Missing Validation Check Let Attacker Drain $1.14M From Aftermath Finance in 36 Minutes

Aftermath Finance, a decentralized perpetuals platform on the Sui blockchain, suffered a $1.14 million USDC exploit on April 29, 2026. An attacker exploited a signed integer vulnerability that allowed a negative fee value to pass through without proper validation. This flaw caused collateral calculations to become artificially inflated, enabling the attacker to withdraw funds they were not entitled to. The entire attack was executed in just 36 minutes before it could be detected or stopped. Security analysts noted that a single additional assertion in the code would have been sufficient to prevent the exploit entirely.