A NullMeridian record Andromeda Logs

NullMeridianLog

22 May 2025, from 10:30:50 UTC

Cetus CLMM: Faulty Overflow Check Let Add-Liquidity Drain Pools

Cetus: on 22 May 2025 a flawed overflow check in an open-source library used by its CLMM let an attacker flash-swap, inject artificial liquidity, and drain pool reserves. Core pools disabled within minutes.

  • Event date
  • Incident typeSmart-contract exploit
  • Bug classValidation
  • Published

Loss, as sourced

Not stated in USD in Cetus's May 22 incident report. Secondary press commonly cites ~$223M; that figure is not taken from Cetus's report.

Traceability

Primary sources

  1. 01cetusprotocol.notion.siteCetus Incident Report, 22 May 2025 (opens in a new tab)
  2. 02sui.ioSui Foundation, on-chain community vote (opens in a new tab)

In brief

Root cause: Per Cetus: incorrect overflow check in add_liquidity (inter_mate library) after a flash_swap suppressed prices, letting the attacker inject artificial liquidity and repeatedly remove_liquidity.

Timeline, as sourced: Per Cetus (UTC, 22 May): 10:30:50 exploit begins; 10:57:47 core CLMM pools disabled; 11:20 contracts globally disabled; 12:50 validators freeze attacker addresses after 33% stake; 18:15 patch.

Account, as sourced

Claimed (Cetus) (report (opens in a new tab)): flash_swap, artificial liquidity via faulty overflow check, repeated remove_liquidity.

Claimed (Sui Foundation): later community vote authorized reclaim of frozen funds into a trust multisig.

Unknown: Cetus's own USD loss total in the May 22 report.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/cetus-clmm-overflow-check-2025