~/blog/move
Move Security Research
Move security research across Sui, Aptos, and Movement: audit field guides, real findings, runtime internals, and formal verification.
Beyond the Bet: Auditing a Prediction Market on Sui Move
A month of generalized field notes from a private Sui Move prediction-market review: pricing, signed oracles, settlement, NAV, LP queues, PTB composition, and why the dangerous bugs live between components.
read the field notesPrivate Bug Bounty Triage: Validating and Reproducing Web3 Findings
A concise breakdown of my private triage workflow: validating Web3 findings, writing deterministic PoCs after triage, and packaging clean impact evidence without leaking client details.
read moreHow to Audit a Perp Protocol on Sui Move
Auditing perps on Sui requires a different checklist from EVM or Aptos. The object model, hot-potato request/response pattern, Programmable Transaction Blocks, and shared collateral vaults all reshape the attack surface — the Sui companion to the Aptos perp audit post.
read moreThe Upgrade Trap — How Versioned Objects Can Brick Protocols on Sui
Sui's Versioned wrapper lets protocols migrate shared objects across upgrades. But the same pattern creates an upgrade trap — if your immutable package depends on a versioned protocol, one migrate() call bricks you forever.
read moreMove VM Runtime — How Your Move Code Actually Runs
How the Move VM runtime actually executes your code — from bytecode loading to interpreter dispatch and native function calls.
read moreSui Execution Layer — A Security Researcher's Deep Dive
A deep dive into Sui's execution layer — how transactions flow from submission to state changes, and what security researchers should look for.
read moreSui's Cut Package — How Sui Freezes Its Execution Layer
How Sui uses the cut package mechanism to freeze its execution layer — snapshotting framework code at specific protocol versions for deterministic replay.
read moreSui Bella Ciao — Inside the New Move VM
Sui rewrote their entire Move VM. Here's how the new execution layer works, what changed from the old one, and where the interesting attack surface lives for security researchers.
read moreHow to Audit a Lending Protocol on Sui Move
Share-ratio manipulation, eMode edge cases, oracle staleness, and the liquidation paths that actually break — a field checklist from a live Sui lending audit.
read moreFormal Verification of Aptos Move Contracts Using Move Prover
Setting up the Move Prover on a real Aptos codebase: writing spec blocks, proving aborts_if conditions, and the invariants that catch bugs manual review misses.
read moreFormal Verification of Current Sui Using Certora — Part 2
Using Certora's Sui Prover to encode borrow restrictions as parametric rules — and what the prover surfaced that manual review walked past.
read moreFormal Verification of Current Sui Using Certora Sui Prover
How I mathematically proved that an eMode group assignment is immutable after obligation creation in a Sui DeFi lending protocol — using Certora's Sui Prover, parametric rules, and field accessors.
read moreThe Move Auditor
Introducing move-auditor — an open-source Claude skill that runs a structured security-audit pipeline over Move codebases, built from my real engagement workflow.
read moreAuditing a Perp Protocol on Aptos Move
Learnings from auditing a fully on-chain perp DEX in Move on Aptos — orderbook mechanics, oracle integration, liquidation engine, funding rate, and the bugs that actually matter.
read moreField Order Is Sort Order — How Struct Layout Silently Breaks Ordered Maps in Move
Move compares structs lexicographically by field declaration order. If you use a struct as a key in an ordered map, the first field dominates sorting — not the field you think matters. A real bug from Decibel Exchange's perpetual futures DEX on Aptos.
read moreThe Silent Killer in Move: How return vs abort Silently Corrupts State on Chain
A real bug from Aptos core's trading engine that permanently deleted orders on an "error" path. The root cause? A return where there should have been an abort. Applies to both Aptos and Sui Move.
read moreZK Journey Week 1 — Why a Move Security Researcher Is Learning Zero Knowledge Proofs from Scratch
As a Move security researcher, I need to understand ZK proofs deeply — not just what they do, but how they work under the hood. Week 1 of my ZK learning journey at the Rare Skills ZK Bootcamp.
read moreThe Move Bug That Would Have Bricked Aave on Aptos Before Day One
A case study from Aave Aptos V3 on Cantina, where Panther placed 3rd with 1 confirmed High and 1 confirmed Medium. The High came down to data being stored at one address and read from another.
read moreHow to Win a Public Contest: Lessons from 6× Top 3 Finishes
Zero fluff, pure trenches-tested insights from climbing to the top 50s on Cantina. This is the alpha that actually moved the needle — not theory, not vibes, just what works when you're deep in the code at 3 AM and the leaderboard is watching.
read more