7. Improper Object Sharing

module vulnerable::wallet {
    use sui::object::{Self, UID};
    use sui::tx_context::{Self, TxContext};
    use sui::transfer;
    use sui::coin::{Self, Coin};
    use sui::sui::SUI;

    public struct Wallet has key {
        id: UID,
        funds: Coin<SUI>,
        owner: address,
    }

    /// VULNERABLE: Wallet is shared instead of transferred!
    fun init(ctx: &mut TxContext) {
        let wallet = Wallet {
            id: object::new(ctx),
            funds: coin::zero(ctx),
            owner: tx_context::sender(ctx),
        };

        // WRONG: This should be transfer(), not share_object()!
        transfer::share_object(wallet);
    }

    /// Because wallet is shared, ANYONE can call this!
    public entry fun withdraw(
        wallet: &mut Wallet,
        amount: u64,
        ctx: &mut TxContext
    ) {
        // This check is useless — attacker just passes their address
        let recipient = tx_context::sender(ctx);

        // Wait, the owner check is missing entirely!
        let withdrawn = coin::split(&mut wallet.funds, amount, ctx);
        transfer::public_transfer(withdrawn, recipient);
    }

    /// VULNERABLE: Even with owner check, sharing was wrong
    public entry fun withdraw_checked(
        wallet: &mut Wallet,
        amount: u64,
        ctx: &mut TxContext
    ) {
        // Owner check exists but...
        assert!(tx_context::sender(ctx) == wallet.owner, E_NOT_OWNER);

        // If owner's key is compromised, wallet is drained
        // With address-owned, owner could at least try to transfer first
        let withdrawn = coin::split(&mut wallet.funds, amount, ctx);
        transfer::public_transfer(withdrawn, wallet.owner);
    }
}

// Attacker finds the shared wallet object
module attack::drain_wallet {
    use vulnerable::wallet;
    use sui::tx_context::TxContext;

    public entry fun steal(
        wallet: &mut wallet::Wallet,
        ctx: &mut TxContext
    ) {
        // Because wallet is shared, attacker can reference it directly
        // If withdraw() lacks owner check, funds are gone
        wallet::withdraw(wallet, 1000000, ctx);
    }
}

module secure::wallet {
    use sui::object::{Self, UID};
    use sui::tx_context::{Self, TxContext};
    use sui::transfer;
    use sui::coin::{Self, Coin};
    use sui::sui::SUI;

    /// Wallet is address-owned — only owner can use it
    public struct Wallet has key {
        id: UID,
        funds: Coin<SUI>,
    }

    /// SECURE: Transfer to user, not share
    fun init(ctx: &mut TxContext) {
        transfer::transfer(
            Wallet {
                id: object::new(ctx),
                funds: coin::zero(ctx),
            },
            tx_context::sender(ctx)
        );
    }

    /// Owner must possess the wallet to call this
    public entry fun withdraw(
        wallet: &mut Wallet,
        amount: u64,
        recipient: address,
        ctx: &mut TxContext
    ) {
        let withdrawn = coin::split(&mut wallet.funds, amount, ctx);
        transfer::public_transfer(withdrawn, recipient);
    }

    /// Only owner can transfer their wallet
    public entry fun transfer_wallet(
        wallet: Wallet,
        new_owner: address,
    ) {
        transfer::transfer(wallet, new_owner);
    }
}

module appropriate_sharing::examples {
    use sui::object::{Self, UID};
    use sui::tx_context::TxContext;
    use sui::transfer;

    /// APPROPRIATE: Global configuration that needs to be readable by all
    public struct GlobalConfig has key {
        id: UID,
        fee_bps: u64,
        paused: bool,
    }

    /// APPROPRIATE: Order book that multiple parties interact with
    public struct OrderBook has key {
        id: UID,
        bids: vector<Order>,
        asks: vector<Order>,
    }

    /// APPROPRIATE: Liquidity pool for AMM
    public struct LiquidityPool has key {
        id: UID,
        reserve_a: Coin<A>,
        reserve_b: Coin<B>,
    }

    /// For shared objects, use capability-based access control
    public struct AdminCap has key {
        id: UID,
        config_id: ID,
    }

    public entry fun update_config(
        cap: &AdminCap,
        config: &mut GlobalConfig,
        new_fee: u64,
    ) {
        assert!(cap.config_id == object::id(config), E_WRONG_CONFIG);
        config.fee_bps = new_fee;
    }
}

// Unless you have a specific reason, use transfer()
fun init(ctx: &mut TxContext) {
    transfer::transfer(MyObject { ... }, tx_context::sender(ctx));
}

/// Shared: Global registry (read-heavy)
public struct Registry has key {
    id: UID,
    // Immutable or admin-only mutable state
}

/// Owned: User-specific state
public struct UserAccount has key {
    id: UID,
    // User's private state
}

/// Any mutation of shared objects requires a capability
public entry fun modify_shared(
    cap: &ModifyCap,
    shared: &mut SharedObject,
    ...
) {
    assert!(cap.shared_id == object::id(shared), E_WRONG_CAP);
    // Now safe to modify
}

/// SHARED: This object is intentionally shared because:
/// 1. Multiple parties need to interact (buyers/sellers)
/// 2. All mutations require OrderCap
/// 3. Contention is managed via order sharding
public struct OrderBook has key { ... }