Cetus lost $223M to a shift overflow. Aftermath lost $1.14M to a negative fee. Bucket Protocol ships a decimal scaling bug today. All three passed audits. All three have the same root cause.
I've spent the last month reading exploit post-mortems, scanning production Sui contracts, and building lint rules to catch what I kept seeing. After the third time the same shape showed up, I stopped thinking of these as separate incidents.
They're the same bug wearing different clothes.
Exploit 1: Cetus — $223M (May 2025)
The largest Move exploit to date. A single function in a shared math library — checked_shlw in integer-mate — was supposed to prevent a 256-bit left shift from overflowing. It didn't.
