Cetus CLMM Hack

What happened

On May 22, 2025, Cetus's Sui concentrated-liquidity market maker was exploited through faulty arithmetic in a shared Move library. The attacker inflated position liquidity with minimal deposits and drained reserves from multiple CLMM pools. Cetus reported approximately $223 million taken before the contracts were paused.

Technical root cause

Cetus attributed the flaw to inter_mate's checked_shlw helper. Its overflow guard used a 256-bit limit where this liquidity calculation required a 192-bit bound, allowing an unsafe left-shifted value to pass validation and corrupt liquidity accounting. Cetus specifically said this was unrelated to the previously reported MAX_U64 issue.

How it happened

1. The attacker used a flash swap to temporarily suppress pool prices, then opened a liquidity position in a selected tick range.
2. A faulty overflow check let add_liquidity record an artificially large liquidity amount despite a minimal token contribution.
3. The attacker repeatedly removed liquidity against that false balance to extract pool reserves.

Protocol details

Classification Arithmetic Error / Exchange (DEX)

Protocol Type DEX

Implementation language Move

Protocol links Website @cetusprotocol

Evidence

• report Report coindesk.com
• report Cetus Incident Report: May 22, 2025 Attack Disclosure cetusprotocol.notion.site
• report Sui DEX Cetus says overlooked flaw in open-source library used by smart contract led to $223 million exploit theblock.co
• analysis Website reference cointelegraph.com
• analysis Website reference binance.com
• analysis DeFiLlama defillama.com
• analysis Response to the Cetus Incident - Onchain Community Vote sui.io

Understand the attack patterns

Compare incidents →

Arithmetic Overflow & Underflow Attacks