RESEARCH: Smart Contract Exploits and DeFi Hacks (Last 48 Hours)

Summary

In the past 48 hours, a significant DeFi exploit occurred on Cetus Protocol, the largest concentrated-liquidity DEX on Sui, resulting in an estimated $223 million loss. The exploit leveraged a flaw in a custom overflow-prevention function, checked_shlw(), which failed to detect unsafe conditions due to an incorrect mask, allowing the attacker to mint an excessively large amount of liquidity tokens with minimal input. This incident highlights critical vulnerabilities in fixed-point arithmetic and the importance of rigorous overflow checks in smart contract security.

Key Developments

• 2025-05-22 — Cetus Protocol suffered a catastrophic exploit that drained approximately $223 million across multiple pools. The root cause was a flaw in the checked_shlw() function, which used an incorrect mask (0xffffffffffffffff << 192) to prevent overflow, allowing the attacker to manipulate calculations and mint large liquidity tokens with minimal deposits. The exploit was replicated across multiple pools, exacerbating the losses. BlockSec Blog

Sources

• OWASP Smart Contract Top 10 - An OWASP other project
• BlockSec Blog on Cetus Incident