Sui Scanner Skill

Purpose

Specialized scanner for Sui Move smart contracts. Sui uses a unique object-centric model where state is organized as typed objects with ownership semantics, not as a global address-keyed storage. This fundamentally changes the security surface compared to both EVM and other Move chains (Aptos).

Sui vs Aptos: Key Differences

Architecture Overview

┌─────────────────────────────────────────────────────────────┐
│                      Sui Network                            │
│                                                             │
│  ┌───────────────────┐    ┌───────────────────┐             │
│  │  Owned Objects    │    │ Shared Objects     │             │
│  │  (No consensus)   │    │ (Consensus needed) │             │
│  │                   │    │                    │             │
│  │  ┌────────┐       │    │  ┌────────┐        │             │
│  │  │ Coin   │ ←owner│    │  │ DEX    │ ←shared│             │
│  │  └────────┘       │    │  │ Pool   │        │             │
│  │  ┌────────┐       │    │  └────────┘        │             │
│  │  │ NFT    │ ←owner│    │  ┌────────┐        │             │
│  │  └────────┘       │    │  │ Config │ ←shared│             │
│  └───────────────────┘    │  └────────┘        │             │
│                           └───────────────────┘             │
│  ┌───────────────────┐    ┌───────────────────┐             │
│  │ Immutable Objects │    │ Wrapped Objects    │             │
│  │ (Frozen forever)  │    │ (Inside another)   │             │
│  │  ┌────────┐       │    │  ┌────────────┐    │             │
│  │  │Package │       │    │  │ Parent Obj  │    │             │
│  │  └────────┘       │    │  │  ┌───────┐  │    │             │
│  └───────────────────┘    │  │  │ Child │  │    │             │
│                           │  │  └───────┘  │    │             │
│                           │  └────────────┘    │             │
│                           └───────────────────┘             │
└─────────────────────────────────────────────────────────────┘

Detection Capabilities

Critical Vulnerabilities

• Object ownership bypass: Shared objects accessed/modified without authorization checks
• UpgradeCap leak: Upgrade capability transferred to wrong address or left publicly accessible
• Dynamic field manipulation: Unbounded or attacker-controlled dynamic field growth
• Missing One-Time Witness: Module initialization can be replayed

High Vulnerabilities

• Missing TxContext::sender check: Privileged operations without caller validation
• Shared object contention DoS: Spamming shared objects to create sequencing bottleneck
• Transfer policy bypass: Using transfer::transfer instead of transfer::public_transfer for types with store
• Object ID prediction: Assuming object IDs are random when they're deterministic

Medium Vulnerabilities

• Object wrapping/unwrapping bugs: Wrapped objects not properly lifecycle-managed
• Clock dependency manipulation: Time-sensitive logic relying on Clock shared object
• Dynamic field key collision: Different logical fields mapped to same dynamic field key
• Frozen object mutability attempt: Logic that attempts to modify frozen objects

Real-World Sui Incidents

Resources

• Sui Patterns — Full vulnerability patterns with Move code
• Object Security — Deep dive on object ownership model

Workflows

• Sui Audit — Step-by-step Sui audit methodology

Related Scanners

• Move Scanner — Generic Move language patterns (shared with Aptos)
• Aptos Scanner — Aptos-specific global storage patterns

Error Code Reference

Sui-specific error codes and framework abort codes. Sui Move uses custom abort codes per module.

Sui Framework Errors

Sui Coin / Token Errors

Common DeFi Protocol Errors (Sui)

Troubleshooting