Agent skill
move-scanner
Use when the user wants to audit Move smart contracts for security vulnerabilities, scan Aptos or Sui contracts for resource safety, capability leaks, or module upgrade issues, review Move-based DeFi protocols for object model and linear type violations, or analyze cross-module trust boundaries.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/move-scanner
SKILL.md
Move Scanner Skill
Purpose
Analyze Move smart contracts for security vulnerabilities on both Aptos and Sui. Move's resource-oriented programming model — with linear types, abilities system, and the borrow checker — provides stronger safety guarantees than Solidity, but introduces unique vulnerability classes around capability management, module upgrades, and cross-module trust.
Move Security Model
Move was designed by Meta (formerly Facebook) for the Diem blockchain with safety as a first-class priority. The type system enforces:
| Safety Property | How Move Enforces It | Residual Risk |
|---|---|---|
| No resource duplication | Linear types: resources can't be copied unless explicitly marked copy |
Incorrect copy ability on value types |
| No resource loss | Resources must be explicitly destroyed or stored | Incorrect drop ability allows silent discard |
| Type safety | Static type checking + bytecode verification | Type confusion via deserialization |
| Access control | Module encapsulation + public vs public(friend) |
Overly permissive friend declarations |
| Memory safety | No raw pointers, borrow checker | Logic errors in state transitions |
Aptos vs Sui — Key Differences
| Feature | Aptos | Sui |
|---|---|---|
| State model | Global storage (move_to, borrow_global) |
Object model (owned, shared, immutable) |
| Execution | Sequential | Parallel (for owned objects) |
| Upgrade model | Module upgrade authority | Package upgrade via UpgradeCap |
| Initialization | init_module (called once on publish) |
init function with one-time witness |
| Identity | Account addresses | Object IDs |
| Token standard | aptos_framework::coin |
sui::coin with TreasuryCap |
| Randomness | aptos_framework::randomness |
sui::random |
Detection Capabilities
Critical — Direct Fund Loss
| Vulnerability | Description | Detection Signal |
|---|---|---|
| Capability leak | AdminCap, MintCap, or TreasuryCap stored in publicly accessible location | Capability with store ability + move_to to accessible address |
| Missing signer check | Entry function doesn't validate caller identity | public entry fun without signer parameter or authority check |
| Resource duplication | Value-holding resource has copy ability |
has copy on struct holding coins or tokens |
| Unsafe module upgrade | Upgrade authority not protected | Upgrade policy set to compatible with weak authority check |
| Unauthorized minting | Token mint function callable by anyone | mint function without capability or authority gate |
High — Significant Impact
| Vulnerability | Description | Detection Signal |
|---|---|---|
| Friend function abuse | Friend modules can bypass internal invariants | public(friend) on sensitive functions with excessive friends |
| Integer overflow | Move integers overflow without abort by default | +, * without checked arithmetic or assert! bounds |
| Object access bypass (Sui) | Shared object manipulation or wrapped object extraction | shared object without proper access control |
| Capability not burned | One-time capabilities not destroyed after use | Init witness or admin cap not consumed |
| Acquires annotation missing | Resource access without proper acquires |
Compile-time error on Aptos, but indicates design issue |
Medium — Conditional Impact
| Vulnerability | Description | Detection Signal |
|---|---|---|
| Dynamic field overflow (Sui) | Unbounded dynamic fields on objects | dynamic_field::add without count limits |
| Missing abort codes | Generic aborts make debugging/monitoring difficult | abort without code or assert! without message |
| Event missing | State changes without event emission | move_to / move_from without event::emit |
| Shared object contention (Sui) | Shared objects create bottlenecks | Frequently-accessed shared objects |
| Phantom type confusion | Phantom type parameters misused | phantom type enabling cross-type access |
Move Type System — Abilities Audit Guide
The four abilities control what you can do with a type:
| Ability | What It Allows | Security Concern |
|---|---|---|
key |
Can be stored in global storage (Aptos) or as an object (Sui) | Required for top-level storage — ensure access control |
store |
Can be nested inside other resources | Values with store can be transferred — check if intended |
copy |
Can be duplicated | DANGEROUS for value types — duplicating coins = minting |
drop |
Can be discarded without destruction | Careful with capabilities — dropping an admin cap means losing it |
Secure Capability Pattern
// SECURE: Capability without copy or drop — must be stored or explicitly destroyed
struct AdminCap has key, store {
id: UID, // Sui
}
// INSECURE: copy + drop allows duplication and silent discard
struct AdminCap has key, store, copy, drop {
id: UID,
}
Resources
| Resource | Description |
|---|---|
| Move Patterns | Common vulnerability patterns in Move with code examples |
| Aptos Security | Aptos-specific security: global storage, coin module, upgrade policy |
| Sui Security | Sui-specific security: object model, shared objects, UpgradeCap |
Workflows
| Workflow | Description |
|---|---|
| Move Audit | Unified audit workflow for Move contracts (Aptos + Sui) |
Notable Move Ecosystem Security Incidents
| Incident | Chain | Root Cause | Impact |
|---|---|---|---|
| Pontem DEX exploit | Aptos | Price oracle manipulation via flash loan | Fund theft |
| Tortuga staking issue | Aptos | Staking reward calculation error | Incorrect APY |
| Various Sui DeFi issues | Sui | Shared object contention + flash loan attacks | Trading manipulation |
| Module upgrade attacks | Aptos | Unprotected upgrade authority | Protocol takeover |
Integration with Other Skills
| Skill | Connection |
|---|---|
aptos-scanner/ |
Aptos-specific patterns and audit workflow |
chain-guides/aptos.md |
Chain context for Aptos (validators, gas, modules) |
patterns/ |
Cross-reference with general vulnerability categories |
exploit-forensics/ |
Move-based exploit analysis |
Error Code Reference
Common Move abort codes encountered during audits. Move uses numeric abort codes (abort <code>) or assert conditions (assert!(<cond>, <code>)).
Move Standard Library Abort Codes
| Abort Code | Module | Meaning |
|---|---|---|
0x10001 (65537) |
vector |
Index out of bounds — vector::borrow or vector::remove |
0x10002 (65538) |
vector |
Vector already contains element — vector::push_back on fixed |
0x20001 (131073) |
option |
Option::extract on None — missing existence check |
0x20002 (131074) |
option |
Option::borrow on None — attempt to read empty option |
0x30001 (196609) |
string |
Invalid UTF-8 bytes |
0x40001 (262145) |
signer |
Incorrect signer in multi-signer scenario |
0x50001 (327681) |
table |
Key already exists in table |
0x50002 (327682) |
table |
Key not found in table |
0x60001 (393217) |
coin |
Insufficient coin balance |
0x60002 (393218) |
coin |
Coin store not registered |
0x60003 (393219) |
coin |
Coin store already registered |
Aptos Framework Abort Codes
| Abort Code | Module | Meaning |
|---|---|---|
0x80001 (524289) |
account |
Account already exists |
0x80002 (524290) |
account |
Account does not exist |
0x80005 (524293) |
account |
Signer capability not found |
0x90001 (589825) |
resource_account |
Resource account already exists |
0xA0001 (655361) |
staking_contract |
Unauthorized — not the owner |
ENOT_OWNER (varies) |
Common pattern | Caller is not the resource owner — check access logic |
EALREADY_INITIALIZED (varies) |
Common pattern | Module/resource already initialized — check init guards |
ENOT_AUTHORIZED (varies) |
Common pattern | Missing authorization — check signer validation |
Sui Framework Abort Codes
| Abort Code | Module | Meaning |
|---|---|---|
ENotOwner |
object |
Caller does not own the object |
EEmptyInventory |
kiosk |
Kiosk has no items |
EObjectNotShared |
transfer |
Attempting shared-object operation on owned object |
EInvalidCap |
Various | Capability token does not match expected type/ID |
EDivisionByZero |
math |
Division by zero in fixed-point math |
EOverflow |
math |
Arithmetic overflow in math operation |
Troubleshooting
| Issue | Likely Cause | Solution |
|---|---|---|
| Scanner doesn't distinguish Aptos vs Sui patterns | Generic Move analysis loaded | Load aptos-scanner/ or sui-scanner/ for chain-specific analysis |
| Capability leaks not detected | Scanner doesn't track linear type flow | Manually trace all Capability and AdminCap types from creation to storage |
| Module upgrade risks missed | Scanner only checks current code | Verify UpgradeCap ownership and upgrade policy (immutable vs compatible) |
| Resource safety violations missed | Scanner trusts the Move verifier | Move verifier catches type safety but NOT logic bugs — audit business logic |
| False positives on abort codes | Scanner flags all abort as errors |
Custom abort codes are normal flow control — check if handled by callers |
| Object ownership confusion (Sui) | Scanner doesn't model Sui object model | Load sui-scanner/resources/object-security.md for ownership analysis |
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?