Possible Vulnerabilities

This section documents 34 vulnerability classes commonly found in Sui Move smart contracts. Each vulnerability has its own dedicated page with detailed explanations, vulnerable code examples, and recommended mitigations.

Overview

Sui Move contracts face unique security challenges due to the object-centric model, capability-based access control, and programmable transaction blocks (PTBs). Understanding these vulnerabilities is essential for writing secure smart contracts.

Vulnerability Categories

Access Control & Authorization (1-9)

• Object Transfer Misuse - Unintended object transfers breaking invariants
• Object Freezing Misuse - Malicious freezing of critical objects
• Numeric / Bitwise Pitfalls - Overflow and shift operation issues
• Ability Misconfiguration - Improper copy, drop, store, key abilities
• Access-Control Mistakes - TxContext and sender verification issues
• Shared Object DoS - Denial of service via shared object contention
• Improper Object Sharing - Accidental exposure of objects as shared
• Dynamic Field Misuse - Child-object and dynamic field vulnerabilities
• Sponsored Transaction Pitfalls - Meta-transaction authority confusion

Logic & State Management (10-20)

• General Move Logic Errors - PTB reordering and mutation issues
• Capability Leakage - Authority leakage via indirect APIs
• Phantom Type Confusion - Type parameter injection attacks
• Unsafe Object ID Usage - Identity assumptions on child objects
• Dynamic Field Key Collisions - Key collision vulnerabilities
• Event Design Vulnerabilities - Ambiguous or missing events
• Unbounded Child Growth - State bloat from unlimited children
• PTB Ordering Issues - Non-deterministic PTB execution
• PTB Refund Issues - Inconsistent state from partial execution
• Ownership Model Confusion - Incorrect ownership transitions
• Weak Initializers - Reinitialization attacks

External Integration & Advanced (21-34)

• Oracle Validation Failures - Off-chain oracle trust issues
• Unsafe Option Authority - Authority toggles via Option
• Clock Time Misuse - Timestamp and time logic vulnerabilities
• Transfer API Misuse - Object ownership model transitions
• Unbounded Vector Growth - Gas exhaustion from large vectors
• Upgrade Boundary Errors - ABI breaks on package upgrades
• Event State Inconsistency - State/event synchronization
• Read API Leakage - Information exposure via view functions
• Unsafe BCS Parsing - Off-chain deserialization issues
• Unsafe Test Patterns - Test code leaking to production
• Unvalidated Struct Fields - Missing input validation
• Inefficient PTB Composition - Gas exhaustion patterns
• Overuse of Shared Objects - Unnecessary sharing risks
• Parent Child Authority - Implicit authority assumptions

OWASP / MITRE CWE Mapping