NSA

Cetus released a report on the theft incident, will advance the LP compensation plan and strengthen security audits

ChainCatcher message, Cetus officially released a report on the theft incident stating that on May 22, Cetus encountered a sophisticated smart contract attack targeting the CLMM liquidity pool. Cetus took immediate measures to mitigate the impact.The attacker exploited an undiscovered vulnerability in an open-source library, lowering the pool price to build positions in the high-price area, and utilized an overflow check flaw to inject inflated liquidity with very few tokens. Subsequently, they repeatedly executed liquidity removal operations to extract assets from the pool, continuously exploiting unverified calculation functions to carry out the attack, ultimately successfully stealing funds.To jointly maintain the maximum interests of the entire ecosystem, with the support of most Sui validator nodes, Cetus urgently froze two Sui wallet addresses of the attacker, which contained the majority of the stolen funds. The remaining stolen funds have been exchanged by the hacker and cross-chain transferred to the Ethereum mainnet.Cetus is collaborating with the Sui security team and several auditing firms to re-examine the contracts and conduct a multi-party joint audit to ensure the safe restoration of CLMM services after verification is completed. At the same time, Cetus will strengthen on-chain monitoring, initiate additional audits, and regularly publish security reports. To compensate affected LPs, Cetus is working with ecosystem partners to develop a recovery plan and is calling on Sui validators to support on-chain voting to expedite the return of user assets and rebuild confidence. While legal proceedings continue, Cetus is also providing the attacker with a white hat return opportunity. Cetus will soon issue a final ultimatum to them. Any updates will be transparently communicated to the community by Cetus.
ChainCatcher Building the Web3 world with innovators