The Math Behind the Millions Lost
In May 2025, the crypto world watched in disbelief as Cetus, a prominent DeFi protocol on the Sui blockchain, lost an astonishing $223 million. This wasn't an isolated incident. Shortly before, Aftermath Finance suffered a $1.14 million loss due to a negative fee exploit. Now, Bucket Protocol is shipping a fix for a decimal scaling bug. All three protocols passed security audits. All three have the same fundamental flaw: a disease in their mathematical underpinnings.
These aren't discrete events; they are the same vulnerability manifesting in different forms. Over the past month, examining post-mortems and production Sui contracts revealed a recurring pattern. The issue lies not in the blockchain's core technology, but in the application-level math libraries used by developers.
Exploit 1: Cetus — A $223 Million Shift Overflow
The Cetus exploit, the largest Move-based exploit to date, originated in a shared math library. Specifically, the checked_shlw function within the integer-mate crate was intended to prevent overflows when performing a 256-bit left shift. However, it failed.
The function's check was supposed to ensure the input value was small enough to be safely shifted. The original code snippet demonstrates this:
// BEFORE fix
assert!(n <= MAX_U256 / 2, "shift out of bounds");
let res = val << n;
The intention was to verify that the shift amount `n` would not cause the value `val` to exceed the maximum representable value for a 256-bit unsigned integer (MAX_U256) after the shift. The check, n <= MAX_U256 / 2, is standard practice for preventing left shift overflows. If `n` is greater than half the bit-width, the result is guaranteed to overflow. For a 256-bit integer, this threshold is 255.
The vulnerability lay in a subtle oversight: the check was performed *before* the shift operation, but the overflow condition could still be met if the input `val` was already large enough that shifting it by a seemingly safe `n` would still result in an overflow. For instance, if `val` was already `MAX_U256 / 2 + 1` and `n` was 1, the check `1 <= 255` would pass, but the subsequent operation `val << 1` would overflow.
The attacker exploited this by manipulating the value of `n` to be 1 and `val` to be close to MAX_U256. This allowed them to effectively mint an unbounded amount of assets, leading to the catastrophic loss.
Exploit 2: Aftermath — The $1.14 Million Negative Fee
A few weeks prior to the Cetus incident, Aftermath Finance faced a $1.14 million loss. This exploit stemmed from a negative fee mechanism within their trading system. The core issue was the calculation of trading fees, which, under specific conditions, could become negative.
In many financial protocols, fees are calculated as a percentage of the transaction value. If the fee percentage is positive, the protocol collects a small amount from each trade. However, if a bug introduces a negative fee percentage, the protocol effectively pays the user. This is precisely what happened at Aftermath.
The vulnerability report indicated that the fee calculation logic did not adequately handle edge cases, particularly when dealing with extremely small or large values, or specific sequences of operations. This allowed an attacker to trigger a state where the fee calculation resulted in a negative value. When the system attempted to apply this negative fee, it would instead credit the attacker's account with funds, draining the protocol's liquidity pools.
This exploit highlights how even seemingly simple arithmetic operations, when integrated into complex financial logic, can harbor critical vulnerabilities if not rigorously validated against all possible inputs and intermediate states.
Exploit 3: Bucket Protocol — The Decimal Scaling Bug
Bucket Protocol's recent encounter with a decimal scaling bug further underscores the pervasive nature of these mathematical vulnerabilities. While the exact loss amount is still being assessed, the nature of the bug is a classic example of precision errors in financial calculations.
Decimal scaling bugs occur when a system fails to correctly handle the precision of numbers, particularly in floating-point or fixed-point arithmetic. In decentralized finance, where precise accounting of assets is paramount, such errors can be catastrophic. For instance, a protocol might use a fixed-point representation for its internal accounting, where a large integer represents a smaller decimal value (e.g., 1,000,000,000 wei might represent 1 ether).
The bug in Bucket Protocol likely involved incorrect scaling factors or division operations that did not account for the defined decimal places. This could allow an attacker to perform operations that, due to rounding errors or improper scaling, result in the creation or extraction of value. For example, if a protocol calculates interest or fees by dividing a large number by a scaling factor, and that division is performed with insufficient precision or an incorrect scaling factor, the resulting value could be subtly wrong. Over many transactions, these small errors can accumulate into significant financial discrepancies, which attackers can exploit.
The Common Disease: Flawed Integer and Decimal Arithmetic
What connects Cetus, Aftermath, and Bucket Protocol is not the specific function that failed, but the underlying principle: a failure in robust mathematical operations at the application layer. These exploits are not indicative of a flaw in Sui's core Move language or its virtual machine. Instead, they point to a developer tendency to reuse or poorly audit shared math libraries, treating them as infallible black boxes.
The integer-mate library, used by Cetus, is a common dependency. Its checked_shlw function, while attempting to be safe, contained a critical logical error. Similarly, the fee calculation logic at Aftermath and the decimal scaling in Bucket Protocol represent common arithmetic patterns that, when not exhaustively tested for edge cases, become exploit vectors.
Think of these math libraries like a set of measuring cups. You trust them to accurately measure ingredients. But if one cup is subtly warped, or if you use it to measure a powder that settles differently than expected, your recipe can be ruined. The developers trusted these libraries, but the subtle warps in the math allowed for catastrophic failures.
The Path Forward: Auditing Beyond the Surface
The fact that all three exploited protocols passed security audits is a stark warning. Auditors, like developers, can overlook subtle mathematical flaws, especially when relying on common libraries. The audits likely confirmed that the library functions were called correctly and that the overall logic appeared sound on the surface.
However, the true vulnerability lay deeper, in the precise way these mathematical operations handled extreme values and edge cases. This suggests a need for more rigorous, mathematically-focused auditing techniques. Static analysis tools can help, but they often struggle with complex logical conditions and arithmetic nuances.
Developers need to approach math libraries with a healthy skepticism. Instead of treating them as trusted utilities, they should be treated as critical components that require their own thorough review. Building custom, audited math functions for critical operations, or using libraries specifically designed for formal verification of mathematical correctness, could mitigate these risks.
The hundreds of millions lost are a painful lesson. The underlying disease – flawed application-level arithmetic – is treatable. It requires a shift in how developers and auditors perceive and verify the mathematical foundations of decentralized applications. The math might look fine on the surface, but as these exploits demonstrate, the devil is in the decimal points and the bit shifts.