experiencing a decline, with estimated losses exceeding $230 million. Subsequently, Cetus issued an announcement stating: "We have detected an incident in our protocol, and for safety reasons, the smart contract has been temporarily suspended. Currently, the team is investigating the event. We will soon release a further investigation statement."
After the incident, the SlowMist security team immediately intervened for analysis and issued a security alert. Below is a detailed analysis of the attack method and fund transfer.
Related Information
One of the attack transactions:https://suiscan.xyz/mainnet/tx/DVMG3B2kocLEnVMDuQzTYRgjwuuFSfciawPvXXheB3x
Attacker's address:0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06
Attacked pool address:0x871d8a227114f375170f149f7e9d45be822dd003eba225e83c05ac80828596bc
Involved tokens:haSUI / SUI
Attack Analysis
The core of this event is that the attacker carefully constructed parameters to cause an overflow while bypassing detection, ultimately using an extremely small Token amount to exchange for massive liquidity assets. Here is a detailed step-by-step analysis:
1. The attacker first borrowed 10,024,321.28 haSUI through a flash loan, causing the pool price to plummet from 18,956,530,795,606,879,104 to 18,425,720,184762886, a price drop of 99.90%.
2. The attacker carefully selected an extremely narrow price range to open a liquidity position: Tick lower limit: 300000 (price: 60,257,519,765,924,248,467,716,150) Tick upper limit: 300200 (price: 60,863,087,478,126,617,965,993,239) Price range width: Only 1.00496621%
3. Then comes the core of this attack: the attacker declared to add 10,365,647,984,364,446,732,462,244,378,333,008 units of massive liquidity, but due to a vulnerability, the system only collected 1 token A.
Let's analyze why the attacker could exchange massive liquidity with 1 Token. The core reason is that there is an overflow detection bypass vulnerability in the checked_shlw function of get_delta_a. The attacker precisely exploited this point, causing the system to severely deviate when calculating how many haSUI actually need to be added. Due to the undetected overflow, the system misjudged the required amount of haSUI, allowing the attacker to exchange massive liquidity assets with extremely few Tokens.
[The rest of the translation follows the same detailed and precise approach, maintaining the technical language and structure of the original text.]
Fortunately, according to Cetus, in cooperation with the SUI Foundation and other ecosystem members, they have successfully frozen $162 million of stolen funds on SUI.
Next, we use the on-chain anti-money laundering and tracking tool MistTrack to analyze the address 0x89012a55cd6b88e407c9d4ae9b3425f55924919b that received cross-chain funds on EVM. This address received 5.2319 BNB on BSC and has not transferred it out yet:
The address received 3,000 USDT, 40.88 million USDC, 1,771 SOL, and 8,130.4 ETH on Ethereum. Among them, USDT, USDC, and SOL were exchanged for ETH through platforms like coW Swap and ParaSwap:
Then, the address transferred 20,000 ETH to the address 0x0251536bfcf144b88e1afa8fe60184ffdb4caf16, which has not transferred it out yet:
Currently, the address's balance on Ethereum is 3,244 ETH:
MistTrack has added the above-related addresses to its malicious address library, and we will continue to monitor the address balances.
Summary
This attack demonstrated the power of a mathematical overflow vulnerability. The attacker precisely calculated and selected specific parameters, exploiting the defect in the checked_shlw function to obtain liquidity worth billions at the cost of just one token. This was an extremely precise mathematical attack, and the SlowMist security team recommends that developers strictly verify the boundary conditions of all mathematical functions during smart contract development.
Welcome to join the BlockBeats official community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Twitter Official Account: https://twitter.com/BlockBeatsAsia
