Cetus CLMM on Sui suffered a math error in its checked_shlw function where an incorrect overflow threshold (0xffffffffffffffff << 192 instead of 1 << 192) allowed attackers to craft positions with phantom liquidity. Using flashloans to manipulate prices and create tight tick ranges, attackers minted enormous liquidity while depositing minimal real tokens, then withdrew actual reserves.