A previously unknown vulnerability within the system’s smart contract logic led to a substantial loss of funds in the Cetus exploit incident.
The attacker leveraged a flash swap to manipulate token prices and exploit a critical flaw in the smart contract logic, draining assets by injecting fake liquidity and siphoning actual token reserves.
The root cause of the exploit was a miscalculation in the open-source library used by the CLMM contract, enabling overflow manipulation due to a misunderstanding of left-shift operations.
The Cetus team reacted swiftly by disabling affected pools, patching vulnerable contracts, and initiating emergency governance procedures with the Sui validator community to prevent further asset movement and compensate affected users.