Skip to content
#07 largest Arithmetic 2025

The Cetus Protocol hack — $223M lost

Loss$223M
Date22 May 2025
ChainSui
Failure classArithmetic
In assetslargest DeFi hack of 2025
Targetconcentrated-liquidity DEX
1

What happened

A custom overflow guard with the wrong threshold. checked_shlw was supposed to reject any value that would overflow when shifted left by 64 bits — that limit is 1 << 192. The code compared against 0xffffffffffffffff << 192 instead: a bound roughly 2⁶⁴ times too high. Everything in that gap sailed through the "safe" branch and silently truncated. In Move, << does not abort on overflow. The attacker opened a position credited with astronomic liquidity while depositing 1 unit of token A.

2

How the attack ran

  1. Open a liquidity positionWith an absurdly large liquidity value
  2. The math calls checked_shlwThe guard that should reject an overflowing shift
  3. Mask is 0xffff…<<192~2⁶⁴× too high, and Move’s << never aborts
  4. Required deposit rounds to 1Near-infinite liquidity for one unit of token A
3

The code

integer_mate::math_u256 — the guard that guarded nothing
// ❌ vulnerable
public fun checked_shlw(n: u256): (u256, bool) {
    let mask = 0xffffffffffffffff << 192;   // ≈ 2^256 − 2^192
    if (n > mask) {
        (0, true)                            // "overflow"
    } else {
        ((n << 64), false)                   // silently truncates
    }
}

// ✅ fixed
public fun checked_shlw(n: u256): (u256, bool) {
    let mask = 1 << 192;                    // the real overflow boundary
    if (n >= mask) { (0, true) } else { ((n << 64), false) }
}

// get_delta_a() uses this to price how much token A a position must deposit.
// Truncated numerator → required deposit rounds down to 1.
→ result: near-infinite liquidity minted for ~1 unit of token A
4

What would have caught it

What an audit looks for: hand-written safe-math is a red flag by itself. Every custom guard needs a boundary test at exactly the limit, one below and one above — 1<<192 versus 0xffff…<<192 is invisible on a read-through and obvious the moment you fuzz it.
6

Sources

Every figure on this page comes from the post-mortems above, not from us. Losses are US dollars at the time of the incident.

Check your own contract for this

Arithmetic is one of the 203 classes the SaferICO scanner checks for. It will not review your signing process — but it will read your Solidity.

Run the scanner See how it is attacked Read the docs