Mmehveteroinmehvetero.com·3d ago · 12 min readBlueMove Was Not an Overflow Bug — How a Cross-Version Reserve Desync Drained 714,000 SUIOn July 11, 2026, at 22:13 UTC, an attacker began draining liquidity pools on BlueMove DEX, a Sui-based AMM. Within 23 minutes, approximately 714,000 SUI — roughly $528,000 at the time — had crossed a00
Mmehveteroinmehvetero.com·Aug 1 · 8 min readHow a Missing `assert!` Drained $3.44M From Typus Finance — and Why the Code Looked CorrectOn October 15, 2025, at 13:05 UTC, an attacker began draining Typus Finance's TLP liquidity pool on the Sui network. Thirty-four minutes later, the contracts were paused — but the pool was already emp00
Mmehveteroinmehvetero.com·Jul 27 · 7 min readThree Sui Exploits, One Disease — Why "The Math Looked Fine" Keeps Costing Hundreds of MillionsCetus lost $223M to a shift overflow. Aftermath lost $1.14M to a negative fee. Bucket Protocol ships a decimal scaling bug today. All three passed audits. All three have the same root cause. I've spe00
Mmehveteroinmehvetero.com·Jul 25 · 6 min readI Built an Open-Source Security Linter for Sui Move — Here's What It Found on Real ProtocolsI've been building move-test-gen, a security tool for Sui Move smart contracts. It started as a test generator and grew into a coverage checker with mutation testing and a security linter. This post c20
Mmehveteroinmehvetero.com·Jul 24 · 8 min readHow One Missing Assert Drained $1.14M From Aftermath Finance — A Signed Integer Exploit on Sui A technical breakdown of the Aftermath Finance perpetuals exploit (April 29, 2026). How a negative fee value bypassed validation, inflated collateral, and allowed an attacker to drain $1.14M USDC in 300
