Second Stamp

CACTF2026

Task: Sui Move DeFi 'sharehouse' LP vault upgraded on-chain v1->v2->v3 where all versions stay callable on the same shared objects; drain both AMM pools, buffer and fees to residual dust. Solution: exploit a cross-version AUM-collapse bug — the legacy v1 bin rule mispriced the position at the fixed oracle price, collapsing the LP-mint denominator, so a v3 deposit mints near-total LP and a profile-3 withdraw drains everything proportionally.