In Sui, every asset is an object and every object is a little state machine.

One common enforcement pattern is the Hot Potato: a struct with no abilities, which must be consumed before the transaction ends or the whole thing aborts.

Flash loans often rely on this. A Receipt is returned to the borrower and must be returned to the protocol to prove repayment.

❌Add drop to the Receipt ✅You’ve just introduced a critical vuln

Now the borrower can drop the potato and walk away without repaying.

Move’s drop ability lets anyone destroy the object unless you intentionally prevent it by omitting the drop ability.

Pro Tip: audit every struct in your protocol.

🔴If it represents an obligation (like a flash loan receipt), remove drop 🟢If it shouldn’t be copied, remove copy 🔵If it shouldn’t be global, remove store

Sui Move gives you low-level control over asset semantics. Misuse even one ability, and enforcement breaks.

Handle objects carefully. Don’t drop the hot potato