Security lives at the heart of Sui
From the ground up, every layer of Sui is designed to protect users, developers, and assets.
Hardened by design
High-velocity finance demands a high standard of security. Sui is built to meet that standard:
Move: No reentrancy attacks
Move requires all function calls to be statically known, making contract behavior predictable and closing the door on dynamic dispatch exploits.
Move: Native access control
Ownership is managed at the protocol level through object metadata, so unauthorized modifications are structurally impossible without relying on manual checks.
Proactive auditing
Sui partners with leading security firms to audit the network and affiliated products continuously. Findings and remediation steps are shared openly to maintain transparency and community trust.
Future-forward defense
From quantum-resistant cryptography research to AI-powered vulnerability detection, the team actively explores emerging threats, staying ahead of the curve.
Build secure from your first line of code
Start with security best practices, written by the people who designed the network, and then dig into developer resources and code quality checklists for every stage of your build.
Built for cryptographic agility
Sui is adding two NIST-standardized post-quantum signature schemes: ML-DSA-65 as a native scheme for everyday accounts and hash-based SLH-DSA-SHA2-128s inside Move contracts for high-value vaults. Read the latest updates on Sui’s post-quantum security efforts:
Securing Sui in the Quantum Computing Era
How each Sui primitive transitions: signatures, hashing, encryption, proofs.
Read BlogMaking Sui Quantum Ready
Two NIST-standardized schemes, and a migration that keeps existing addresses.
Read BlogFrom the Cryptographer’s Desk
The reasoning behind both schemes, the benchmarks, and the trade-offs.
Read BlogGet audited and verified
Work with trusted security partners to secure your product. Explore the directory:
A specialized partner focusing on Move-based smart contracts. They provide deep-tier formal verification to prove the mathematical correctness of core protocol logic (e.g., accounting and liquidations).
A technology-first firm that provides the "Certora Prover," an automated formal verification tool. They allow developers to write custom security rules (specifications) that the system mathematically validates against the code.
A security research firm that conducts deep architectural reviews and threat modeling. They are known for building their own security tooling and focusing on long-term system resilience beyond a simple code audit.
A research-driven firm with deep expertise in modern runtimes like Move. They pair manual auditing with custom-built fuzzing tools and a white-hat attacker mindset to surface complex, non-obvious vulnerabilities.
A security firm dedicated to the Move ecosystem. They provide a mix of manual audits and proprietary static analysis tools (like the Move Analyzer) specifically designed to catch Move-specific logic errors.
Zellic provides high-end, manual security assessments with a focus on complex cryptography and protocol design. Their Zenith arm is specialized for rapid, high-coverage reviews for projects moving toward launch.
A collective of high-ranked independent security researchers. They specialize in "time-boxed" manual reviews, where a team of top-tier auditors aggressively hunts for vulnerabilities within a concentrated window.
Recent reports on Sui
Developer resources
Security best practices
New Sui VM: Bug Bounty Now Open
Ecosystem Security Expansion Initiative
Security Audits and Move Registry
Sui Prover, by Asymptotic
Sui Cryptography and Quantum Computing
Why Move: Security
Developer Experience & Security
Nautilus: Verifiable Offchain Compute