SlowMist pointed out the vulnerability that caused the 230 million USD hack on Cetus.

According to a new analysis report from SlowMist, the attack on the DeFi platform Cetus – which caused about $230 million in damage – stemmed from a serious technical vulnerability in the 'checked_shlw' function inside the 'get_delta_a' function.

Specifically, Cetus's system did not detect the overflow condition (overflow) during the processing, causing the mechanism for calculating the necessary amount of haSUI to be seriously inaccurate. Due to not recognizing this error, the system misestimated the amount of haSUI that needed to be deposited, thereby allowing the attacker to use a very small amount of tokens to exchange for a much larger volume of liquidity assets.

This vulnerability causes a serious imbalance in the pricing mechanism and facilitates the exploitative behavior of protocol assets.