All Solutions
SUI

Sui Smart Contract Audit

Manual review of every module in your Sui Move codebase.

REQUEST A SUI AUDIT

THE CHALLENGE

Sui's object model moves value, not just storage.

Sui replaces global state with owned objects, shared objects, and capabilities. Access control lives in who holds what, not in who calls what, so missing capability checks, unsafe object wrapping, and shared-object races are Sui-specific vulnerability classes a generic review will miss.

Once a package is published, its logic is permanent. A Sui smart contract audit is the last checkpoint before your package takes custody of real assets.

WHAT WE AUDIT

Sui-specific coverage, not a generic review

Move modules — entry functions, visibility, and friend declarations
Capability and witness patterns, including one-time witness misuse
Object ownership, transfers, wrapping, and dynamic fields
Shared-object concurrency and race conditions
Programmable transaction block (PTB) composition and argument safety
Admin and upgrade capability custody (UpgradeCap, Publisher)
Arithmetic, fixed-point math, and rounding direction
Coin and balance handling, including generic type confusion
Oracle, price feed, and clock dependencies
Package upgrade policy and dependency pinning

HOW IT WORKS

Our Process

vault.move
pool.move
kiosk.move
modules · signers · objects
01

Discovery

We read your module structure, object layouts, and capability holders to understand protocol intent before review begins.

attacker txpath
entry funpath
shared objecttarget
attacker · perspective · paths
02

Threat Modeling

We map object ownership, capability custody, shared-object access, and PTB composition from an attacker perspective.

1public fun withdraw(
2 cap: &VaultCap,
3 amt: u64,
4) {
5 assert!(amt > 0, E_ZERO);
6 let c = split(&mut bal, amt);
7 transfer::public_transfer(c, sender())
8}
every · line · reviewed
03

Manual Audit

Senior engineers review your Move modules line by line for Sui-specific classes: missing capability checks, witness misuse, object wrapping, shared-object races, and arithmetic errors.

cap::denied
object::wrapped
shared_object::race
ptb::atomicity
fuzz · invariants · edge cases
04

Advanced Testing

Targeted tests and invariant checks against your entry functions and object flows to surface edge cases your suite never reaches.

Ccapability theft
Hobject wrapping
Mshared-object race
Lupgrade policy
fixes · verified
05

Fix Review

We verify every fix and confirm each finding is fully resolved before the final report is delivered.

WHY ADEVAR

Built on Move-specific experience

100+ audits across Solana, Ethereum, Sui, and other ecosystems

Senior engineers who work directly with Move object and capability models

Research-driven reviews of access-control and account-model bug classes

FAQ

Frequently Asked Questions

A Sui audit reviews your Move modules and package structure for Sui-specific vulnerability classes: missing or misused capabilities, one-time witness errors, unsafe object wrapping, shared-object races, PTB composition risks, arithmetic and rounding errors, and upgrade capability custody. Every module is reviewed manually by a senior engineer.

Sui Move packages, including modules written against the Sui framework, dynamic field usage, and the off-chain clients or PTBs that interact with your package.

Most Sui audits run 1 to 4 weeks depending on module count, object complexity, and documentation quality. A focused single-package audit typically runs 1 to 2 weeks.

Sui's object model, capability-based access control, and shared-object concurrency create a different attack surface than the EVM. Object ownership, capability custody, witness patterns, and PTB composition are Sui-specific issues an EVM-focused review will miss.

Yes. We offer infrastructure audits covering your RPC and indexer setup, deployment keys, and upgrade process alongside the on-chain package review.

Ready to audit your Sui package?

Tell us about your modules and we will scope the right engagement for your team.

REQUEST A SUI AUDIT