Introduction
Smart contract vulnerabilities have led to over $3 billion in losses across blockchains. Sui’s Move language reduces risks with built-in safeguards, but audits remain critical. This guide covers:
1️⃣Sui-specific attack vectors
2️⃣Move Prover for formal verification
3️⃣Step-by-step auditing checklist
4️⃣Real-world exploit case studies

1. Why Smart Contract Audits Are Different on Sui

A. Move Language Advantages

• No reentrancy: Functions can’t call back into contracts mid-execution
• Static ownership checks: Compiler prevents invalid object access
• Explicit resource handling: No accidental token burns

B. New Sui-Specific Risks

Risk Category	Example	Mitigation
Shared Object Locks	Deadlocks in DeFi pools	Timeout patterns
Object Spoofing	Fake NFT metadata	On-chain signature checks
Gas Oracle Attacks	Frontrunning transactions	Private mempools

2. The Move Prover: Formal Verification Made Practical

Step-by-Step Setup

1. Install the prover:

   sui move prove --path ./contract  
   

2. Add invariants to your code:

   spec balance_never_negative {  
       ensures coin.balance >= 0;  
   }  
   

3. Run verification:

   sui move prove --check-invariants  
   

Real-World Example: Stablecoin Contract

module audited::stablecoin {  
    // Prover ensures total_supply == sum(balances)  
    invariant supply_integrity {  
        global.total_supply == sum(global.balances)  
    }  
}  

3. The 5-Point Sui Audit Checklist

4. Ownership Transfers
   ✅ Verify transfer::transfer is used correctly
   ❌ Catch missing ownership checks:

// UNSAFE - missing owner check!  
public fun withdraw(coin: Coin) { ... }  

2. Shared Object Synchronization
   ✅ Test concurrent access patterns
   ❌ Identify deadlock risks:

// Potential deadlock  
public fun swap(a: &mut Pool, b: &mut Pool) { ... }  

3. Event Validation

✅ Ensure all critical actions emit events
❌ Detect silent failures:

// Missing event  
fun _internal_transfer() { ... }  

4. Arithmetic Safety
   ✅ Use sui::math for overflow protection
   ❌ Flag raw arithmetic:

let total = a + b; // UNSAFE  

5. Admin Privileges
   ✅ Implement multi-sig for upgrades
   ❌ Catch single-owner risks:

public fun set_admin(new: address) { ... }  

4. Case Study: AMM Exploit Prevention

Vulnerability Found

// Bug: First depositor could manipulate share price  
fun deposit(pool: &mut Pool, amount: u64) {  
    let shares = amount * pool.total_shares / pool.reserves;  
    // ...  
}  

Fixed Version

// Solution: Use initialized minimum liquidity  
fun safe_deposit(pool: &mut Pool, amount: u64) {  
    assert!(pool.reserves > MIN_LIQUIDITY, EINVALID);  
    let shares = amount * pool.total_shares / pool.reserves;  
    // ...  
}  

5. Third-Party Audit Tools

Tool	Purpose	Sui Support
Move Analyzer	Static analysis	✅ Yes
Certora	Formal verification	🔜 Coming
Soteria	Automated vulnerability scanning	✅ Yes

6. Future of Sui Security

Upcoming Features

• On-chain audit registry: Immutable proof of verification
• ZK-proof privacy: Hide sensitive data during audits
• AI-assisted review: GitHub Copilot for Move

Conclusion
Sui’s architecture reduces smart contract risks, but audits remain essential. By combining:

1. Move Prover for mathematical guarantees
2. Manual review for business logic
3. Automated tools for continuous checking