How much is a line of code worth? The answer is 1.6 billion dollars — this is not an exaggeration, it is the painful lesson just experienced by Cetus, the largest DEX platform in the Sui ecosystem. A Hacker directly took away 230 million dollars through a breathtakingly ingenious vulnerability.

The key to the matter lies in a seemingly ordinary boundary check: the attacker constructed a special set of inputs that made the value n just satisfy the condition n <= mask, successfully passing the first line of defense. But the real deadly part is the latter half—this n is also greater than or equal to 2^192, and when a left shift of 64 bits is executed, the entire calculation result directly exceeds the storage limit of u256. In an instant of overflow, the function outputs a completely incorrect return value, and the gates of the liquidity pool were thus pried open.

The good news is that the Cetus team has quickly fixed the codebase. But this case serves as a reminder to everyone: security audits of smart contracts leave no room for complacency; even a minor error in bitwise operations can lead to astronomical costs. In the world of DeFi, code is law, and bugs are the loopholes in that law.