Worked example · 2025-05

Cetus Protocol concentrated-liquidity overflow exploit — Sui — 2025-05-22

Loss: approximately $220M extracted from Cetus's concentrated-liquidity pools on Sui in a single attack window beginning approximately 10:30 UTC on 2025-05-22. Cetus is the dominant DEX-and-CLMM protocol on Sui and at the time of the event accounted for the majority of Sui-ecosystem TVL; the drained pools spanned several major SUI / stablecoin and SUI / wrapped-asset pairs.
Recovery: approximately $162M of the extracted ~$220M was effectively immobilised on the Sui side after the Sui validator set executed a coordinated transaction-censorship action against the attacker-controlled addresses within the first hour after detection (roughly 10:30–11:30 UTC on 2025-05-22). The remaining ~$58M had already been bridged off-Sui via Wormhole to Ethereum in the same window and was subsequently routed and partially mixed; recovery on the off-Sui leg has been minimal. Cetus, the Sui Foundation, and Mysten Labs subsequently coordinated a recovery proposal that, combined with a Cetus-side treasury contribution and a Sui Foundation backstop, was structured to make affected LPs whole at a high recovery rate.
OAK Techniques observed: OAK-T9.005 broadly construed — the failure class is a smart-contract arithmetic-overflow bug in Cetus's concentrated-liquidity tick / liquidity-shift computation, not a reentrancy in the canonical 2016 sense, but it sits in the same OAK-T9.005 smart-contract-exploit family as a precision / arithmetic-correctness sub-pattern. Downstream OAK-T7.003 (Cross-Chain Bridge Laundering — Wormhole leg, the ~$58M that escaped before the validator-set freeze).
Attribution: pseudonymous. No public named-individual attribution. The attacker funded the deployment wallet with bridged stablecoins; on-chain investigators (most prominently SlowMist, with corroborating threads from Sui-ecosystem analysts) traced the funding source but did not identify the operator. There is no public OAK-G01 / state-actor attribution for this incident as of the date of this example.
Key teaching point: validator-coordinated transaction freeze as an L1-level recovery primitive. The Sui validator set executed an emergency coordinated-censorship action against the attacker addresses, immobilising ~$162M of the ~$220M before the funds could leave the Sui state machine. This is a recovery primitive that has no direct EVM-chain analogue at scale: it depends on the permissioned / known-validator-set property of Sui's consensus, validator coordination latency measured in tens of minutes, and the operational legitimacy of validators acting in concert on a non-protocol-defined censorship event. The Cetus incident is the clearest 2024–2025 worked example that this primitive exists, that it can be invoked in the worst-case window, and that the structural divergence from EVM-chain post-incident recovery limits is large enough to be a first-class consideration in chain-selection threat modelling.

Summary

Cetus Protocol is a concentrated-liquidity AMM (CLMM) on the Sui blockchain. On 2025-05-22, beginning at approximately 10:30 UTC, an attacker exploited an integer-overflow vulnerability in Cetus's tick-math / liquidity-shift computation to mint outsized liquidity-position shares against pools at an effectively zero token cost, then redeemed those shares against the pools' real reserves. The drain proceeded across multiple Cetus pools in rapid sequence, with cumulative outflow of approximately $220M before the attacker began bridging proceeds out of Sui via Wormhole to Ethereum.

The proximate cause — per the Cetus post-incident write-up corroborated by OtterSec, SlowMist, and BlockSec forensic analyses — was an arithmetic-correctness bug in the Move-language implementation of one of the CLMM's tick-spacing or liquidity-delta computations, in which a multiplication step produced a value that, under specific tick / liquidity-input combinations, wrapped past the type's representable range. The wrapped value was then used downstream as if it were the correct (non-wrapped) result, causing Cetus's accounting to credit the attacker's position with liquidity vastly larger than the tokens they had actually deposited. The Move type system's static guarantees did not catch this: the bug was in algorithmic correctness within representable types, not in a misuse of unchecked arithmetic per se.

Within the first hour after detection, the Sui validator set coordinated an emergency action that effectively prevented the attacker-controlled addresses from moving the on-Sui balance further. Approximately $162M of the ~$220M was immobilised by this action; approximately $58M had already crossed Wormhole to Ethereum before the freeze landed and is treated separately in the laundering-leg analysis below. Cetus paused its protocol; Mysten Labs and the Sui Foundation coordinated public communications; and over the following weeks a recovery package — combining frozen-fund recovery, a Cetus-side treasury contribution, and a Sui Foundation backstop — was proposed to make affected liquidity providers whole.

For OAK's purposes the structurally novel feature of this incident is not the smart-contract bug — arithmetic-overflow exploits in CLMM tick math are a known DeFi failure class with EVM-side precedents — but the validator-coordinated freeze. This primitive is unavailable on Ethereum, BNB Chain, Arbitrum, and most other permissionless-validator-set L1s and L2s in any form that could be invoked in tens of minutes; on Sui's permissioned-validator-set design with bounded validator count, it was operationally feasible. The incident is the canonical 2025 worked example for this divergence.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Cetus deploys CLMM contracts on Sui in Move; integer-overflow vulnerability latent in tick / liquidity-delta computation under specific input combinations	T9.005 surface (latent)
Pre-event	Attacker funds deployment wallet on Sui with bridged stablecoins; analyses Cetus tick-math implementation to identify the overflow surface	(off-OAK pre-event observation)
2025-05-22 ~10:30	First attack tx on Sui: attacker submits liquidity-position transaction with carefully chosen tick / amount combination that triggers the overflow; receives an attributed liquidity share vastly larger than tokens deposited	T9.005 extraction
2025-05-22 ~10:30–11:00	Attacker repeats the pattern across multiple Cetus pools; cumulative on-Sui outflow approaches ~$220M	T9.005 repeat
2025-05-22 ~10:30–11:30	Attacker bridges ~$58M (the Wormhole-routed share) from Sui to Ethereum before the freeze lands	T7.003 (Wormhole bridge leg)
2025-05-22 ~11:00	Cetus operations team detects anomalous pool state; pauses protocol contracts on the Cetus side	(operator response)
2025-05-22 ~11:00–11:30	Sui Foundation, Mysten Labs, Cetus, and the Sui validator set coordinate emergency response; validators agree to censor transactions originating from or destined to the attacker-controlled Sui addresses	(validator-set coordination)
2025-05-22 ~11:30	Effective on-Sui freeze in place; ~$162M of the ~$220M is immobilised on the Sui side and cannot be moved further	L1-level recovery primitive (Sui-specific)
2025-05-22 onward	Attacker on-chain attempts to move the frozen Sui-side balance fail — transactions are not included by validators	(recovery state)
2025-05-22 onward	Public post-incident write-ups: Cetus disclosure thread; OtterSec / SlowMist / BlockSec forensic analyses; Sui Foundation joint statement	(transparency)
2025-05-22 — weeks following	Recovery package: combination of immobilised-funds recovery, Cetus treasury contribution, and Sui Foundation backstop proposed to make affected LPs whole	(recovery negotiation)
Continuing	The ~$58M that bridged to Ethereum via Wormhole is routed through additional hops; partial mixing / cross-chain rotation observed; off-Sui recovery is minimal	T7.003 outcome

What defenders observed

The bug shape was algorithmic-correctness-within-representable-types, not "unchecked arithmetic." The Move language's type system gives stronger static guarantees than Solidity in several respects, but it does not rule out arithmetic that is correctly typed and correctly bounded at each step yet algorithmically wrong — for example, a multiplication that fits the type but represents a quantity outside the algorithmic preconditions of the downstream code. Cetus's overflow was of this shape: the offending step did not exceed the integer type's range in the trivial sense but produced a value that violated the algorithmic invariants the rest of the code assumed. Audit firms that approached the Move codebase with a primarily type-system-driven threat model under-weighted this class of failure; OtterSec's post-incident analysis explicitly flagged tick-math algorithmic invariants as a per-DEX audit-checklist item that the Move ecosystem now needs to track explicitly.
The freeze action was not a protocol-level pause. Cetus's own pause mechanism was invoked, but on its own it could not stop the attacker from spending the already-attributed Sui-side balance — the attacker's wallet held real on-Sui assets at that point, separate from Cetus's pool state. The freeze that immobilised the ~$162M was a transaction-censorship action by the Sui validator set itself, applied at the consensus layer to transactions originating from the attacker's addresses. This is a categorically different primitive from a protocol pause and is what makes the Cetus case structurally novel.
The Wormhole-leg loss is the real on-chain loss after recovery. Approximately $58M crossed to Ethereum before the freeze landed. On Ethereum the funds entered a permissionless, censorship-resistant validator set with no analogous primitive available; recovery on that leg has tracked the patterns of other 2024–2025 cross-chain-bridge laundering cases (mixer routing, cross-chain hops, fan-out into multiple addresses). Defender accounting that reports the headline as "Cetus lost $220M" overstates the residual loss; defender accounting that reports "Cetus recovered everything" overstates the recovery. The accurate frame is: the Sui-side ~$162M was recovered via the validator-coordinated freeze; the off-Sui ~$58M was lost in the same shape as a typical 2024–2025 cross-chain-laundered DeFi exploit.
Detection latency was well-aligned with the freeze window. The on-chain attack signature — outsized liquidity attribution against a Cetus pool followed by aggressive redemption — was visible in the first transaction. Cetus operations, Sui Foundation, Mysten Labs, and the validator set together completed the loop from detection to validator-coordinated freeze in roughly an hour. This is a small-multiple of the time typically observed between exploit detection and protocol-pause execution on EVM chains; the incremental latency for validator-set coordination on top of protocol pause was on the order of tens of minutes, not hours.
The recovery was not free. The Sui validator set acting as a coordinated censor against specific addresses is — at the level of consensus mechanics — a discretionary choice, applied case-by-case under social pressure from the chain's foundation and dominant ecosystem participants. The Cetus incident is the clearest 2025 case where this was invoked. Defenders modelling chain-selection should treat this as a real but conditional capability: it depends on a coalition of validators agreeing to censor in a specific case, on the case being legible to that coalition as legitimate (a clear-cut exploit, not a contested flow), and on the absence of credible counter-pressure from validators who object. None of these conditions are guaranteed; the primitive exists but is not unconditional.

What this example tells contributors writing future Technique pages

T9.005 covers more than reentrancy. The Cetus case is the canonical 2025 worked example for the arithmetic-correctness sub-class of T9.005 — a smart-contract bug that produces a state attribution the protocol's accounting cannot recover from, but where the failure is not a reentry. Contributors writing T9.005 worked examples should preserve the Reentrancy framing as the primary T9.005 sub-class while explicitly noting that arithmetic-overflow / precision-loss / rounding-error failures in CLMM tick math, oracle math, share-price computation, and liquidity-delta math are siblings within the same T9.005 family. The Onyx Protocol example at /examples/2024-09-onyx.md is the EVM-side companion in this sub-class for the same v0.1 cohort. A future v0.x update may warrant promoting the arithmetic-correctness sub-class to its own technique ID; until then, Cetus and Onyx both ride T9.005 in the broad construction.
L1 recovery primitives are a chain-selection consideration. The Cetus incident is the strongest 2025 case for documenting that recovery primitives differ across L1s in operationally consequential ways. Sui's permissioned-validator-set design admits a validator-coordinated freeze that is unavailable on Ethereum, BNB Chain, and most large-validator-set L1s. Defenders evaluating where to deploy a high-TVL protocol should treat "post-incident recovery primitives available on this L1" as a first-class threat-modelling input alongside transaction throughput, finality latency, and tooling maturity. Contributors writing OAK actor / mitigation pages should include this dimension explicitly; the Cetus case is the citation.
The ~$58M Wormhole-leg loss is the realistic floor for the off-L1 portion. Once funds crossed to Ethereum, they entered a recovery surface structurally identical to the typical 2024–2025 DeFi-exploit laundering chain. Contributors writing examples that involve cross-chain bridge legs after a partial L1-side recovery should expect the off-L1 leg to track those patterns; the Cetus split (~70% recovered on Sui, ~30% lost off-Sui via Wormhole) is the realistic shape, not full recovery.
Pseudonymous attribution is the realistic attribution status for this class. No FBI / Treasury attribution applies; no industry forensics provider has converted on-chain analysis into a named-individual claim; the incident is pseudonymous in OAK terms. Contributors writing the worked-example layer should not over-claim attribution simply because the on-chain forensics are detailed — clear forensic reconstruction of the on-chain attack does not by itself produce a name.

Public references

[cetuspostmortem2025] — Cetus Protocol's official post-incident write-up describing the overflow root cause, the impact across pools, and the recovery proposal.
[ottersecsuicetus2025] — OtterSec post-incident technical analysis of the integer-overflow vulnerability in Cetus's tick / liquidity-delta computation, including the algorithmic-invariants framing.
[slowmistcetus2025] — SlowMist incident analysis of the Cetus exploit, including funding-source tracking and the on-Sui-versus-Wormhole split.
[blocksecsuicetus2025] — BlockSec forensic write-up emphasising the cross-pool repetition pattern and the fan-out shape of the on-Sui extraction.
[suifoundationcetus2025] — Sui Foundation joint statement covering the validator-coordinated freeze action and the recovery-package framework.
[mystenlabscetus2025] — Mysten Labs technical communication on the Sui-side response, including the role of the Move type system and the limits the Cetus bug class exposed.
[peckshieldcetus2025] — PeckShield headline figures and on-chain analytics for the Cetus drain, used as the cumulative-loss reference.
[chainalysiscetus2025] for category-level context and 2025 DeFi-exploit cumulative figures.

Discussion

Cetus is OAK's canonical 2025 case for the non-EVM L1 recovery primitive — the structural divergence between permissioned-validator-set chains (Sui, Aptos, and a handful of others) and permissionless-validator-set chains (Ethereum, BNB Chain, Arbitrum, Optimism, Base, Polygon, and most other large-cap L1/L2s) at the post-incident-recovery layer. The 2024–2025 worked-example corpus is heavily weighted toward EVM incidents, which is the right weighting for representativeness; the Cetus inclusion is the corpus's structural counterweight, the case that prevents the framework from implicitly assuming EVM-chain recovery limits as universal.

The validator-coordinated freeze itself deserves careful framing in the contributor handbook. It is not a protocol-pause mechanism; Cetus's own pause was invoked separately. It is not an EVM-style sequencer-pause primitive (as exists on some Optimistic L2s); the Sui freeze was a coordinated transaction-censorship action by the validator set itself. It is not a code-deployable mitigation in the canonical OAK Mitigation sense; it is a discretionary action by humans operating validator nodes, applied case-by-case. And it is not unconditional; it depends on a coalition of validators agreeing the case is legitimate. In the Cetus case the conditions held: the exploit was unambiguous, the coalition was reachable, the social legitimacy was high, and the operational latency was tolerable. Contributors writing future examples on Sui-ecosystem incidents (or on Aptos-ecosystem incidents, where the structural property is similar) should expect that this primitive may or may not be invoked depending on the case; the existence of the primitive does not imply automatic invocation.

The Cetus bug class — algorithmic arithmetic-correctness failure within representable types — is the technical teaching point that pairs with the L1-recovery framing. CLMM-style protocols (Uniswap V3, Cetus, several Aptos / Sui CLMMs) have aggressive tick / liquidity / fee math, and the surface area for non-trivial arithmetic-correctness bugs is larger than for simpler constant-product AMMs. The Onyx Protocol example at /examples/2024-09-onyx.md covers the EVM-side empty-market rounding-error sub-pattern; the Cetus example covers the Move-side tick-math overflow sub-pattern; the two together illustrate that the T9.005 arithmetic sub-class is recurrent across language ecosystems and audit traditions, and that ecosystem maturity does not by itself close the surface.

For OAK's broader credibility, including Cetus in v0.1 closes three gaps: it adds a Sui-ecosystem worked example to a corpus that is otherwise EVM-and-Bitcoin dominated, it documents the validator-coordinated freeze as a first-class L1 recovery primitive available on permissioned-validator-set chains, and it pairs with Onyx as the 2025 evidence that T9.005 in the broad construction continues to fire on protocols of substantial TVL despite the maturity of CLMM tick-math implementations across the ecosystem.