Author: Victory & Lisa
Background
On May 22, according to community news, the liquidity provider Cetus on the SUI ecosystem was suspected of being attacked, with a significant drop in liquidity pool depth and multiple token trading pairs on Cetus experiencing declines, with expected losses exceeding $230 million. Subsequently, Cetus issued an announcement stating: "An incident has been detected in our protocol, and for security reasons, the smart contract has been temporarily paused. The team is currently investigating the incident. We will soon release further investigation statements."
After the incident, the SlowMist security team intervened for analysis and issued a security alert. Below is a detailed analysis of the attack method and fund transfer situation.
(https://x.com/CetusProtocol/status/1925515662346404024)
Relevant information
One of the attack transactions:
https://suiscan.xyz/mainnet/tx/DVMG3B2kocLEnVMDuQzTYRgjwuuFSfciawPvXXheB3x
Attacker address:
0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06
The address of the attacked pool:
0x871d8a227114f375170f149f7e9d45be822dd003eba225e83c05ac80828596bc
Involved tokens:
haSUI / SUI
Attack Analysis
The core of this incident is that the attacker carefully constructed parameters to cause overflow while bypassing detection, ultimately allowing a very small token amount to exchange for massive liquidity assets. Below are the specific steps for analysis:
1. The attacker first borrowed 10,024,321.28 haSUI through a flash loan, causing the pool price to plummet from 18,956,530,795,606,879,104 to 18,425,720,184762886, with a price drop of 99.90%.
2. The attacker carefully selected an extremely narrow price range to open a liquidity position:
Tick lower limit: 300000 (Price: 60,257,519,765,924,248,467,716,150)
Tick upper limit: 300200 (Price: 60,863,087,478,126,617,965,993,239)
Price range width: only 1.00496621%
3. Next is the core of this attack, where the attacker claimed to add a massive liquidity of 10,365,647,984,364,446,732,462,244,378,333,008 units, but due to the vulnerability, the system only accepted 1 token A.
Let's analyze why the attacker could exchange a massive liquidity with just 1 token. The core reason lies in the overflow detection bypass vulnerability in the checked_shlw function in the get_delta_a function. The attacker exploited this, causing the system to miscalculate the actual amount of haSUI needed to add. Due to the overflow not being detected, the system misjudged the required amount of haSUI, allowing the attacker to exchange only a very small number of tokens for a large amount of liquidity assets, thus executing the attack.
When the system calculates how much haSUI is needed to add such massive liquidity:
The key here is that there is a serious flaw in the implementation of the checked_shlw function. In fact, any input value less than 0xffffffffffffffff << 192 will bypass overflow detection. However, when these values are left-shifted by 64 bits, the result exceeds the representable range of u256, causing the high-order data to be truncated, resulting in a obtained value much smaller than the theoretical value. As a result, the system will underestimate the required amount of haSUI in subsequent calculations.
Error mask: 0xffffffffffffffff << 192 = a very large value (about 2^256 - 2^192)
Almost all inputs are less than this mask, bypassing overflow detection
The real problem: when n >= 2^192, n << 64 exceeds the u256 range and gets truncated
The intermediate value constructed by the attacker liquidity * sqrt_price_diff = 6277101735386680763835789423207666908085499738337898853712:
Less than the erroneous mask, bypassing overflow detection
But after left-shifting 64 bits, it exceeds the maximum value of u256, causing the overflow part to be truncated
This leads to a final calculation result of approximately less than 1, but since it is rounded up, the quotient is calculated to equal 1
4. Finally, the attacker removed liquidity and obtained massive token profits:
First removal: Obtained 10,024,321.28 haSUI
Second removal: Obtained 1 haSUI
Third removal: Obtained 10,024,321.28 haSUI
5. The attacker repaid the flash loan, netting approximately 10,024,321.28 haSUI and 5,765,124.79 SUI, completing the attack.
Project team's fix situation
After the attack occurred, Cetus released a fix patch. The specific fix code can be referred to: https://github.com/CetusProtocol/integer-mate/pull/7/files#diff-c04eb6ebebbabb80342cd953bc63925e1c1cdc7ae1fb572f4aad240288a69409.
The fixed checked_shlw function is as follows:
Fix description:
Correct the erroneous mask 0xffffffffffffffff << 192 to the correct threshold 1 << 192
Change the condition from n > mask to n >= mask
Ensure that when left-shifting 64 bits may cause overflow, the overflow flag can be correctly detected and returned
MistTrack Analysis
According to analysis, the attacker 0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06 profited approximately $230 million, including various assets such as SUI, vSUI, USDC, etc.
We found that the attacker prepared the Gas Fee two days ago and made an attempt before the attack, but it failed:
After profiting, the attacker transferred part of the funds such as
USDC, SOL, suiETH through cross-chain bridges like Sui Bridge, Circle, Wormhole, and Mayan to the EVM address 0x89012a55cd6b88e407c9d4ae9b3425f55924919b:
Among them, 5.2341 WBNB was cross-chained to the BSC address 0x89012a55cd6b88e407c9d4ae9b3425f55924919b:
Then, the attacker transferred a value of
$10 million in assets deposited into Suilend:
The attacker also transferred 24,022,896 SUI to the new address 0xcd8962dad278d8b50fa0f9eb0186bfa4cbdecc6d59377214, which has not yet been transferred out:
Fortunately, according to Cetus, with the cooperation of the SUI Foundation and other ecosystem members, they have successfully frozen $162 million of stolen funds on SUI.
(https://x.com/CetusProtocol/status/1925567348586815622)
Next, we use the on-chain anti-money laundering and tracking tool MistTrack to analyze the address 0x89012a55cd6b88e407c9d4ae9b3425f55924919b that received cross-chain funds on EVM.
The address received 5.2319 BNB on BSC, which has not yet been transferred out:
The address received 3,000 USDT, 40,880,000 USDC, 1,771 SOL, and 8,130.4 ETH on Ethereum.
Among them, USDT, USDC, and SOL were exchanged for ETH through CoW Swap, ParaSwap, etc.:
Then, the address transferred 20,000 ETH to address 0x0251536bfcf144b88e1afa8fe60184ffdb4caf16, which has not yet been transferred out:
Currently, the balance of this address on Ethereum is 3,244 ETH:
MistTrack has added the above related addresses to the malicious address database, and we will continue to monitor the address balance.
Summary
This attack demonstrates the power of mathematical overflow vulnerabilities. The attacker precisely calculated and selected specific parameters to exploit the flaw in the checked_shlw function, obtaining liquidity worth billions at the cost of 1 token. This is an extremely sophisticated mathematical attack, and the SlowMist security team advises developers to strictly verify all boundary conditions of mathematical functions in smart contract development.