Sui to the Rescue: Will Cetus Recover Its Funds Soon?

Thursday, May 22, Cetus, the main DEX of the Sui ecosystem, fell victim to a hack and lost 223 million dollars. All network participants have been collaborating for four days to recover the stolen funds. After freezing the funds, Cetus launched a proposal to recover them and obtained the support of the Sui foundation.

Review of the Cetus Hack

Since its inception, funds managed by decentralized finance have been the target of hackers. The Sui ecosystem is no exception, and its main DEX, Cetus, suffered a major hack last week. The attacker managed to drain the equivalent of 223 million dollars by using fake tokens to manipulate price curves.

On the same day, the Cetus team tried to minimize the problem by communicating only about an oracle bug before being forced to publicly acknowledge the theft. Meanwhile, the hacker knows it is only a matter of time before measures are taken to prevent him from using the stolen funds. He therefore decides to bridge the equivalent of 60 million dollars to the Ethereum blockchain to swap these funds for ETH, evading measures that the Sui blockchain might take against him.

The Sui network validators froze the remaining funds (approximately 160 million dollars), effectively preventing the hacker from using them, which allows Cetus to consider a strategy for recovering the funds.

The Sui Foundation to the Rescue of Cetus

As of Friday, the Sui Foundation intervened to negotiate with the hacker. He holds 160 million in USDC frozen on the Sui network and more than 20,000 ETH on the Ethereum blockchain. The foundation proposed that the hacker act as a “white hat” instead of risking criminal prosecution. If he returns the frozen funds and the ETH to demonstrate good faith, he can keep as a reward 2,324 ETH, equivalent to 6 million dollars.

For now, the hacker has not accepted the proposal and several applications have suspended their activity to complete security audits to ensure they are not vulnerable to the same attack.

Cetus has therefore decided to change its strategy by using the governance of the Sui network. Its proposal, posted online this weekend, aims to request a network update to directly reclaim the frozen funds, effectively circumventing the hacker’s actions. This radical method is the same as Ethereum’s hard fork in 2017 following The DAO hack and had divided the community.

This proposal has just received significant support thanks to the support of the Sui foundation . However, it sets two limits on its support: it is informal since the foundation does not use its voting power to ensure the proposal’s success, for reasons of neutrality. Furthermore, the foundation requires that the recovered funds be primarily used to reimburse the application’s users.

Controversy Around the Centralization of the Sui Network

We can be pleased that Cetus, the validators, and the Sui foundation collaborate to recover the funds stolen by the hacker and compensate users. However, the freezing of funds has sparked controversy because in a sense it contradicts the decentralization of web3. Indeed, the freeze was possible through the coordinated action of 114 validators and Mysten Labs, the company that manages the network, by changing the source code in real time without consulting the community. Although the motive may be commendable, this shows that the network and users’ funds are not censorship-resistant.

This intervention revives a recurring debate within DeFi: should security take priority at the expense of decentralization ?

Four days after the hack of the DEX Cetus, the Sui community must make a decision: should the network be updated to recover the funds? The Sui foundation supports helping compensate users while trying to maintain a semblance of neutrality. But there is no doubt that this hack and its resolution will leave marks on this ecosystem.