SlowMist releases analysis of the $230 million Cetus theft: hackers used a very small amount of tokens to exchange for huge amounts of liquid assets

Odaily Planet Daily News SlowMist released an analysis of the $230 million theft of Cetus, which pointed out that the core of this incident was that the attacker carefully constructed parameters to cause overflow but bypass detection, and finally exchanged a huge amount of liquid assets with a very small amount of tokens. The core reason is that there is an overflow detection bypass vulnerability in checked_shlw in the get_delta_a function. The attacker took advantage of this and caused the system to have a serious deviation in calculating how much haSUI actually needed to be added. Because the overflow was not detected, the system misjudged the number of haSUI required, resulting in the attacker only needing a few tokens to exchange a large amount of liquid assets, thus realizing the attack. This attack demonstrates the power of mathematical overflow vulnerabilities. The attacker selected specific parameters through precise calculations and exploited the defects of the checked_shlw function to obtain billions of liquidity at the cost of 1 token. This is an extremely sophisticated mathematical attack, and developers are advised to strictly verify the boundary conditions of all mathematical functions in smart contract development.