Blockchain security firm Dedaub found that a flawed overflow check was the reason behind the massive $200 million-plus exploit on Sui decentralized exchange Cetus last week.

Dedaub discovered that when you add liquidity to Cetus, the system does some math to check how much you should get in return. There was a mistake in the code that checks for “overflow,” or when a number gets too big for the computer to handle.

The check was supposed to stop that from happening, but it didn’t work correctly. As a result, the attacker needed to deposit only one token to obtain a huge amount of liquidity.

This story is an excerpt from the Unchained Daily newsletter.  

To get these updates in your email for free, subscribe here.

Dedaub also clarified that the issue was “NOT an oracle issue (despite what the team initially claimed),” and that it was “NOT about minting fake tokens (some security firms got this wrong).”

“The affected funds consist of 2 parts, one being within Sui and the other bridged out of the ecosystem mainly held in ETH,” Cetus said in a community update. “The assets within Sui addresses are currently frozen through the efforts of the validators.”

The team is pursuing two possible outcomes — an onchain vote to authorise recovery of the frozen funds or reaching a whitehat agreement with the hacker.