1. Exceeding the maximum supply of 10 billion SUI + allowing the attacker to claim the excess funds
   ‍
2. Loss of Funds which includes:
   - Unauthorized creation, copying, transfer or destruction of objects via bypass of or exploit of bugs in the Move or Sui bytecode verifier
   
   - Address Collision – creating two distinct authentication schemes that hash to the same SUI address in a manner that lead to significant loss of funds
   
   - Object ID collision — creating two distinct objects with the same ID in a manner that leads to significant loss of funds.
   
   - Unauthorized use of an owned object as a transaction input, resulting in significant loss of funds due to the inability to verify ownership and permission to transfer
   
   - Dynamically loading an object that is not directly or transitively owned by the transaction sender, in a manner that leads to significant loss of funds
   
   - Unauthorized upgrade of a Move package, in a manner that leads to significant loss of funds
   
   - Stealing staking rewards that belong to another user, or claiming more than a user’s share of staking rewards, not including rounding errors that result in a minor, financially insignificant discrepancy
   ‍
3. Violating BFT assumptions, acquiring voting power vastly disproportionate to stake, or any other issue that can meaningfully compromise the integrity of the blockchain’s proof of stake governance does not include the following:
   
   - Voting power that is redistributed because one or more other validators already has max voting power
   
   - Rounding errors that result in minor voting power discrepancies
   ‍
4. Network not being able to confirm new transactions (total network shutdown) requiring a hard fork to resolve
5. Arbitrary, non-Move remote code execution on unmodified validator software

‍

1. A bug that results in unintended and harmful smart contract behavior with no concrete funds at direct risk
2. Unintended, permanent burning of SUI under the max cap.
3. Shutdown of greater than or equal to 30% of network processing nodes without brute force actions, but does not shut down the network

1. Sending a transaction that triggers invariant violation error code in unmodified validator software
2. A remote call that crashes a Sui full node