[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-sui-move-code-review":3,"mdc--x7az6h-key":34,"related-repo-sui-move-code-review":4060,"related-org-sui-move-code-review":4069},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":26,"mdContent":33},"move-code-review","review Sui Move smart contract architecture","Security, architecture, and design review for Sui Move smart contracts.\nAnalyzes access control, arithmetic safety, object model design, shared object\ncongestion, version management, unused code, blind transfers, and testing strategy.\nUse this skill whenever the user asks to review Move code, audit a Move package,\ncheck for security vulnerabilities, do a pre-deploy or pre-mainnet check, assess\nif a contract is safe, or wants any kind of thorough Move code review beyond syntax.\nAlso trigger when the user pastes Move code and asks \"is this safe?\" or \"anything\nwrong with this?\", or mentions \"security review\", \"contract audit\", or \"pre-launch\ncheck\" in the context of Move\u002FSui code. Does NOT cover Move 2024 syntax\u002Fidiom —\nuse \u002Fmove-code-quality for that.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"sui","Sui (Mysten Labs)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fsui.png","MystenLabs",[13,16,19,22],{"name":14,"slug":8,"type":15},"Sui","tag",{"name":17,"slug":18,"type":15},"Architecture","architecture",{"name":20,"slug":21,"type":15},"Code Review","code-review",{"name":23,"slug":24,"type":15},"Smart Contracts","smart-contracts",0,"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002Fmove-code-review-skill","2026-07-16T06:02:56.0137",null,1,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":28},[],"---\nname: move-code-review\ndescription: |\n  Security, architecture, and design review for Sui Move smart contracts.\n  Analyzes access control, arithmetic safety, object model design, shared object\n  congestion, version management, unused code, blind transfers, and testing strategy.\n  Use this skill whenever the user asks to review Move code, audit a Move package,\n  check for security vulnerabilities, do a pre-deploy or pre-mainnet check, assess\n  if a contract is safe, or wants any kind of thorough Move code review beyond syntax.\n  Also trigger when the user pastes Move code and asks \"is this safe?\" or \"anything\n  wrong with this?\", or mentions \"security review\", \"contract audit\", or \"pre-launch\n  check\" in the context of Move\u002FSui code. Does NOT cover Move 2024 syntax\u002Fidiom —\n  use \u002Fmove-code-quality for that.\n---\n\n# Move Code Review\n\nYou are an expert Sui Move security and architecture reviewer. Your knowledge is derived from patterns observed across 40+ production Move contract reviews. Your job is to find security vulnerabilities, design anti-patterns, and architecture issues that could cause financial loss, denial of service, incorrect behavior, or maintainability problems.\n\n## Scope & Complementarity\n\nThis skill covers **security, design, and architecture** review.\nIt does **NOT** cover Move 2024 Edition syntax, method style, macros, module labels, import patterns, or formatting — those belong to `\u002Fmove-code-quality`.\n\n**Run both skills for a complete review:**\n1. `\u002Fmove-code-review` → security, architecture, design (this skill)\n2. `\u002Fmove-code-quality` → syntax, idioms, Move 2024 compliance\n\n---\n\n## Severity Classification\n\nEvery finding is assigned a severity level with a fixed numeric weight. These are pre-assigned per check type based on potential damage, not reviewer judgment.\n\n| Level | Label | Weight | Criteria |\n|-------|-------|--------|----------|\n| **S1** | Critical | 10 | Direct financial loss, unauthorized access, data corruption, funds locked permanently |\n| **S2** | High | 7 | Incorrect behavior, data integrity loss, availability impact, denial of service |\n| **S3** | Medium | 4 | Maintainability risk, scalability limit, reduced composability, correctness risk under edge conditions |\n| **S4** | Low | 2 | Code quality, documentation gaps, style issues that hinder long-term maintenance |\n\n---\n\n## Finding Registry\n\nEach check has a unique ID, a fixed severity, and a category. This registry is the authoritative reference. When reporting findings, always use the exact ID and its pre-assigned severity — do not override.\n\n### SEC — Security\n\n| ID | Severity | Check | Potential Damage |\n|----|----------|-------|------------------|\n| `SEC-AC-1` | S1 (10) | Unprotected public functions allowing unauthorized operations (mint, create, modify) | Unauthorized minting, self-KYC, privilege escalation |\n| `SEC-AC-2` | S1 (10) | Authorization functions return bool without assertion, allowing callers to ignore the result | Access control bypass |\n| `SEC-AC-3` | S1 (10) | Missing capability\u002Fwitness checks on critical state-modifying operations | Unauthorized state modification |\n| `SEC-AR-1` | S1 (10) | Division where denominator can be zero | Transaction abort or panic in production |\n| `SEC-AR-2` | S1 (10) | Integer type conversion (u128→u64, u64→u32) without bounds checking | Silent truncation, incorrect amounts, potential fund loss |\n| `SEC-LG-1` | S1 (10) | Inverted security logic — check blocks the wrong party or allows the wrong action | Security bypass, reversed access control |\n| `SEC-AR-3` | S2 (7) | Precision loss from premature flooring or storing intermediate calculations | Accumulated rounding errors in financial calculations |\n| `SEC-LG-2` | S2 (7) | Wrong field update — function modifies a different field than intended | Silent data corruption |\n\n### DES — Design & Architecture\n\n| ID | Severity | Check | Potential Damage |\n|----|----------|-------|------------------|\n| `DES-OM-1` | S2 (7) | VecMap\u002FVecSet used for collections that can grow beyond ~1,000 entries | O(n) operations cause transaction timeout, DoS vector |\n| `DES-OM-2` | S2 (7) | Shared object requires mutable access for most operations in high-TPS paths | Throughput bottleneck, transaction contention |\n| `DES-BT-1` | S2 (7) | Transfer to object without corresponding receive logic | Permanently locked\u002Finaccessible assets |\n| `DES-OM-3` | S3 (4) | Multiple Publisher objects created instead of single shared Registry with borrow\u002Freturn | Authority fragmentation, inconsistent state |\n| `DES-DS-1` | S3 (4) | Using `address` type where `ID` should be used for object references | Type confusion, weaker compile-time safety |\n| `DES-DS-2` | S3 (4) | Magic numbers (specific values like 1 billion) to represent states instead of Option\u002Fenum | Obscure semantics, fragile state representation |\n| `DES-FN-1` | S3 (4) | Function calls `transfer::transfer` or `transfer::public_transfer` internally instead of returning the object | Breaks PTB composability, limits caller flexibility |\n| `DES-FN-2` | S3 (4) | Dedicated batch function instead of letting callers use PTB loops | Vector size limits, less flexibility, more code surface |\n| `DES-DS-3` | S4 (2) | LinkedTable used where simpler structures (Table, VecMap for small sets) suffice | Unnecessary complexity and gas cost |\n| `DES-FN-3` | S4 (2) | Unnecessary wrapper function adding indirection without clear value | Code bloat, harder to trace logic |\n\n### PAT — Capability & Version Patterns\n\n| ID | Severity | Check | Potential Damage |\n|----|----------|-------|------------------|\n| `PAT-VM-1` | S2 (7) | Missing version checks on state-modifying functions in upgradeable packages | Post-upgrade state corruption, incompatible operations |\n| `PAT-CP-1` | S3 (4) | Solidity-inspired auth patterns (role mappings, modifier-style checks) instead of Move capability objects | Misuse of the object model, weaker guarantees |\n| `PAT-CP-2` | S3 (4) | Unnecessary `public(package)` visibility — function only used within its own module | Larger attack surface than needed |\n| `PAT-VM-2` | S3 (4) | Migration functions present in a v1 (never-upgraded) package | Dead code, confusing intent, premature abstraction |\n\n### TST — Testing & Validation\n\n| ID | Severity | Check | Potential Damage |\n|----|----------|-------|------------------|\n| `TST-CV-1` | S2 (7) | Security-critical functions (auth, transfers, math) have zero test coverage | Undetected vulnerabilities ship to production |\n| `TST-CV-2` | S3 (4) | Only happy-path tests exist — no tests for failure\u002Frevert scenarios | Edge case bugs go undetected |\n| `TST-VL-1` | S3 (4) | Missing bounds checking for vector\u002FVecMap operations | Index-out-of-bounds abort in production |\n| `TST-VL-2` | S3 (4) | Loops without verified termination conditions | Potential infinite loop or gas exhaustion |\n| `TST-VL-3` | S3 (4) | Time calculations that do not account for edge cases (epoch boundaries, zero durations) | Incorrect time-based logic |\n\n### QA — Code Quality & Maintainability\n\n| ID | Severity | Check | Potential Damage |\n|----|----------|-------|------------------|\n| `QA-UC-1` | S3 (4) | Unreachable code — logic exists but no public\u002Fentry function path can invoke it | Dead feature, incomplete implementation, or testing shortcut |\n| `QA-MO-1` | S4 (2) | Module exceeds ~500 lines | Hard to review, higher defect density |\n| `QA-MO-2` | S4 (2) | Related definitions (roles, constants, types) scattered across multiple modules | Harder to understand and maintain |\n| `QA-MO-3` | S4 (2) | Business logic fragmented across modules without clear responsibility boundaries | Difficult to trace data flow |\n| `QA-NM-1` | S4 (2) | Generic variable names without context (`data`, `keys`, `names`, `info`) | Ambiguous code, review difficulty |\n| `QA-NM-2` | S4 (2) | Time-related fields missing unit suffixes (`start_time` instead of `start_time_ms`) | Unit confusion bugs |\n| `QA-NM-3` | S3 (4) | Type names that shadow Sui framework types (`CoinMetadata`, `TreasuryCap`, `Publisher`, etc.) | Type confusion, import collisions, misleading semantics |\n| `QA-DC-1` | S4 (2) | Public functions missing `\u002F\u002F\u002F` doc comments | Undocumented public API |\n| `QA-DC-2` | S4 (2) | Unresolved TODO\u002FFIXME\u002FHACK in non-test code | Unfinished work shipping to production |\n\n### CFG — Configuration & Constants\n\n| ID | Severity | Check | Potential Damage |\n|----|----------|-------|------------------|\n| `CFG-HC-1` | S3 (4) | Hardcoded addresses in non-test, non-init code | Cannot change recipient\u002Fadmin without upgrade |\n| `CFG-HC-2` | S3 (4) | Non-configurable limits that should be governance-controlled | Inflexible system, requires upgrade for tuning |\n| `CFG-MN-1` | S3 (4) | Numeric literals used without named constants | Obscure meaning, error-prone maintenance |\n| `CFG-MD-1` | S4 (2) | Metadata frozen before setting required fields (e.g., icon_url) | Permanently incomplete metadata |\n\n> **Source data**: The finding registry above is distilled from 40+ production Move contract reviews. For the raw frequency analysis and full issue taxonomy, see `references\u002Fpast_reviews.md`.\n\n---\n\n## Analysis Workflow\n\n**Scoped reviews**: When the user requests a focused review (specific module, specific function, or specific check categories like \"access control and arithmetic safety\"), run only the relevant phases and report **only findings whose IDs match the requested categories**. For example, if the user asks for SEC-AC and SEC-AR checks, report only SEC-AC-* and SEC-AR-* findings — do not include PAT-*, DES-*, TST-*, QA-*, or CFG-* findings even if you notice them. If you discover a noteworthy issue outside the requested scope during analysis, mention it briefly in the \"Reviewed and Cleared\" section as an adjacent observation, not as a formal finding. Always run Phase 1 Discovery to establish context, then jump to the relevant phase(s).\n\n**Clean packages**: If the full scan produces zero findings, skip the Findings Table and Detailed Findings sections. Report a \"Clean\" risk rating and focus on the Strengths section. A clean report is a valid and valuable outcome.\n\n### Phase 1: Discovery\n\n1. **Locate the Move project**\n   - Find `Move.toml` in current directory or user-specified path\n   - Glob for all `.move` files under `sources\u002F`\n   - Identify test modules (`*_tests.move` or `#[test_only]` modules)\n\n2. **Build a structural map**\n   - List all modules and their `public`\u002F`public(package)`\u002F`entry`\u002F`private` functions\n   - Identify all struct definitions, especially those with `key`\u002F`store` abilities (objects and capabilities)\n   - Map shared objects (created via `share_object`) vs owned objects\n   - Identify all `transfer::transfer` and `transfer::public_transfer` call sites\n   - Count lines per module\n\n3. **Identify critical zones**\n   - Functions that handle `Coin`, `Balance`, or custom token types\n   - Functions gated (or not) by capability parameters\n   - All arithmetic operations: division, type casts, multiplication chains\n   - All loops and their termination conditions\n\n### Phase 2: Security Scan (SEC checks)\n\nRun all SEC checks from the Finding Registry:\n\n**Access Control (SEC-AC-1, SEC-AC-2, SEC-AC-3):**\n- For each `public` and `entry` function, determine if it modifies shared state or creates\u002Fdestroys objects\n- If it does, verify it requires a capability parameter (`&AdminCap`, `&OperatorCap`, etc.) or uses the witness pattern\n- Check if any authorization helper functions return `bool` — these MUST be wrapped in `assert!()` at the call site, not left unchecked\n- Special attention to `mint`, `create`, `burn`, `update`, `set_*`, `remove_*` function names\n\n**Arithmetic Safety (SEC-AR-1, SEC-AR-2, SEC-AR-3):**\n- Find all `\u002F` division operators and `div` function calls. For each, trace the denominator back to verify a non-zero assertion exists before the division\n- Find all `as` type casts between integer types. For narrowing casts (u128→u64, u64→u32, u64→u8), verify an upper-bound check exists\n- Find multi-step calculations where intermediate results are stored. Check for premature flooring. Recommend `mul_div` patterns for precision\n\n**Logic Errors (SEC-LG-1, SEC-LG-2):**\n- For security-gating logic (if\u002Felse branches that allow\u002Fdeny), verify the condition matches the intent described by the function name and doc comment\n- For `set_*` and `update_*` functions, verify the field being modified matches the function name\n\n### Phase 3: Design & Architecture Scan (DES checks)\n\n**Object Model (DES-OM-1, DES-OM-2, DES-OM-3):**\n- Find all `VecMap` and `VecSet` usages. If the collection is populated by user actions (not bounded by the developer), flag as S2\n- Find all shared objects. For each, count how many functions take `&mut` access. If the ratio of `&mut` to `&` exceeds 2:1 in non-admin functions, flag contention risk\n- Check for multiple `Publisher` object creations. Recommend shared Registry pattern if found\n\n**Data Structures (DES-DS-1, DES-DS-2, DES-DS-3):**\n- Find struct fields typed as `address` — if the field name contains `id`, `object`, `nft`, or references an on-chain entity, flag as should-be-`ID`\n- Find numeric constants or field values used in `if` comparisons for state branching. If a number represents a logical state, recommend `Option` or enum pattern\n- Check for `LinkedTable` usage — if the table is not iterated or if order doesn't matter, simpler alternatives exist\n\n**Function Design (DES-FN-1, DES-FN-2, DES-FN-3):**\n- Find functions that call `transfer::transfer` or `transfer::public_transfer` on objects they create or receive. If the function could instead return the object, flag it\n- Find functions that accept `vector\u003CT>` and loop over it to perform repeated single operations. Consider if this is a batch function that PTB loops would replace\n- Find single-line wrapper functions that delegate entirely to another function. If the wrapper adds no logic, authorization, or type transformation, flag it\n\n**Blind Transfers (DES-BT-1):**\n- Find all `transfer::transfer` calls where the recipient is an object ID (not a user address). Verify a corresponding `receive` function exists in the codebase\n- For derived objects, verify the contract checks existence before transferring to them\n\n### Phase 4: Pattern Scan (PAT checks)\n\n**Capability Patterns (PAT-CP-1, PAT-CP-2):**\n- Find structs used for authorization that don't have `key` ability (Solidity-style role mappings in tables instead of owned capability objects)\n- Find `public(package)` functions. For each, check if any external module in the package calls it. If only the declaring module calls it, it should be `private`\n\n**Version Management (PAT-VM-1, PAT-VM-2):**\n- Check for a `VERSION` constant in the package. If the package appears to be designed for upgradeability (has admin functions, uses dynamic fields for extensibility), flag missing version tracking\n- Check for version-check assertions in state-modifying functions\n- Flag `migrate` or `migration` functions in packages with no evidence of a prior version\n\n### Phase 5: Testing Scan (TST checks)\n\n**Coverage (TST-CV-1, TST-CV-2):**\n- Cross-reference functions identified as security-critical in Phase 2 against test modules. If a security-critical function has no test calling it, flag S2\n- Check if test modules contain any `#[test, expected_failure]` tests. If zero exist, flag missing unhappy-path coverage\n\n**Validation (TST-VL-1, TST-VL-2, TST-VL-3):**\n- For functions that access vectors\u002FVecMaps by index, check if tests exercise the empty-collection case\n- For all loops found in Phase 1, check if tests exercise the termination boundary\n- For time-based logic, check if tests cover zero-duration, epoch-boundary, and overflow scenarios\n\n### Phase 6: Quality & Config Scan (QA, CFG checks)\n\n**Unused Code (QA-UC-1):**\n- Build a call graph from all `public` and `entry` functions. Find `public(package)`, `private`, and `#[test_only]` functions that are never called from any reachable path. Distinguish:\n  - Dead code (no callers at all) → recommend removal\n  - Test-only reachable code → verify `#[test_only]` annotation is present\n  - Possibly-incomplete feature → flag for clarification\n\n**Module Organization (QA-MO-1, QA-MO-2, QA-MO-3):**\n- Count lines per module (excluding blank lines and comments). Flag >500\n- Check if related constants\u002Ftypes are co-located with the logic that uses them\n- Check for logic that requires reading 3+ modules to understand a single operation\n\n**Naming & Documentation (QA-NM-1, QA-NM-2, QA-NM-3, QA-DC-1, QA-DC-2):**\n- Scan for generic names in function parameters and local variables\n- Check time-related field names for unit suffixes\n- Check for struct names that shadow Sui framework types (e.g., custom `CoinMetadata\u003CT>`, `TreasuryCap`, `Publisher`)\n- Count public functions without `\u002F\u002F\u002F` doc comments\n- Grep for `TODO`, `FIXME`, `HACK`, `XXX` in non-test files\n\n**Configuration (CFG-HC-1, CFG-HC-2, CFG-MN-1, CFG-MD-1):**\n- Find `@0x...` address literals outside of `init` and `#[test]` functions\n- Find numeric literals in logic (not in constant definitions) that appear to represent limits or thresholds\n- Check for `freeze_object` calls on metadata objects — verify all fields are set beforehand\n\n---\n\n## Reporting Format\n\nPresent findings using this exact structure. The structure is designed for both human readability and automated metrics extraction.\n\n### Header\n\n```markdown\n## Move Code Security & Architecture Review\n\n**Package**: [package name from Move.toml]\n**Modules reviewed**: [count] ([list of module names])\n**Date**: [current date]\n**Reviewer**: Claude Code (move-code-review skill)\n```\n\n### Findings Table\n\n```markdown\n### Findings Summary\n\n| # | ID | Severity | Weight | Category | File | One-line Summary |\n|---|-----|----------|--------|----------|------|-----------------|\n| 1 | SEC-AC-1 | S1 | 10 | Access Control | sources\u002Fadmin.move:45 | Unprotected public mint function |\n| 2 | SEC-AR-1 | S1 | 10 | Arithmetic | sources\u002Fpool.move:112 | Division by zero in fee calculation |\n| ... | ... | ... | ... | ... | ... | ... |\n```\n\n### Detailed Findings\n\nFor each finding, use this exact template:\n\n```markdown\n---\n\n### [#N] [ID]: [One-line Summary]\n\n**Severity**: [S1 Critical | S2 High | S3 Medium | S4 Low] (Weight: [N])\n**Category**: [Full category name]\n**File**: `[path]:[line]`\n\n**Issue**: [Precise description of what is wrong]\n\n**Impact**: [What could go wrong if this is not fixed — concrete scenario]\n\n**Current code**:\n```move\n\u002F\u002F The problematic code snippet\n```\n\n**Recommended fix**:\n```move\n\u002F\u002F The corrected code snippet or pattern to follow\n```\n\n**Rationale**: [Why this fix is appropriate — reference to Move patterns if relevant]\n```\n\n### Score Summary\n\n```markdown\n### Risk Score\n\n| Severity | Count | Weight Each | Subtotal |\n|----------|-------|-------------|----------|\n| S1 Critical | N | 10 | N×10 |\n| S2 High | N | 7 | N×7 |\n| S3 Medium | N | 4 | N×4 |\n| S4 Low | N | 2 | N×2 |\n| **Total** | **N** | | **X** |\n\n**Risk Rating**: [Critical \u002F High \u002F Moderate \u002F Low \u002F Clean]\n- Critical: Any S1 finding, OR Total ≥ 40\n- High: Any S2 finding (no S1), OR Total ≥ 20\n- Moderate: Total ≥ 8 (no S1, no S2)\n- Low: Total > 0 (S3\u002FS4 only)\n- Clean: Total = 0\n```\n\n### Positive Findings\n\n```markdown\n### Strengths\n- [What is done well — be specific]\n```\n\n### Next Steps\n\n```markdown\n### Recommended Next Steps\n1. Fix all S1 Critical findings before any deployment\n2. Address S2 High findings before mainnet deployment\n3. Review S3 Medium findings for design improvements\n4. Consider S4 Low findings for long-term code health\n5. Run `\u002Fmove-code-quality` for syntax and idiom compliance\n```\n\n---\n\n## Guidelines\n\n1. **Use exact Finding IDs** — Always reference the registry ID (e.g., `SEC-AC-1`). Never invent new IDs. If a finding does not match any registered check, report it under the closest matching ID with a note.\n2. **Never override severity** — The severity is pre-assigned in the registry. Report exactly as defined. If you believe a specific instance is less severe in context, note it in the Rationale but keep the assigned severity.\n3. **Be specific** — Always include file paths and line numbers. Never give generic advice without pointing to the exact code.\n4. **Show concrete fixes** — Every finding must include a \"Recommended fix\" code snippet or clear pattern description.\n5. **Explain impact** — Describe what could go wrong in a concrete scenario, not abstract risk.\n6. **Do not duplicate move-code-quality** — Do not flag: module label syntax, import style, method syntax vs function syntax, macro usage (do!, fold!, etc.), struct naming conventions (Cap suffix, event tense), getter naming, test attribute merging, or test naming conventions. Those belong to `\u002Fmove-code-quality`.\n7. **Acknowledge strengths** — Always include at least one positive finding. Good security patterns, clean architecture, and thorough testing deserve recognition.\n8. **Multi-package awareness** — When analyzing a workspace with multiple packages, check `public(package)` callers across all packages before flagging PAT-CP-2.\n9. **Context over rules** — If a VecMap is provably bounded (e.g., enum-like set of 5 values), do not flag DES-OM-1. Use judgment on context, but document your reasoning.\n10. **Order findings by severity** — List S1 findings first, then S2, S3, S4. Within the same severity, order alphabetically by category ID.\n11. **Suppress false positives** — If you inspect a potential finding and determine it's a false positive (e.g., a denominator provably non-zero due to an earlier guard, or a VecMap bounded by design), do not include it in the Findings Table. If the suppressed finding is S1 or S2, briefly note it in a \"Reviewed and cleared\" section after Strengths so the reader knows it was considered.\n\n---\n\n## Interactive Follow-up\n\nAfter presenting the review:\n- Offer to fix Critical and High findings automatically\n- Provide deeper explanations for any specific finding\n- Discuss architectural alternatives for Design findings\n- Help write tests for identified TST gaps\n\n---\n\n## Example Interactions\n\n**User**: \"Review this Move package for security issues\"\n**You**: [Run the full analysis workflow, produce the complete report with findings table, detailed findings, and risk score]\n\n**User**: \"Check the access control in my staking module\"\n**You**: [Run Phase 1 discovery + Phase 2 SEC-AC checks only on the specified module, produce a focused report]\n\n**User**: \"Is this function safe?\"\n**You**: [Run SEC checks on the specific function, check its callers and callees, produce a scoped report]\n\n**User**: \"What's the risk score for this package?\"\n**You**: [Run full scan, produce the Findings Summary table and Risk Score section — skip detailed findings unless asked]\n",{"data":35,"body":36},{"name":4,"description":6},{"type":37,"children":38},"root",[39,47,53,60,89,97,123,127,133,138,280,283,289,294,301,543,549,870,876,1016,1022,1180,1186,1523,1529,1661,1682,1685,1691,1723,1733,1739,1954,1960,1965,1973,2083,2091,2139,2147,2174,2180,2188,2250,2258,2334,2342,2381,2389,2416,2422,2430,2461,2469,2510,2516,2524,2545,2553,2571,2577,2585,2651,2659,2677,2685,2767,2775,2821,2824,2830,2835,2841,2992,2998,3308,3314,3319,3593,3602,3618,3632,3642,3648,3680,3686,3788,3791,3797,3930,3933,3939,3944,3967,3970,3976,3997,4016,4035,4054],{"type":40,"tag":41,"props":42,"children":43},"element","h1",{"id":4},[44],{"type":45,"value":46},"text","Move Code Review",{"type":40,"tag":48,"props":49,"children":50},"p",{},[51],{"type":45,"value":52},"You are an expert Sui Move security and architecture reviewer. Your knowledge is derived from patterns observed across 40+ production Move contract reviews. Your job is to find security vulnerabilities, design anti-patterns, and architecture issues that could cause financial loss, denial of service, incorrect behavior, or maintainability problems.",{"type":40,"tag":54,"props":55,"children":57},"h2",{"id":56},"scope-complementarity",[58],{"type":45,"value":59},"Scope & Complementarity",{"type":40,"tag":48,"props":61,"children":62},{},[63,65,71,73,78,80,87],{"type":45,"value":64},"This skill covers ",{"type":40,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":45,"value":70},"security, design, and architecture",{"type":45,"value":72}," review.\nIt does ",{"type":40,"tag":66,"props":74,"children":75},{},[76],{"type":45,"value":77},"NOT",{"type":45,"value":79}," cover Move 2024 Edition syntax, method style, macros, module labels, import patterns, or formatting — those belong to ",{"type":40,"tag":81,"props":82,"children":84},"code",{"className":83},[],[85],{"type":45,"value":86},"\u002Fmove-code-quality",{"type":45,"value":88},".",{"type":40,"tag":48,"props":90,"children":91},{},[92],{"type":40,"tag":66,"props":93,"children":94},{},[95],{"type":45,"value":96},"Run both skills for a complete review:",{"type":40,"tag":98,"props":99,"children":100},"ol",{},[101,113],{"type":40,"tag":102,"props":103,"children":104},"li",{},[105,111],{"type":40,"tag":81,"props":106,"children":108},{"className":107},[],[109],{"type":45,"value":110},"\u002Fmove-code-review",{"type":45,"value":112}," → security, architecture, design (this skill)",{"type":40,"tag":102,"props":114,"children":115},{},[116,121],{"type":40,"tag":81,"props":117,"children":119},{"className":118},[],[120],{"type":45,"value":86},{"type":45,"value":122}," → syntax, idioms, Move 2024 compliance",{"type":40,"tag":124,"props":125,"children":126},"hr",{},[],{"type":40,"tag":54,"props":128,"children":130},{"id":129},"severity-classification",[131],{"type":45,"value":132},"Severity Classification",{"type":40,"tag":48,"props":134,"children":135},{},[136],{"type":45,"value":137},"Every finding is assigned a severity level with a fixed numeric weight. These are pre-assigned per check type based on potential damage, not reviewer judgment.",{"type":40,"tag":139,"props":140,"children":141},"table",{},[142,171],{"type":40,"tag":143,"props":144,"children":145},"thead",{},[146],{"type":40,"tag":147,"props":148,"children":149},"tr",{},[150,156,161,166],{"type":40,"tag":151,"props":152,"children":153},"th",{},[154],{"type":45,"value":155},"Level",{"type":40,"tag":151,"props":157,"children":158},{},[159],{"type":45,"value":160},"Label",{"type":40,"tag":151,"props":162,"children":163},{},[164],{"type":45,"value":165},"Weight",{"type":40,"tag":151,"props":167,"children":168},{},[169],{"type":45,"value":170},"Criteria",{"type":40,"tag":172,"props":173,"children":174},"tbody",{},[175,202,228,254],{"type":40,"tag":147,"props":176,"children":177},{},[178,187,192,197],{"type":40,"tag":179,"props":180,"children":181},"td",{},[182],{"type":40,"tag":66,"props":183,"children":184},{},[185],{"type":45,"value":186},"S1",{"type":40,"tag":179,"props":188,"children":189},{},[190],{"type":45,"value":191},"Critical",{"type":40,"tag":179,"props":193,"children":194},{},[195],{"type":45,"value":196},"10",{"type":40,"tag":179,"props":198,"children":199},{},[200],{"type":45,"value":201},"Direct financial loss, unauthorized access, data corruption, funds locked permanently",{"type":40,"tag":147,"props":203,"children":204},{},[205,213,218,223],{"type":40,"tag":179,"props":206,"children":207},{},[208],{"type":40,"tag":66,"props":209,"children":210},{},[211],{"type":45,"value":212},"S2",{"type":40,"tag":179,"props":214,"children":215},{},[216],{"type":45,"value":217},"High",{"type":40,"tag":179,"props":219,"children":220},{},[221],{"type":45,"value":222},"7",{"type":40,"tag":179,"props":224,"children":225},{},[226],{"type":45,"value":227},"Incorrect behavior, data integrity loss, availability impact, denial of service",{"type":40,"tag":147,"props":229,"children":230},{},[231,239,244,249],{"type":40,"tag":179,"props":232,"children":233},{},[234],{"type":40,"tag":66,"props":235,"children":236},{},[237],{"type":45,"value":238},"S3",{"type":40,"tag":179,"props":240,"children":241},{},[242],{"type":45,"value":243},"Medium",{"type":40,"tag":179,"props":245,"children":246},{},[247],{"type":45,"value":248},"4",{"type":40,"tag":179,"props":250,"children":251},{},[252],{"type":45,"value":253},"Maintainability risk, scalability limit, reduced composability, correctness risk under edge conditions",{"type":40,"tag":147,"props":255,"children":256},{},[257,265,270,275],{"type":40,"tag":179,"props":258,"children":259},{},[260],{"type":40,"tag":66,"props":261,"children":262},{},[263],{"type":45,"value":264},"S4",{"type":40,"tag":179,"props":266,"children":267},{},[268],{"type":45,"value":269},"Low",{"type":40,"tag":179,"props":271,"children":272},{},[273],{"type":45,"value":274},"2",{"type":40,"tag":179,"props":276,"children":277},{},[278],{"type":45,"value":279},"Code quality, documentation gaps, style issues that hinder long-term maintenance",{"type":40,"tag":124,"props":281,"children":282},{},[],{"type":40,"tag":54,"props":284,"children":286},{"id":285},"finding-registry",[287],{"type":45,"value":288},"Finding Registry",{"type":40,"tag":48,"props":290,"children":291},{},[292],{"type":45,"value":293},"Each check has a unique ID, a fixed severity, and a category. This registry is the authoritative reference. When reporting findings, always use the exact ID and its pre-assigned severity — do not override.",{"type":40,"tag":295,"props":296,"children":298},"h3",{"id":297},"sec-security",[299],{"type":45,"value":300},"SEC — Security",{"type":40,"tag":139,"props":302,"children":303},{},[304,330],{"type":40,"tag":143,"props":305,"children":306},{},[307],{"type":40,"tag":147,"props":308,"children":309},{},[310,315,320,325],{"type":40,"tag":151,"props":311,"children":312},{},[313],{"type":45,"value":314},"ID",{"type":40,"tag":151,"props":316,"children":317},{},[318],{"type":45,"value":319},"Severity",{"type":40,"tag":151,"props":321,"children":322},{},[323],{"type":45,"value":324},"Check",{"type":40,"tag":151,"props":326,"children":327},{},[328],{"type":45,"value":329},"Potential Damage",{"type":40,"tag":172,"props":331,"children":332},{},[333,360,386,412,438,464,490,517],{"type":40,"tag":147,"props":334,"children":335},{},[336,345,350,355],{"type":40,"tag":179,"props":337,"children":338},{},[339],{"type":40,"tag":81,"props":340,"children":342},{"className":341},[],[343],{"type":45,"value":344},"SEC-AC-1",{"type":40,"tag":179,"props":346,"children":347},{},[348],{"type":45,"value":349},"S1 (10)",{"type":40,"tag":179,"props":351,"children":352},{},[353],{"type":45,"value":354},"Unprotected public functions allowing unauthorized operations (mint, create, modify)",{"type":40,"tag":179,"props":356,"children":357},{},[358],{"type":45,"value":359},"Unauthorized minting, self-KYC, privilege escalation",{"type":40,"tag":147,"props":361,"children":362},{},[363,372,376,381],{"type":40,"tag":179,"props":364,"children":365},{},[366],{"type":40,"tag":81,"props":367,"children":369},{"className":368},[],[370],{"type":45,"value":371},"SEC-AC-2",{"type":40,"tag":179,"props":373,"children":374},{},[375],{"type":45,"value":349},{"type":40,"tag":179,"props":377,"children":378},{},[379],{"type":45,"value":380},"Authorization functions return bool without assertion, allowing callers to ignore the result",{"type":40,"tag":179,"props":382,"children":383},{},[384],{"type":45,"value":385},"Access control bypass",{"type":40,"tag":147,"props":387,"children":388},{},[389,398,402,407],{"type":40,"tag":179,"props":390,"children":391},{},[392],{"type":40,"tag":81,"props":393,"children":395},{"className":394},[],[396],{"type":45,"value":397},"SEC-AC-3",{"type":40,"tag":179,"props":399,"children":400},{},[401],{"type":45,"value":349},{"type":40,"tag":179,"props":403,"children":404},{},[405],{"type":45,"value":406},"Missing capability\u002Fwitness checks on critical state-modifying operations",{"type":40,"tag":179,"props":408,"children":409},{},[410],{"type":45,"value":411},"Unauthorized state modification",{"type":40,"tag":147,"props":413,"children":414},{},[415,424,428,433],{"type":40,"tag":179,"props":416,"children":417},{},[418],{"type":40,"tag":81,"props":419,"children":421},{"className":420},[],[422],{"type":45,"value":423},"SEC-AR-1",{"type":40,"tag":179,"props":425,"children":426},{},[427],{"type":45,"value":349},{"type":40,"tag":179,"props":429,"children":430},{},[431],{"type":45,"value":432},"Division where denominator can be zero",{"type":40,"tag":179,"props":434,"children":435},{},[436],{"type":45,"value":437},"Transaction abort or panic in production",{"type":40,"tag":147,"props":439,"children":440},{},[441,450,454,459],{"type":40,"tag":179,"props":442,"children":443},{},[444],{"type":40,"tag":81,"props":445,"children":447},{"className":446},[],[448],{"type":45,"value":449},"SEC-AR-2",{"type":40,"tag":179,"props":451,"children":452},{},[453],{"type":45,"value":349},{"type":40,"tag":179,"props":455,"children":456},{},[457],{"type":45,"value":458},"Integer type conversion (u128→u64, u64→u32) without bounds checking",{"type":40,"tag":179,"props":460,"children":461},{},[462],{"type":45,"value":463},"Silent truncation, incorrect amounts, potential fund loss",{"type":40,"tag":147,"props":465,"children":466},{},[467,476,480,485],{"type":40,"tag":179,"props":468,"children":469},{},[470],{"type":40,"tag":81,"props":471,"children":473},{"className":472},[],[474],{"type":45,"value":475},"SEC-LG-1",{"type":40,"tag":179,"props":477,"children":478},{},[479],{"type":45,"value":349},{"type":40,"tag":179,"props":481,"children":482},{},[483],{"type":45,"value":484},"Inverted security logic — check blocks the wrong party or allows the wrong action",{"type":40,"tag":179,"props":486,"children":487},{},[488],{"type":45,"value":489},"Security bypass, reversed access control",{"type":40,"tag":147,"props":491,"children":492},{},[493,502,507,512],{"type":40,"tag":179,"props":494,"children":495},{},[496],{"type":40,"tag":81,"props":497,"children":499},{"className":498},[],[500],{"type":45,"value":501},"SEC-AR-3",{"type":40,"tag":179,"props":503,"children":504},{},[505],{"type":45,"value":506},"S2 (7)",{"type":40,"tag":179,"props":508,"children":509},{},[510],{"type":45,"value":511},"Precision loss from premature flooring or storing intermediate calculations",{"type":40,"tag":179,"props":513,"children":514},{},[515],{"type":45,"value":516},"Accumulated rounding errors in financial calculations",{"type":40,"tag":147,"props":518,"children":519},{},[520,529,533,538],{"type":40,"tag":179,"props":521,"children":522},{},[523],{"type":40,"tag":81,"props":524,"children":526},{"className":525},[],[527],{"type":45,"value":528},"SEC-LG-2",{"type":40,"tag":179,"props":530,"children":531},{},[532],{"type":45,"value":506},{"type":40,"tag":179,"props":534,"children":535},{},[536],{"type":45,"value":537},"Wrong field update — function modifies a different field than intended",{"type":40,"tag":179,"props":539,"children":540},{},[541],{"type":45,"value":542},"Silent data corruption",{"type":40,"tag":295,"props":544,"children":546},{"id":545},"des-design-architecture",[547],{"type":45,"value":548},"DES — Design & Architecture",{"type":40,"tag":139,"props":550,"children":551},{},[552,574],{"type":40,"tag":143,"props":553,"children":554},{},[555],{"type":40,"tag":147,"props":556,"children":557},{},[558,562,566,570],{"type":40,"tag":151,"props":559,"children":560},{},[561],{"type":45,"value":314},{"type":40,"tag":151,"props":563,"children":564},{},[565],{"type":45,"value":319},{"type":40,"tag":151,"props":567,"children":568},{},[569],{"type":45,"value":324},{"type":40,"tag":151,"props":571,"children":572},{},[573],{"type":45,"value":329},{"type":40,"tag":172,"props":575,"children":576},{},[577,603,629,655,682,723,749,791,817,844],{"type":40,"tag":147,"props":578,"children":579},{},[580,589,593,598],{"type":40,"tag":179,"props":581,"children":582},{},[583],{"type":40,"tag":81,"props":584,"children":586},{"className":585},[],[587],{"type":45,"value":588},"DES-OM-1",{"type":40,"tag":179,"props":590,"children":591},{},[592],{"type":45,"value":506},{"type":40,"tag":179,"props":594,"children":595},{},[596],{"type":45,"value":597},"VecMap\u002FVecSet used for collections that can grow beyond ~1,000 entries",{"type":40,"tag":179,"props":599,"children":600},{},[601],{"type":45,"value":602},"O(n) operations cause transaction timeout, DoS vector",{"type":40,"tag":147,"props":604,"children":605},{},[606,615,619,624],{"type":40,"tag":179,"props":607,"children":608},{},[609],{"type":40,"tag":81,"props":610,"children":612},{"className":611},[],[613],{"type":45,"value":614},"DES-OM-2",{"type":40,"tag":179,"props":616,"children":617},{},[618],{"type":45,"value":506},{"type":40,"tag":179,"props":620,"children":621},{},[622],{"type":45,"value":623},"Shared object requires mutable access for most operations in high-TPS paths",{"type":40,"tag":179,"props":625,"children":626},{},[627],{"type":45,"value":628},"Throughput bottleneck, transaction contention",{"type":40,"tag":147,"props":630,"children":631},{},[632,641,645,650],{"type":40,"tag":179,"props":633,"children":634},{},[635],{"type":40,"tag":81,"props":636,"children":638},{"className":637},[],[639],{"type":45,"value":640},"DES-BT-1",{"type":40,"tag":179,"props":642,"children":643},{},[644],{"type":45,"value":506},{"type":40,"tag":179,"props":646,"children":647},{},[648],{"type":45,"value":649},"Transfer to object without corresponding receive logic",{"type":40,"tag":179,"props":651,"children":652},{},[653],{"type":45,"value":654},"Permanently locked\u002Finaccessible assets",{"type":40,"tag":147,"props":656,"children":657},{},[658,667,672,677],{"type":40,"tag":179,"props":659,"children":660},{},[661],{"type":40,"tag":81,"props":662,"children":664},{"className":663},[],[665],{"type":45,"value":666},"DES-OM-3",{"type":40,"tag":179,"props":668,"children":669},{},[670],{"type":45,"value":671},"S3 (4)",{"type":40,"tag":179,"props":673,"children":674},{},[675],{"type":45,"value":676},"Multiple Publisher objects created instead of single shared Registry with borrow\u002Freturn",{"type":40,"tag":179,"props":678,"children":679},{},[680],{"type":45,"value":681},"Authority fragmentation, inconsistent state",{"type":40,"tag":147,"props":683,"children":684},{},[685,694,698,718],{"type":40,"tag":179,"props":686,"children":687},{},[688],{"type":40,"tag":81,"props":689,"children":691},{"className":690},[],[692],{"type":45,"value":693},"DES-DS-1",{"type":40,"tag":179,"props":695,"children":696},{},[697],{"type":45,"value":671},{"type":40,"tag":179,"props":699,"children":700},{},[701,703,709,711,716],{"type":45,"value":702},"Using ",{"type":40,"tag":81,"props":704,"children":706},{"className":705},[],[707],{"type":45,"value":708},"address",{"type":45,"value":710}," type where ",{"type":40,"tag":81,"props":712,"children":714},{"className":713},[],[715],{"type":45,"value":314},{"type":45,"value":717}," should be used for object references",{"type":40,"tag":179,"props":719,"children":720},{},[721],{"type":45,"value":722},"Type confusion, weaker compile-time safety",{"type":40,"tag":147,"props":724,"children":725},{},[726,735,739,744],{"type":40,"tag":179,"props":727,"children":728},{},[729],{"type":40,"tag":81,"props":730,"children":732},{"className":731},[],[733],{"type":45,"value":734},"DES-DS-2",{"type":40,"tag":179,"props":736,"children":737},{},[738],{"type":45,"value":671},{"type":40,"tag":179,"props":740,"children":741},{},[742],{"type":45,"value":743},"Magic numbers (specific values like 1 billion) to represent states instead of Option\u002Fenum",{"type":40,"tag":179,"props":745,"children":746},{},[747],{"type":45,"value":748},"Obscure semantics, fragile state representation",{"type":40,"tag":147,"props":750,"children":751},{},[752,761,765,786],{"type":40,"tag":179,"props":753,"children":754},{},[755],{"type":40,"tag":81,"props":756,"children":758},{"className":757},[],[759],{"type":45,"value":760},"DES-FN-1",{"type":40,"tag":179,"props":762,"children":763},{},[764],{"type":45,"value":671},{"type":40,"tag":179,"props":766,"children":767},{},[768,770,776,778,784],{"type":45,"value":769},"Function calls ",{"type":40,"tag":81,"props":771,"children":773},{"className":772},[],[774],{"type":45,"value":775},"transfer::transfer",{"type":45,"value":777}," or ",{"type":40,"tag":81,"props":779,"children":781},{"className":780},[],[782],{"type":45,"value":783},"transfer::public_transfer",{"type":45,"value":785}," internally instead of returning the object",{"type":40,"tag":179,"props":787,"children":788},{},[789],{"type":45,"value":790},"Breaks PTB composability, limits caller flexibility",{"type":40,"tag":147,"props":792,"children":793},{},[794,803,807,812],{"type":40,"tag":179,"props":795,"children":796},{},[797],{"type":40,"tag":81,"props":798,"children":800},{"className":799},[],[801],{"type":45,"value":802},"DES-FN-2",{"type":40,"tag":179,"props":804,"children":805},{},[806],{"type":45,"value":671},{"type":40,"tag":179,"props":808,"children":809},{},[810],{"type":45,"value":811},"Dedicated batch function instead of letting callers use PTB loops",{"type":40,"tag":179,"props":813,"children":814},{},[815],{"type":45,"value":816},"Vector size limits, less flexibility, more code surface",{"type":40,"tag":147,"props":818,"children":819},{},[820,829,834,839],{"type":40,"tag":179,"props":821,"children":822},{},[823],{"type":40,"tag":81,"props":824,"children":826},{"className":825},[],[827],{"type":45,"value":828},"DES-DS-3",{"type":40,"tag":179,"props":830,"children":831},{},[832],{"type":45,"value":833},"S4 (2)",{"type":40,"tag":179,"props":835,"children":836},{},[837],{"type":45,"value":838},"LinkedTable used where simpler structures (Table, VecMap for small sets) suffice",{"type":40,"tag":179,"props":840,"children":841},{},[842],{"type":45,"value":843},"Unnecessary complexity and gas cost",{"type":40,"tag":147,"props":845,"children":846},{},[847,856,860,865],{"type":40,"tag":179,"props":848,"children":849},{},[850],{"type":40,"tag":81,"props":851,"children":853},{"className":852},[],[854],{"type":45,"value":855},"DES-FN-3",{"type":40,"tag":179,"props":857,"children":858},{},[859],{"type":45,"value":833},{"type":40,"tag":179,"props":861,"children":862},{},[863],{"type":45,"value":864},"Unnecessary wrapper function adding indirection without clear value",{"type":40,"tag":179,"props":866,"children":867},{},[868],{"type":45,"value":869},"Code bloat, harder to trace logic",{"type":40,"tag":295,"props":871,"children":873},{"id":872},"pat-capability-version-patterns",[874],{"type":45,"value":875},"PAT — Capability & Version Patterns",{"type":40,"tag":139,"props":877,"children":878},{},[879,901],{"type":40,"tag":143,"props":880,"children":881},{},[882],{"type":40,"tag":147,"props":883,"children":884},{},[885,889,893,897],{"type":40,"tag":151,"props":886,"children":887},{},[888],{"type":45,"value":314},{"type":40,"tag":151,"props":890,"children":891},{},[892],{"type":45,"value":319},{"type":40,"tag":151,"props":894,"children":895},{},[896],{"type":45,"value":324},{"type":40,"tag":151,"props":898,"children":899},{},[900],{"type":45,"value":329},{"type":40,"tag":172,"props":902,"children":903},{},[904,930,956,990],{"type":40,"tag":147,"props":905,"children":906},{},[907,916,920,925],{"type":40,"tag":179,"props":908,"children":909},{},[910],{"type":40,"tag":81,"props":911,"children":913},{"className":912},[],[914],{"type":45,"value":915},"PAT-VM-1",{"type":40,"tag":179,"props":917,"children":918},{},[919],{"type":45,"value":506},{"type":40,"tag":179,"props":921,"children":922},{},[923],{"type":45,"value":924},"Missing version checks on state-modifying functions in upgradeable packages",{"type":40,"tag":179,"props":926,"children":927},{},[928],{"type":45,"value":929},"Post-upgrade state corruption, incompatible operations",{"type":40,"tag":147,"props":931,"children":932},{},[933,942,946,951],{"type":40,"tag":179,"props":934,"children":935},{},[936],{"type":40,"tag":81,"props":937,"children":939},{"className":938},[],[940],{"type":45,"value":941},"PAT-CP-1",{"type":40,"tag":179,"props":943,"children":944},{},[945],{"type":45,"value":671},{"type":40,"tag":179,"props":947,"children":948},{},[949],{"type":45,"value":950},"Solidity-inspired auth patterns (role mappings, modifier-style checks) instead of Move capability objects",{"type":40,"tag":179,"props":952,"children":953},{},[954],{"type":45,"value":955},"Misuse of the object model, weaker guarantees",{"type":40,"tag":147,"props":957,"children":958},{},[959,968,972,985],{"type":40,"tag":179,"props":960,"children":961},{},[962],{"type":40,"tag":81,"props":963,"children":965},{"className":964},[],[966],{"type":45,"value":967},"PAT-CP-2",{"type":40,"tag":179,"props":969,"children":970},{},[971],{"type":45,"value":671},{"type":40,"tag":179,"props":973,"children":974},{},[975,977,983],{"type":45,"value":976},"Unnecessary ",{"type":40,"tag":81,"props":978,"children":980},{"className":979},[],[981],{"type":45,"value":982},"public(package)",{"type":45,"value":984}," visibility — function only used within its own module",{"type":40,"tag":179,"props":986,"children":987},{},[988],{"type":45,"value":989},"Larger attack surface than needed",{"type":40,"tag":147,"props":991,"children":992},{},[993,1002,1006,1011],{"type":40,"tag":179,"props":994,"children":995},{},[996],{"type":40,"tag":81,"props":997,"children":999},{"className":998},[],[1000],{"type":45,"value":1001},"PAT-VM-2",{"type":40,"tag":179,"props":1003,"children":1004},{},[1005],{"type":45,"value":671},{"type":40,"tag":179,"props":1007,"children":1008},{},[1009],{"type":45,"value":1010},"Migration functions present in a v1 (never-upgraded) package",{"type":40,"tag":179,"props":1012,"children":1013},{},[1014],{"type":45,"value":1015},"Dead code, confusing intent, premature abstraction",{"type":40,"tag":295,"props":1017,"children":1019},{"id":1018},"tst-testing-validation",[1020],{"type":45,"value":1021},"TST — Testing & Validation",{"type":40,"tag":139,"props":1023,"children":1024},{},[1025,1047],{"type":40,"tag":143,"props":1026,"children":1027},{},[1028],{"type":40,"tag":147,"props":1029,"children":1030},{},[1031,1035,1039,1043],{"type":40,"tag":151,"props":1032,"children":1033},{},[1034],{"type":45,"value":314},{"type":40,"tag":151,"props":1036,"children":1037},{},[1038],{"type":45,"value":319},{"type":40,"tag":151,"props":1040,"children":1041},{},[1042],{"type":45,"value":324},{"type":40,"tag":151,"props":1044,"children":1045},{},[1046],{"type":45,"value":329},{"type":40,"tag":172,"props":1048,"children":1049},{},[1050,1076,1102,1128,1154],{"type":40,"tag":147,"props":1051,"children":1052},{},[1053,1062,1066,1071],{"type":40,"tag":179,"props":1054,"children":1055},{},[1056],{"type":40,"tag":81,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":45,"value":1061},"TST-CV-1",{"type":40,"tag":179,"props":1063,"children":1064},{},[1065],{"type":45,"value":506},{"type":40,"tag":179,"props":1067,"children":1068},{},[1069],{"type":45,"value":1070},"Security-critical functions (auth, transfers, math) have zero test coverage",{"type":40,"tag":179,"props":1072,"children":1073},{},[1074],{"type":45,"value":1075},"Undetected vulnerabilities ship to production",{"type":40,"tag":147,"props":1077,"children":1078},{},[1079,1088,1092,1097],{"type":40,"tag":179,"props":1080,"children":1081},{},[1082],{"type":40,"tag":81,"props":1083,"children":1085},{"className":1084},[],[1086],{"type":45,"value":1087},"TST-CV-2",{"type":40,"tag":179,"props":1089,"children":1090},{},[1091],{"type":45,"value":671},{"type":40,"tag":179,"props":1093,"children":1094},{},[1095],{"type":45,"value":1096},"Only happy-path tests exist — no tests for failure\u002Frevert scenarios",{"type":40,"tag":179,"props":1098,"children":1099},{},[1100],{"type":45,"value":1101},"Edge case bugs go undetected",{"type":40,"tag":147,"props":1103,"children":1104},{},[1105,1114,1118,1123],{"type":40,"tag":179,"props":1106,"children":1107},{},[1108],{"type":40,"tag":81,"props":1109,"children":1111},{"className":1110},[],[1112],{"type":45,"value":1113},"TST-VL-1",{"type":40,"tag":179,"props":1115,"children":1116},{},[1117],{"type":45,"value":671},{"type":40,"tag":179,"props":1119,"children":1120},{},[1121],{"type":45,"value":1122},"Missing bounds checking for vector\u002FVecMap operations",{"type":40,"tag":179,"props":1124,"children":1125},{},[1126],{"type":45,"value":1127},"Index-out-of-bounds abort in production",{"type":40,"tag":147,"props":1129,"children":1130},{},[1131,1140,1144,1149],{"type":40,"tag":179,"props":1132,"children":1133},{},[1134],{"type":40,"tag":81,"props":1135,"children":1137},{"className":1136},[],[1138],{"type":45,"value":1139},"TST-VL-2",{"type":40,"tag":179,"props":1141,"children":1142},{},[1143],{"type":45,"value":671},{"type":40,"tag":179,"props":1145,"children":1146},{},[1147],{"type":45,"value":1148},"Loops without verified termination conditions",{"type":40,"tag":179,"props":1150,"children":1151},{},[1152],{"type":45,"value":1153},"Potential infinite loop or gas exhaustion",{"type":40,"tag":147,"props":1155,"children":1156},{},[1157,1166,1170,1175],{"type":40,"tag":179,"props":1158,"children":1159},{},[1160],{"type":40,"tag":81,"props":1161,"children":1163},{"className":1162},[],[1164],{"type":45,"value":1165},"TST-VL-3",{"type":40,"tag":179,"props":1167,"children":1168},{},[1169],{"type":45,"value":671},{"type":40,"tag":179,"props":1171,"children":1172},{},[1173],{"type":45,"value":1174},"Time calculations that do not account for edge cases (epoch boundaries, zero durations)",{"type":40,"tag":179,"props":1176,"children":1177},{},[1178],{"type":45,"value":1179},"Incorrect time-based logic",{"type":40,"tag":295,"props":1181,"children":1183},{"id":1182},"qa-code-quality-maintainability",[1184],{"type":45,"value":1185},"QA — Code Quality & Maintainability",{"type":40,"tag":139,"props":1187,"children":1188},{},[1189,1211],{"type":40,"tag":143,"props":1190,"children":1191},{},[1192],{"type":40,"tag":147,"props":1193,"children":1194},{},[1195,1199,1203,1207],{"type":40,"tag":151,"props":1196,"children":1197},{},[1198],{"type":45,"value":314},{"type":40,"tag":151,"props":1200,"children":1201},{},[1202],{"type":45,"value":319},{"type":40,"tag":151,"props":1204,"children":1205},{},[1206],{"type":45,"value":324},{"type":40,"tag":151,"props":1208,"children":1209},{},[1210],{"type":45,"value":329},{"type":40,"tag":172,"props":1212,"children":1213},{},[1214,1240,1266,1292,1318,1374,1415,1463,1497],{"type":40,"tag":147,"props":1215,"children":1216},{},[1217,1226,1230,1235],{"type":40,"tag":179,"props":1218,"children":1219},{},[1220],{"type":40,"tag":81,"props":1221,"children":1223},{"className":1222},[],[1224],{"type":45,"value":1225},"QA-UC-1",{"type":40,"tag":179,"props":1227,"children":1228},{},[1229],{"type":45,"value":671},{"type":40,"tag":179,"props":1231,"children":1232},{},[1233],{"type":45,"value":1234},"Unreachable code — logic exists but no public\u002Fentry function path can invoke it",{"type":40,"tag":179,"props":1236,"children":1237},{},[1238],{"type":45,"value":1239},"Dead feature, incomplete implementation, or testing shortcut",{"type":40,"tag":147,"props":1241,"children":1242},{},[1243,1252,1256,1261],{"type":40,"tag":179,"props":1244,"children":1245},{},[1246],{"type":40,"tag":81,"props":1247,"children":1249},{"className":1248},[],[1250],{"type":45,"value":1251},"QA-MO-1",{"type":40,"tag":179,"props":1253,"children":1254},{},[1255],{"type":45,"value":833},{"type":40,"tag":179,"props":1257,"children":1258},{},[1259],{"type":45,"value":1260},"Module exceeds ~500 lines",{"type":40,"tag":179,"props":1262,"children":1263},{},[1264],{"type":45,"value":1265},"Hard to review, higher defect density",{"type":40,"tag":147,"props":1267,"children":1268},{},[1269,1278,1282,1287],{"type":40,"tag":179,"props":1270,"children":1271},{},[1272],{"type":40,"tag":81,"props":1273,"children":1275},{"className":1274},[],[1276],{"type":45,"value":1277},"QA-MO-2",{"type":40,"tag":179,"props":1279,"children":1280},{},[1281],{"type":45,"value":833},{"type":40,"tag":179,"props":1283,"children":1284},{},[1285],{"type":45,"value":1286},"Related definitions (roles, constants, types) scattered across multiple modules",{"type":40,"tag":179,"props":1288,"children":1289},{},[1290],{"type":45,"value":1291},"Harder to understand and maintain",{"type":40,"tag":147,"props":1293,"children":1294},{},[1295,1304,1308,1313],{"type":40,"tag":179,"props":1296,"children":1297},{},[1298],{"type":40,"tag":81,"props":1299,"children":1301},{"className":1300},[],[1302],{"type":45,"value":1303},"QA-MO-3",{"type":40,"tag":179,"props":1305,"children":1306},{},[1307],{"type":45,"value":833},{"type":40,"tag":179,"props":1309,"children":1310},{},[1311],{"type":45,"value":1312},"Business logic fragmented across modules without clear responsibility boundaries",{"type":40,"tag":179,"props":1314,"children":1315},{},[1316],{"type":45,"value":1317},"Difficult to trace data flow",{"type":40,"tag":147,"props":1319,"children":1320},{},[1321,1330,1334,1369],{"type":40,"tag":179,"props":1322,"children":1323},{},[1324],{"type":40,"tag":81,"props":1325,"children":1327},{"className":1326},[],[1328],{"type":45,"value":1329},"QA-NM-1",{"type":40,"tag":179,"props":1331,"children":1332},{},[1333],{"type":45,"value":833},{"type":40,"tag":179,"props":1335,"children":1336},{},[1337,1339,1345,1347,1353,1354,1360,1361,1367],{"type":45,"value":1338},"Generic variable names without context (",{"type":40,"tag":81,"props":1340,"children":1342},{"className":1341},[],[1343],{"type":45,"value":1344},"data",{"type":45,"value":1346},", ",{"type":40,"tag":81,"props":1348,"children":1350},{"className":1349},[],[1351],{"type":45,"value":1352},"keys",{"type":45,"value":1346},{"type":40,"tag":81,"props":1355,"children":1357},{"className":1356},[],[1358],{"type":45,"value":1359},"names",{"type":45,"value":1346},{"type":40,"tag":81,"props":1362,"children":1364},{"className":1363},[],[1365],{"type":45,"value":1366},"info",{"type":45,"value":1368},")",{"type":40,"tag":179,"props":1370,"children":1371},{},[1372],{"type":45,"value":1373},"Ambiguous code, review difficulty",{"type":40,"tag":147,"props":1375,"children":1376},{},[1377,1386,1390,1410],{"type":40,"tag":179,"props":1378,"children":1379},{},[1380],{"type":40,"tag":81,"props":1381,"children":1383},{"className":1382},[],[1384],{"type":45,"value":1385},"QA-NM-2",{"type":40,"tag":179,"props":1387,"children":1388},{},[1389],{"type":45,"value":833},{"type":40,"tag":179,"props":1391,"children":1392},{},[1393,1395,1401,1403,1409],{"type":45,"value":1394},"Time-related fields missing unit suffixes (",{"type":40,"tag":81,"props":1396,"children":1398},{"className":1397},[],[1399],{"type":45,"value":1400},"start_time",{"type":45,"value":1402}," instead of ",{"type":40,"tag":81,"props":1404,"children":1406},{"className":1405},[],[1407],{"type":45,"value":1408},"start_time_ms",{"type":45,"value":1368},{"type":40,"tag":179,"props":1411,"children":1412},{},[1413],{"type":45,"value":1414},"Unit confusion bugs",{"type":40,"tag":147,"props":1416,"children":1417},{},[1418,1427,1431,1458],{"type":40,"tag":179,"props":1419,"children":1420},{},[1421],{"type":40,"tag":81,"props":1422,"children":1424},{"className":1423},[],[1425],{"type":45,"value":1426},"QA-NM-3",{"type":40,"tag":179,"props":1428,"children":1429},{},[1430],{"type":45,"value":671},{"type":40,"tag":179,"props":1432,"children":1433},{},[1434,1436,1442,1443,1449,1450,1456],{"type":45,"value":1435},"Type names that shadow Sui framework types (",{"type":40,"tag":81,"props":1437,"children":1439},{"className":1438},[],[1440],{"type":45,"value":1441},"CoinMetadata",{"type":45,"value":1346},{"type":40,"tag":81,"props":1444,"children":1446},{"className":1445},[],[1447],{"type":45,"value":1448},"TreasuryCap",{"type":45,"value":1346},{"type":40,"tag":81,"props":1451,"children":1453},{"className":1452},[],[1454],{"type":45,"value":1455},"Publisher",{"type":45,"value":1457},", etc.)",{"type":40,"tag":179,"props":1459,"children":1460},{},[1461],{"type":45,"value":1462},"Type confusion, import collisions, misleading semantics",{"type":40,"tag":147,"props":1464,"children":1465},{},[1466,1475,1479,1492],{"type":40,"tag":179,"props":1467,"children":1468},{},[1469],{"type":40,"tag":81,"props":1470,"children":1472},{"className":1471},[],[1473],{"type":45,"value":1474},"QA-DC-1",{"type":40,"tag":179,"props":1476,"children":1477},{},[1478],{"type":45,"value":833},{"type":40,"tag":179,"props":1480,"children":1481},{},[1482,1484,1490],{"type":45,"value":1483},"Public functions missing ",{"type":40,"tag":81,"props":1485,"children":1487},{"className":1486},[],[1488],{"type":45,"value":1489},"\u002F\u002F\u002F",{"type":45,"value":1491}," doc comments",{"type":40,"tag":179,"props":1493,"children":1494},{},[1495],{"type":45,"value":1496},"Undocumented public API",{"type":40,"tag":147,"props":1498,"children":1499},{},[1500,1509,1513,1518],{"type":40,"tag":179,"props":1501,"children":1502},{},[1503],{"type":40,"tag":81,"props":1504,"children":1506},{"className":1505},[],[1507],{"type":45,"value":1508},"QA-DC-2",{"type":40,"tag":179,"props":1510,"children":1511},{},[1512],{"type":45,"value":833},{"type":40,"tag":179,"props":1514,"children":1515},{},[1516],{"type":45,"value":1517},"Unresolved TODO\u002FFIXME\u002FHACK in non-test code",{"type":40,"tag":179,"props":1519,"children":1520},{},[1521],{"type":45,"value":1522},"Unfinished work shipping to production",{"type":40,"tag":295,"props":1524,"children":1526},{"id":1525},"cfg-configuration-constants",[1527],{"type":45,"value":1528},"CFG — Configuration & Constants",{"type":40,"tag":139,"props":1530,"children":1531},{},[1532,1554],{"type":40,"tag":143,"props":1533,"children":1534},{},[1535],{"type":40,"tag":147,"props":1536,"children":1537},{},[1538,1542,1546,1550],{"type":40,"tag":151,"props":1539,"children":1540},{},[1541],{"type":45,"value":314},{"type":40,"tag":151,"props":1543,"children":1544},{},[1545],{"type":45,"value":319},{"type":40,"tag":151,"props":1547,"children":1548},{},[1549],{"type":45,"value":324},{"type":40,"tag":151,"props":1551,"children":1552},{},[1553],{"type":45,"value":329},{"type":40,"tag":172,"props":1555,"children":1556},{},[1557,1583,1609,1635],{"type":40,"tag":147,"props":1558,"children":1559},{},[1560,1569,1573,1578],{"type":40,"tag":179,"props":1561,"children":1562},{},[1563],{"type":40,"tag":81,"props":1564,"children":1566},{"className":1565},[],[1567],{"type":45,"value":1568},"CFG-HC-1",{"type":40,"tag":179,"props":1570,"children":1571},{},[1572],{"type":45,"value":671},{"type":40,"tag":179,"props":1574,"children":1575},{},[1576],{"type":45,"value":1577},"Hardcoded addresses in non-test, non-init code",{"type":40,"tag":179,"props":1579,"children":1580},{},[1581],{"type":45,"value":1582},"Cannot change recipient\u002Fadmin without upgrade",{"type":40,"tag":147,"props":1584,"children":1585},{},[1586,1595,1599,1604],{"type":40,"tag":179,"props":1587,"children":1588},{},[1589],{"type":40,"tag":81,"props":1590,"children":1592},{"className":1591},[],[1593],{"type":45,"value":1594},"CFG-HC-2",{"type":40,"tag":179,"props":1596,"children":1597},{},[1598],{"type":45,"value":671},{"type":40,"tag":179,"props":1600,"children":1601},{},[1602],{"type":45,"value":1603},"Non-configurable limits that should be governance-controlled",{"type":40,"tag":179,"props":1605,"children":1606},{},[1607],{"type":45,"value":1608},"Inflexible system, requires upgrade for tuning",{"type":40,"tag":147,"props":1610,"children":1611},{},[1612,1621,1625,1630],{"type":40,"tag":179,"props":1613,"children":1614},{},[1615],{"type":40,"tag":81,"props":1616,"children":1618},{"className":1617},[],[1619],{"type":45,"value":1620},"CFG-MN-1",{"type":40,"tag":179,"props":1622,"children":1623},{},[1624],{"type":45,"value":671},{"type":40,"tag":179,"props":1626,"children":1627},{},[1628],{"type":45,"value":1629},"Numeric literals used without named constants",{"type":40,"tag":179,"props":1631,"children":1632},{},[1633],{"type":45,"value":1634},"Obscure meaning, error-prone maintenance",{"type":40,"tag":147,"props":1636,"children":1637},{},[1638,1647,1651,1656],{"type":40,"tag":179,"props":1639,"children":1640},{},[1641],{"type":40,"tag":81,"props":1642,"children":1644},{"className":1643},[],[1645],{"type":45,"value":1646},"CFG-MD-1",{"type":40,"tag":179,"props":1648,"children":1649},{},[1650],{"type":45,"value":833},{"type":40,"tag":179,"props":1652,"children":1653},{},[1654],{"type":45,"value":1655},"Metadata frozen before setting required fields (e.g., icon_url)",{"type":40,"tag":179,"props":1657,"children":1658},{},[1659],{"type":45,"value":1660},"Permanently incomplete metadata",{"type":40,"tag":1662,"props":1663,"children":1664},"blockquote",{},[1665],{"type":40,"tag":48,"props":1666,"children":1667},{},[1668,1673,1675,1681],{"type":40,"tag":66,"props":1669,"children":1670},{},[1671],{"type":45,"value":1672},"Source data",{"type":45,"value":1674},": The finding registry above is distilled from 40+ production Move contract reviews. For the raw frequency analysis and full issue taxonomy, see ",{"type":40,"tag":81,"props":1676,"children":1678},{"className":1677},[],[1679],{"type":45,"value":1680},"references\u002Fpast_reviews.md",{"type":45,"value":88},{"type":40,"tag":124,"props":1683,"children":1684},{},[],{"type":40,"tag":54,"props":1686,"children":1688},{"id":1687},"analysis-workflow",[1689],{"type":45,"value":1690},"Analysis Workflow",{"type":40,"tag":48,"props":1692,"children":1693},{},[1694,1699,1701,1706,1708,1714,1716,1721],{"type":40,"tag":66,"props":1695,"children":1696},{},[1697],{"type":45,"value":1698},"Scoped reviews",{"type":45,"value":1700},": When the user requests a focused review (specific module, specific function, or specific check categories like \"access control and arithmetic safety\"), run only the relevant phases and report ",{"type":40,"tag":66,"props":1702,"children":1703},{},[1704],{"type":45,"value":1705},"only findings whose IDs match the requested categories",{"type":45,"value":1707},". For example, if the user asks for SEC-AC and SEC-AR checks, report only SEC-AC-* and SEC-AR-* findings — do not include PAT-",{"type":40,"tag":1709,"props":1710,"children":1711},"em",{},[1712],{"type":45,"value":1713},", DES-",{"type":45,"value":1715},", TST-",{"type":40,"tag":1709,"props":1717,"children":1718},{},[1719],{"type":45,"value":1720},", QA-",{"type":45,"value":1722},", or CFG-* findings even if you notice them. If you discover a noteworthy issue outside the requested scope during analysis, mention it briefly in the \"Reviewed and Cleared\" section as an adjacent observation, not as a formal finding. Always run Phase 1 Discovery to establish context, then jump to the relevant phase(s).",{"type":40,"tag":48,"props":1724,"children":1725},{},[1726,1731],{"type":40,"tag":66,"props":1727,"children":1728},{},[1729],{"type":45,"value":1730},"Clean packages",{"type":45,"value":1732},": If the full scan produces zero findings, skip the Findings Table and Detailed Findings sections. Report a \"Clean\" risk rating and focus on the Strengths section. A clean report is a valid and valuable outcome.",{"type":40,"tag":295,"props":1734,"children":1736},{"id":1735},"phase-1-discovery",[1737],{"type":45,"value":1738},"Phase 1: Discovery",{"type":40,"tag":98,"props":1740,"children":1741},{},[1742,1806,1908],{"type":40,"tag":102,"props":1743,"children":1744},{},[1745,1750],{"type":40,"tag":66,"props":1746,"children":1747},{},[1748],{"type":45,"value":1749},"Locate the Move project",{"type":40,"tag":1751,"props":1752,"children":1753},"ul",{},[1754,1767,1786],{"type":40,"tag":102,"props":1755,"children":1756},{},[1757,1759,1765],{"type":45,"value":1758},"Find ",{"type":40,"tag":81,"props":1760,"children":1762},{"className":1761},[],[1763],{"type":45,"value":1764},"Move.toml",{"type":45,"value":1766}," in current directory or user-specified path",{"type":40,"tag":102,"props":1768,"children":1769},{},[1770,1772,1778,1780],{"type":45,"value":1771},"Glob for all ",{"type":40,"tag":81,"props":1773,"children":1775},{"className":1774},[],[1776],{"type":45,"value":1777},".move",{"type":45,"value":1779}," files under ",{"type":40,"tag":81,"props":1781,"children":1783},{"className":1782},[],[1784],{"type":45,"value":1785},"sources\u002F",{"type":40,"tag":102,"props":1787,"children":1788},{},[1789,1791,1797,1798,1804],{"type":45,"value":1790},"Identify test modules (",{"type":40,"tag":81,"props":1792,"children":1794},{"className":1793},[],[1795],{"type":45,"value":1796},"*_tests.move",{"type":45,"value":777},{"type":40,"tag":81,"props":1799,"children":1801},{"className":1800},[],[1802],{"type":45,"value":1803},"#[test_only]",{"type":45,"value":1805}," modules)",{"type":40,"tag":102,"props":1807,"children":1808},{},[1809,1814],{"type":40,"tag":66,"props":1810,"children":1811},{},[1812],{"type":45,"value":1813},"Build a structural map",{"type":40,"tag":1751,"props":1815,"children":1816},{},[1817,1851,1871,1884,1903],{"type":40,"tag":102,"props":1818,"children":1819},{},[1820,1822,1828,1830,1835,1836,1842,1843,1849],{"type":45,"value":1821},"List all modules and their ",{"type":40,"tag":81,"props":1823,"children":1825},{"className":1824},[],[1826],{"type":45,"value":1827},"public",{"type":45,"value":1829},"\u002F",{"type":40,"tag":81,"props":1831,"children":1833},{"className":1832},[],[1834],{"type":45,"value":982},{"type":45,"value":1829},{"type":40,"tag":81,"props":1837,"children":1839},{"className":1838},[],[1840],{"type":45,"value":1841},"entry",{"type":45,"value":1829},{"type":40,"tag":81,"props":1844,"children":1846},{"className":1845},[],[1847],{"type":45,"value":1848},"private",{"type":45,"value":1850}," functions",{"type":40,"tag":102,"props":1852,"children":1853},{},[1854,1856,1862,1863,1869],{"type":45,"value":1855},"Identify all struct definitions, especially those with ",{"type":40,"tag":81,"props":1857,"children":1859},{"className":1858},[],[1860],{"type":45,"value":1861},"key",{"type":45,"value":1829},{"type":40,"tag":81,"props":1864,"children":1866},{"className":1865},[],[1867],{"type":45,"value":1868},"store",{"type":45,"value":1870}," abilities (objects and capabilities)",{"type":40,"tag":102,"props":1872,"children":1873},{},[1874,1876,1882],{"type":45,"value":1875},"Map shared objects (created via ",{"type":40,"tag":81,"props":1877,"children":1879},{"className":1878},[],[1880],{"type":45,"value":1881},"share_object",{"type":45,"value":1883},") vs owned objects",{"type":40,"tag":102,"props":1885,"children":1886},{},[1887,1889,1894,1896,1901],{"type":45,"value":1888},"Identify all ",{"type":40,"tag":81,"props":1890,"children":1892},{"className":1891},[],[1893],{"type":45,"value":775},{"type":45,"value":1895}," and ",{"type":40,"tag":81,"props":1897,"children":1899},{"className":1898},[],[1900],{"type":45,"value":783},{"type":45,"value":1902}," call sites",{"type":40,"tag":102,"props":1904,"children":1905},{},[1906],{"type":45,"value":1907},"Count lines per module",{"type":40,"tag":102,"props":1909,"children":1910},{},[1911,1916],{"type":40,"tag":66,"props":1912,"children":1913},{},[1914],{"type":45,"value":1915},"Identify critical zones",{"type":40,"tag":1751,"props":1917,"children":1918},{},[1919,1939,1944,1949],{"type":40,"tag":102,"props":1920,"children":1921},{},[1922,1924,1930,1931,1937],{"type":45,"value":1923},"Functions that handle ",{"type":40,"tag":81,"props":1925,"children":1927},{"className":1926},[],[1928],{"type":45,"value":1929},"Coin",{"type":45,"value":1346},{"type":40,"tag":81,"props":1932,"children":1934},{"className":1933},[],[1935],{"type":45,"value":1936},"Balance",{"type":45,"value":1938},", or custom token types",{"type":40,"tag":102,"props":1940,"children":1941},{},[1942],{"type":45,"value":1943},"Functions gated (or not) by capability parameters",{"type":40,"tag":102,"props":1945,"children":1946},{},[1947],{"type":45,"value":1948},"All arithmetic operations: division, type casts, multiplication chains",{"type":40,"tag":102,"props":1950,"children":1951},{},[1952],{"type":45,"value":1953},"All loops and their termination conditions",{"type":40,"tag":295,"props":1955,"children":1957},{"id":1956},"phase-2-security-scan-sec-checks",[1958],{"type":45,"value":1959},"Phase 2: Security Scan (SEC checks)",{"type":40,"tag":48,"props":1961,"children":1962},{},[1963],{"type":45,"value":1964},"Run all SEC checks from the Finding Registry:",{"type":40,"tag":48,"props":1966,"children":1967},{},[1968],{"type":40,"tag":66,"props":1969,"children":1970},{},[1971],{"type":45,"value":1972},"Access Control (SEC-AC-1, SEC-AC-2, SEC-AC-3):",{"type":40,"tag":1751,"props":1974,"children":1975},{},[1976,1994,2014,2035],{"type":40,"tag":102,"props":1977,"children":1978},{},[1979,1981,1986,1987,1992],{"type":45,"value":1980},"For each ",{"type":40,"tag":81,"props":1982,"children":1984},{"className":1983},[],[1985],{"type":45,"value":1827},{"type":45,"value":1895},{"type":40,"tag":81,"props":1988,"children":1990},{"className":1989},[],[1991],{"type":45,"value":1841},{"type":45,"value":1993}," function, determine if it modifies shared state or creates\u002Fdestroys objects",{"type":40,"tag":102,"props":1995,"children":1996},{},[1997,1999,2005,2006,2012],{"type":45,"value":1998},"If it does, verify it requires a capability parameter (",{"type":40,"tag":81,"props":2000,"children":2002},{"className":2001},[],[2003],{"type":45,"value":2004},"&AdminCap",{"type":45,"value":1346},{"type":40,"tag":81,"props":2007,"children":2009},{"className":2008},[],[2010],{"type":45,"value":2011},"&OperatorCap",{"type":45,"value":2013},", etc.) or uses the witness pattern",{"type":40,"tag":102,"props":2015,"children":2016},{},[2017,2019,2025,2027,2033],{"type":45,"value":2018},"Check if any authorization helper functions return ",{"type":40,"tag":81,"props":2020,"children":2022},{"className":2021},[],[2023],{"type":45,"value":2024},"bool",{"type":45,"value":2026}," — these MUST be wrapped in ",{"type":40,"tag":81,"props":2028,"children":2030},{"className":2029},[],[2031],{"type":45,"value":2032},"assert!()",{"type":45,"value":2034}," at the call site, not left unchecked",{"type":40,"tag":102,"props":2036,"children":2037},{},[2038,2040,2046,2047,2053,2054,2060,2061,2067,2068,2074,2075,2081],{"type":45,"value":2039},"Special attention to ",{"type":40,"tag":81,"props":2041,"children":2043},{"className":2042},[],[2044],{"type":45,"value":2045},"mint",{"type":45,"value":1346},{"type":40,"tag":81,"props":2048,"children":2050},{"className":2049},[],[2051],{"type":45,"value":2052},"create",{"type":45,"value":1346},{"type":40,"tag":81,"props":2055,"children":2057},{"className":2056},[],[2058],{"type":45,"value":2059},"burn",{"type":45,"value":1346},{"type":40,"tag":81,"props":2062,"children":2064},{"className":2063},[],[2065],{"type":45,"value":2066},"update",{"type":45,"value":1346},{"type":40,"tag":81,"props":2069,"children":2071},{"className":2070},[],[2072],{"type":45,"value":2073},"set_*",{"type":45,"value":1346},{"type":40,"tag":81,"props":2076,"children":2078},{"className":2077},[],[2079],{"type":45,"value":2080},"remove_*",{"type":45,"value":2082}," function names",{"type":40,"tag":48,"props":2084,"children":2085},{},[2086],{"type":40,"tag":66,"props":2087,"children":2088},{},[2089],{"type":45,"value":2090},"Arithmetic Safety (SEC-AR-1, SEC-AR-2, SEC-AR-3):",{"type":40,"tag":1751,"props":2092,"children":2093},{},[2094,2114,2126],{"type":40,"tag":102,"props":2095,"children":2096},{},[2097,2099,2104,2106,2112],{"type":45,"value":2098},"Find all ",{"type":40,"tag":81,"props":2100,"children":2102},{"className":2101},[],[2103],{"type":45,"value":1829},{"type":45,"value":2105}," division operators and ",{"type":40,"tag":81,"props":2107,"children":2109},{"className":2108},[],[2110],{"type":45,"value":2111},"div",{"type":45,"value":2113}," function calls. For each, trace the denominator back to verify a non-zero assertion exists before the division",{"type":40,"tag":102,"props":2115,"children":2116},{},[2117,2118,2124],{"type":45,"value":2098},{"type":40,"tag":81,"props":2119,"children":2121},{"className":2120},[],[2122],{"type":45,"value":2123},"as",{"type":45,"value":2125}," type casts between integer types. For narrowing casts (u128→u64, u64→u32, u64→u8), verify an upper-bound check exists",{"type":40,"tag":102,"props":2127,"children":2128},{},[2129,2131,2137],{"type":45,"value":2130},"Find multi-step calculations where intermediate results are stored. Check for premature flooring. Recommend ",{"type":40,"tag":81,"props":2132,"children":2134},{"className":2133},[],[2135],{"type":45,"value":2136},"mul_div",{"type":45,"value":2138}," patterns for precision",{"type":40,"tag":48,"props":2140,"children":2141},{},[2142],{"type":40,"tag":66,"props":2143,"children":2144},{},[2145],{"type":45,"value":2146},"Logic Errors (SEC-LG-1, SEC-LG-2):",{"type":40,"tag":1751,"props":2148,"children":2149},{},[2150,2155],{"type":40,"tag":102,"props":2151,"children":2152},{},[2153],{"type":45,"value":2154},"For security-gating logic (if\u002Felse branches that allow\u002Fdeny), verify the condition matches the intent described by the function name and doc comment",{"type":40,"tag":102,"props":2156,"children":2157},{},[2158,2160,2165,2166,2172],{"type":45,"value":2159},"For ",{"type":40,"tag":81,"props":2161,"children":2163},{"className":2162},[],[2164],{"type":45,"value":2073},{"type":45,"value":1895},{"type":40,"tag":81,"props":2167,"children":2169},{"className":2168},[],[2170],{"type":45,"value":2171},"update_*",{"type":45,"value":2173}," functions, verify the field being modified matches the function name",{"type":40,"tag":295,"props":2175,"children":2177},{"id":2176},"phase-3-design-architecture-scan-des-checks",[2178],{"type":45,"value":2179},"Phase 3: Design & Architecture Scan (DES checks)",{"type":40,"tag":48,"props":2181,"children":2182},{},[2183],{"type":40,"tag":66,"props":2184,"children":2185},{},[2186],{"type":45,"value":2187},"Object Model (DES-OM-1, DES-OM-2, DES-OM-3):",{"type":40,"tag":1751,"props":2189,"children":2190},{},[2191,2210,2238],{"type":40,"tag":102,"props":2192,"children":2193},{},[2194,2195,2201,2202,2208],{"type":45,"value":2098},{"type":40,"tag":81,"props":2196,"children":2198},{"className":2197},[],[2199],{"type":45,"value":2200},"VecMap",{"type":45,"value":1895},{"type":40,"tag":81,"props":2203,"children":2205},{"className":2204},[],[2206],{"type":45,"value":2207},"VecSet",{"type":45,"value":2209}," usages. If the collection is populated by user actions (not bounded by the developer), flag as S2",{"type":40,"tag":102,"props":2211,"children":2212},{},[2213,2215,2221,2223,2228,2230,2236],{"type":45,"value":2214},"Find all shared objects. For each, count how many functions take ",{"type":40,"tag":81,"props":2216,"children":2218},{"className":2217},[],[2219],{"type":45,"value":2220},"&mut",{"type":45,"value":2222}," access. If the ratio of ",{"type":40,"tag":81,"props":2224,"children":2226},{"className":2225},[],[2227],{"type":45,"value":2220},{"type":45,"value":2229}," to ",{"type":40,"tag":81,"props":2231,"children":2233},{"className":2232},[],[2234],{"type":45,"value":2235},"&",{"type":45,"value":2237}," exceeds 2:1 in non-admin functions, flag contention risk",{"type":40,"tag":102,"props":2239,"children":2240},{},[2241,2243,2248],{"type":45,"value":2242},"Check for multiple ",{"type":40,"tag":81,"props":2244,"children":2246},{"className":2245},[],[2247],{"type":45,"value":1455},{"type":45,"value":2249}," object creations. Recommend shared Registry pattern if found",{"type":40,"tag":48,"props":2251,"children":2252},{},[2253],{"type":40,"tag":66,"props":2254,"children":2255},{},[2256],{"type":45,"value":2257},"Data Structures (DES-DS-1, DES-DS-2, DES-DS-3):",{"type":40,"tag":1751,"props":2259,"children":2260},{},[2261,2300,2321],{"type":40,"tag":102,"props":2262,"children":2263},{},[2264,2266,2271,2273,2279,2280,2286,2287,2293,2295],{"type":45,"value":2265},"Find struct fields typed as ",{"type":40,"tag":81,"props":2267,"children":2269},{"className":2268},[],[2270],{"type":45,"value":708},{"type":45,"value":2272}," — if the field name contains ",{"type":40,"tag":81,"props":2274,"children":2276},{"className":2275},[],[2277],{"type":45,"value":2278},"id",{"type":45,"value":1346},{"type":40,"tag":81,"props":2281,"children":2283},{"className":2282},[],[2284],{"type":45,"value":2285},"object",{"type":45,"value":1346},{"type":40,"tag":81,"props":2288,"children":2290},{"className":2289},[],[2291],{"type":45,"value":2292},"nft",{"type":45,"value":2294},", or references an on-chain entity, flag as should-be-",{"type":40,"tag":81,"props":2296,"children":2298},{"className":2297},[],[2299],{"type":45,"value":314},{"type":40,"tag":102,"props":2301,"children":2302},{},[2303,2305,2311,2313,2319],{"type":45,"value":2304},"Find numeric constants or field values used in ",{"type":40,"tag":81,"props":2306,"children":2308},{"className":2307},[],[2309],{"type":45,"value":2310},"if",{"type":45,"value":2312}," comparisons for state branching. If a number represents a logical state, recommend ",{"type":40,"tag":81,"props":2314,"children":2316},{"className":2315},[],[2317],{"type":45,"value":2318},"Option",{"type":45,"value":2320}," or enum pattern",{"type":40,"tag":102,"props":2322,"children":2323},{},[2324,2326,2332],{"type":45,"value":2325},"Check for ",{"type":40,"tag":81,"props":2327,"children":2329},{"className":2328},[],[2330],{"type":45,"value":2331},"LinkedTable",{"type":45,"value":2333}," usage — if the table is not iterated or if order doesn't matter, simpler alternatives exist",{"type":40,"tag":48,"props":2335,"children":2336},{},[2337],{"type":40,"tag":66,"props":2338,"children":2339},{},[2340],{"type":45,"value":2341},"Function Design (DES-FN-1, DES-FN-2, DES-FN-3):",{"type":40,"tag":1751,"props":2343,"children":2344},{},[2345,2363,2376],{"type":40,"tag":102,"props":2346,"children":2347},{},[2348,2350,2355,2356,2361],{"type":45,"value":2349},"Find functions that call ",{"type":40,"tag":81,"props":2351,"children":2353},{"className":2352},[],[2354],{"type":45,"value":775},{"type":45,"value":777},{"type":40,"tag":81,"props":2357,"children":2359},{"className":2358},[],[2360],{"type":45,"value":783},{"type":45,"value":2362}," on objects they create or receive. If the function could instead return the object, flag it",{"type":40,"tag":102,"props":2364,"children":2365},{},[2366,2368,2374],{"type":45,"value":2367},"Find functions that accept ",{"type":40,"tag":81,"props":2369,"children":2371},{"className":2370},[],[2372],{"type":45,"value":2373},"vector\u003CT>",{"type":45,"value":2375}," and loop over it to perform repeated single operations. Consider if this is a batch function that PTB loops would replace",{"type":40,"tag":102,"props":2377,"children":2378},{},[2379],{"type":45,"value":2380},"Find single-line wrapper functions that delegate entirely to another function. If the wrapper adds no logic, authorization, or type transformation, flag it",{"type":40,"tag":48,"props":2382,"children":2383},{},[2384],{"type":40,"tag":66,"props":2385,"children":2386},{},[2387],{"type":45,"value":2388},"Blind Transfers (DES-BT-1):",{"type":40,"tag":1751,"props":2390,"children":2391},{},[2392,2411],{"type":40,"tag":102,"props":2393,"children":2394},{},[2395,2396,2401,2403,2409],{"type":45,"value":2098},{"type":40,"tag":81,"props":2397,"children":2399},{"className":2398},[],[2400],{"type":45,"value":775},{"type":45,"value":2402}," calls where the recipient is an object ID (not a user address). Verify a corresponding ",{"type":40,"tag":81,"props":2404,"children":2406},{"className":2405},[],[2407],{"type":45,"value":2408},"receive",{"type":45,"value":2410}," function exists in the codebase",{"type":40,"tag":102,"props":2412,"children":2413},{},[2414],{"type":45,"value":2415},"For derived objects, verify the contract checks existence before transferring to them",{"type":40,"tag":295,"props":2417,"children":2419},{"id":2418},"phase-4-pattern-scan-pat-checks",[2420],{"type":45,"value":2421},"Phase 4: Pattern Scan (PAT checks)",{"type":40,"tag":48,"props":2423,"children":2424},{},[2425],{"type":40,"tag":66,"props":2426,"children":2427},{},[2428],{"type":45,"value":2429},"Capability Patterns (PAT-CP-1, PAT-CP-2):",{"type":40,"tag":1751,"props":2431,"children":2432},{},[2433,2445],{"type":40,"tag":102,"props":2434,"children":2435},{},[2436,2438,2443],{"type":45,"value":2437},"Find structs used for authorization that don't have ",{"type":40,"tag":81,"props":2439,"children":2441},{"className":2440},[],[2442],{"type":45,"value":1861},{"type":45,"value":2444}," ability (Solidity-style role mappings in tables instead of owned capability objects)",{"type":40,"tag":102,"props":2446,"children":2447},{},[2448,2449,2454,2456],{"type":45,"value":1758},{"type":40,"tag":81,"props":2450,"children":2452},{"className":2451},[],[2453],{"type":45,"value":982},{"type":45,"value":2455}," functions. For each, check if any external module in the package calls it. If only the declaring module calls it, it should be ",{"type":40,"tag":81,"props":2457,"children":2459},{"className":2458},[],[2460],{"type":45,"value":1848},{"type":40,"tag":48,"props":2462,"children":2463},{},[2464],{"type":40,"tag":66,"props":2465,"children":2466},{},[2467],{"type":45,"value":2468},"Version Management (PAT-VM-1, PAT-VM-2):",{"type":40,"tag":1751,"props":2470,"children":2471},{},[2472,2485,2490],{"type":40,"tag":102,"props":2473,"children":2474},{},[2475,2477,2483],{"type":45,"value":2476},"Check for a ",{"type":40,"tag":81,"props":2478,"children":2480},{"className":2479},[],[2481],{"type":45,"value":2482},"VERSION",{"type":45,"value":2484}," constant in the package. If the package appears to be designed for upgradeability (has admin functions, uses dynamic fields for extensibility), flag missing version tracking",{"type":40,"tag":102,"props":2486,"children":2487},{},[2488],{"type":45,"value":2489},"Check for version-check assertions in state-modifying functions",{"type":40,"tag":102,"props":2491,"children":2492},{},[2493,2495,2501,2502,2508],{"type":45,"value":2494},"Flag ",{"type":40,"tag":81,"props":2496,"children":2498},{"className":2497},[],[2499],{"type":45,"value":2500},"migrate",{"type":45,"value":777},{"type":40,"tag":81,"props":2503,"children":2505},{"className":2504},[],[2506],{"type":45,"value":2507},"migration",{"type":45,"value":2509}," functions in packages with no evidence of a prior version",{"type":40,"tag":295,"props":2511,"children":2513},{"id":2512},"phase-5-testing-scan-tst-checks",[2514],{"type":45,"value":2515},"Phase 5: Testing Scan (TST checks)",{"type":40,"tag":48,"props":2517,"children":2518},{},[2519],{"type":40,"tag":66,"props":2520,"children":2521},{},[2522],{"type":45,"value":2523},"Coverage (TST-CV-1, TST-CV-2):",{"type":40,"tag":1751,"props":2525,"children":2526},{},[2527,2532],{"type":40,"tag":102,"props":2528,"children":2529},{},[2530],{"type":45,"value":2531},"Cross-reference functions identified as security-critical in Phase 2 against test modules. If a security-critical function has no test calling it, flag S2",{"type":40,"tag":102,"props":2533,"children":2534},{},[2535,2537,2543],{"type":45,"value":2536},"Check if test modules contain any ",{"type":40,"tag":81,"props":2538,"children":2540},{"className":2539},[],[2541],{"type":45,"value":2542},"#[test, expected_failure]",{"type":45,"value":2544}," tests. If zero exist, flag missing unhappy-path coverage",{"type":40,"tag":48,"props":2546,"children":2547},{},[2548],{"type":40,"tag":66,"props":2549,"children":2550},{},[2551],{"type":45,"value":2552},"Validation (TST-VL-1, TST-VL-2, TST-VL-3):",{"type":40,"tag":1751,"props":2554,"children":2555},{},[2556,2561,2566],{"type":40,"tag":102,"props":2557,"children":2558},{},[2559],{"type":45,"value":2560},"For functions that access vectors\u002FVecMaps by index, check if tests exercise the empty-collection case",{"type":40,"tag":102,"props":2562,"children":2563},{},[2564],{"type":45,"value":2565},"For all loops found in Phase 1, check if tests exercise the termination boundary",{"type":40,"tag":102,"props":2567,"children":2568},{},[2569],{"type":45,"value":2570},"For time-based logic, check if tests cover zero-duration, epoch-boundary, and overflow scenarios",{"type":40,"tag":295,"props":2572,"children":2574},{"id":2573},"phase-6-quality-config-scan-qa-cfg-checks",[2575],{"type":45,"value":2576},"Phase 6: Quality & Config Scan (QA, CFG checks)",{"type":40,"tag":48,"props":2578,"children":2579},{},[2580],{"type":40,"tag":66,"props":2581,"children":2582},{},[2583],{"type":45,"value":2584},"Unused Code (QA-UC-1):",{"type":40,"tag":1751,"props":2586,"children":2587},{},[2588],{"type":40,"tag":102,"props":2589,"children":2590},{},[2591,2593,2598,2599,2604,2606,2611,2612,2617,2619,2624,2626],{"type":45,"value":2592},"Build a call graph from all ",{"type":40,"tag":81,"props":2594,"children":2596},{"className":2595},[],[2597],{"type":45,"value":1827},{"type":45,"value":1895},{"type":40,"tag":81,"props":2600,"children":2602},{"className":2601},[],[2603],{"type":45,"value":1841},{"type":45,"value":2605}," functions. Find ",{"type":40,"tag":81,"props":2607,"children":2609},{"className":2608},[],[2610],{"type":45,"value":982},{"type":45,"value":1346},{"type":40,"tag":81,"props":2613,"children":2615},{"className":2614},[],[2616],{"type":45,"value":1848},{"type":45,"value":2618},", and ",{"type":40,"tag":81,"props":2620,"children":2622},{"className":2621},[],[2623],{"type":45,"value":1803},{"type":45,"value":2625}," functions that are never called from any reachable path. Distinguish:\n",{"type":40,"tag":1751,"props":2627,"children":2628},{},[2629,2634,2646],{"type":40,"tag":102,"props":2630,"children":2631},{},[2632],{"type":45,"value":2633},"Dead code (no callers at all) → recommend removal",{"type":40,"tag":102,"props":2635,"children":2636},{},[2637,2639,2644],{"type":45,"value":2638},"Test-only reachable code → verify ",{"type":40,"tag":81,"props":2640,"children":2642},{"className":2641},[],[2643],{"type":45,"value":1803},{"type":45,"value":2645}," annotation is present",{"type":40,"tag":102,"props":2647,"children":2648},{},[2649],{"type":45,"value":2650},"Possibly-incomplete feature → flag for clarification",{"type":40,"tag":48,"props":2652,"children":2653},{},[2654],{"type":40,"tag":66,"props":2655,"children":2656},{},[2657],{"type":45,"value":2658},"Module Organization (QA-MO-1, QA-MO-2, QA-MO-3):",{"type":40,"tag":1751,"props":2660,"children":2661},{},[2662,2667,2672],{"type":40,"tag":102,"props":2663,"children":2664},{},[2665],{"type":45,"value":2666},"Count lines per module (excluding blank lines and comments). Flag >500",{"type":40,"tag":102,"props":2668,"children":2669},{},[2670],{"type":45,"value":2671},"Check if related constants\u002Ftypes are co-located with the logic that uses them",{"type":40,"tag":102,"props":2673,"children":2674},{},[2675],{"type":45,"value":2676},"Check for logic that requires reading 3+ modules to understand a single operation",{"type":40,"tag":48,"props":2678,"children":2679},{},[2680],{"type":40,"tag":66,"props":2681,"children":2682},{},[2683],{"type":45,"value":2684},"Naming & Documentation (QA-NM-1, QA-NM-2, QA-NM-3, QA-DC-1, QA-DC-2):",{"type":40,"tag":1751,"props":2686,"children":2687},{},[2688,2693,2698,2722,2733],{"type":40,"tag":102,"props":2689,"children":2690},{},[2691],{"type":45,"value":2692},"Scan for generic names in function parameters and local variables",{"type":40,"tag":102,"props":2694,"children":2695},{},[2696],{"type":45,"value":2697},"Check time-related field names for unit suffixes",{"type":40,"tag":102,"props":2699,"children":2700},{},[2701,2703,2709,2710,2715,2716,2721],{"type":45,"value":2702},"Check for struct names that shadow Sui framework types (e.g., custom ",{"type":40,"tag":81,"props":2704,"children":2706},{"className":2705},[],[2707],{"type":45,"value":2708},"CoinMetadata\u003CT>",{"type":45,"value":1346},{"type":40,"tag":81,"props":2711,"children":2713},{"className":2712},[],[2714],{"type":45,"value":1448},{"type":45,"value":1346},{"type":40,"tag":81,"props":2717,"children":2719},{"className":2718},[],[2720],{"type":45,"value":1455},{"type":45,"value":1368},{"type":40,"tag":102,"props":2723,"children":2724},{},[2725,2727,2732],{"type":45,"value":2726},"Count public functions without ",{"type":40,"tag":81,"props":2728,"children":2730},{"className":2729},[],[2731],{"type":45,"value":1489},{"type":45,"value":1491},{"type":40,"tag":102,"props":2734,"children":2735},{},[2736,2738,2744,2745,2751,2752,2758,2759,2765],{"type":45,"value":2737},"Grep for ",{"type":40,"tag":81,"props":2739,"children":2741},{"className":2740},[],[2742],{"type":45,"value":2743},"TODO",{"type":45,"value":1346},{"type":40,"tag":81,"props":2746,"children":2748},{"className":2747},[],[2749],{"type":45,"value":2750},"FIXME",{"type":45,"value":1346},{"type":40,"tag":81,"props":2753,"children":2755},{"className":2754},[],[2756],{"type":45,"value":2757},"HACK",{"type":45,"value":1346},{"type":40,"tag":81,"props":2760,"children":2762},{"className":2761},[],[2763],{"type":45,"value":2764},"XXX",{"type":45,"value":2766}," in non-test files",{"type":40,"tag":48,"props":2768,"children":2769},{},[2770],{"type":40,"tag":66,"props":2771,"children":2772},{},[2773],{"type":45,"value":2774},"Configuration (CFG-HC-1, CFG-HC-2, CFG-MN-1, CFG-MD-1):",{"type":40,"tag":1751,"props":2776,"children":2777},{},[2778,2804,2809],{"type":40,"tag":102,"props":2779,"children":2780},{},[2781,2782,2788,2790,2796,2797,2803],{"type":45,"value":1758},{"type":40,"tag":81,"props":2783,"children":2785},{"className":2784},[],[2786],{"type":45,"value":2787},"@0x...",{"type":45,"value":2789}," address literals outside of ",{"type":40,"tag":81,"props":2791,"children":2793},{"className":2792},[],[2794],{"type":45,"value":2795},"init",{"type":45,"value":1895},{"type":40,"tag":81,"props":2798,"children":2800},{"className":2799},[],[2801],{"type":45,"value":2802},"#[test]",{"type":45,"value":1850},{"type":40,"tag":102,"props":2805,"children":2806},{},[2807],{"type":45,"value":2808},"Find numeric literals in logic (not in constant definitions) that appear to represent limits or thresholds",{"type":40,"tag":102,"props":2810,"children":2811},{},[2812,2813,2819],{"type":45,"value":2325},{"type":40,"tag":81,"props":2814,"children":2816},{"className":2815},[],[2817],{"type":45,"value":2818},"freeze_object",{"type":45,"value":2820}," calls on metadata objects — verify all fields are set beforehand",{"type":40,"tag":124,"props":2822,"children":2823},{},[],{"type":40,"tag":54,"props":2825,"children":2827},{"id":2826},"reporting-format",[2828],{"type":45,"value":2829},"Reporting Format",{"type":40,"tag":48,"props":2831,"children":2832},{},[2833],{"type":45,"value":2834},"Present findings using this exact structure. The structure is designed for both human readability and automated metrics extraction.",{"type":40,"tag":295,"props":2836,"children":2838},{"id":2837},"header",[2839],{"type":45,"value":2840},"Header",{"type":40,"tag":2842,"props":2843,"children":2848},"pre",{"className":2844,"code":2845,"language":2846,"meta":2847,"style":2847},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Move Code Security & Architecture Review\n\n**Package**: [package name from Move.toml]\n**Modules reviewed**: [count] ([list of module names])\n**Date**: [current date]\n**Reviewer**: Claude Code (move-code-review skill)\n","markdown","",[2849],{"type":40,"tag":81,"props":2850,"children":2851},{"__ignoreMap":2847},[2852,2869,2879,2905,2948,2970],{"type":40,"tag":2853,"props":2854,"children":2856},"span",{"class":2855,"line":29},"line",[2857,2863],{"type":40,"tag":2853,"props":2858,"children":2860},{"style":2859},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[2861],{"type":45,"value":2862},"## ",{"type":40,"tag":2853,"props":2864,"children":2866},{"style":2865},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[2867],{"type":45,"value":2868},"Move Code Security & Architecture Review\n",{"type":40,"tag":2853,"props":2870,"children":2872},{"class":2855,"line":2871},2,[2873],{"type":40,"tag":2853,"props":2874,"children":2876},{"emptyLinePlaceholder":2875},true,[2877],{"type":45,"value":2878},"\n",{"type":40,"tag":2853,"props":2880,"children":2882},{"class":2855,"line":2881},3,[2883,2889,2895,2899],{"type":40,"tag":2853,"props":2884,"children":2886},{"style":2885},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[2887],{"type":45,"value":2888},"**",{"type":40,"tag":2853,"props":2890,"children":2892},{"style":2891},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[2893],{"type":45,"value":2894},"Package",{"type":40,"tag":2853,"props":2896,"children":2897},{"style":2885},[2898],{"type":45,"value":2888},{"type":40,"tag":2853,"props":2900,"children":2902},{"style":2901},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[2903],{"type":45,"value":2904},": [package name from Move.toml]\n",{"type":40,"tag":2853,"props":2906,"children":2908},{"class":2855,"line":2907},4,[2909,2913,2918,2922,2927,2932,2938,2943],{"type":40,"tag":2853,"props":2910,"children":2911},{"style":2885},[2912],{"type":45,"value":2888},{"type":40,"tag":2853,"props":2914,"children":2915},{"style":2891},[2916],{"type":45,"value":2917},"Modules reviewed",{"type":40,"tag":2853,"props":2919,"children":2920},{"style":2885},[2921],{"type":45,"value":2888},{"type":40,"tag":2853,"props":2923,"children":2924},{"style":2901},[2925],{"type":45,"value":2926},": ",{"type":40,"tag":2853,"props":2928,"children":2929},{"style":2859},[2930],{"type":45,"value":2931},"[",{"type":40,"tag":2853,"props":2933,"children":2935},{"style":2934},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2936],{"type":45,"value":2937},"count",{"type":40,"tag":2853,"props":2939,"children":2940},{"style":2859},[2941],{"type":45,"value":2942},"]",{"type":40,"tag":2853,"props":2944,"children":2945},{"style":2901},[2946],{"type":45,"value":2947}," ([list of module names])\n",{"type":40,"tag":2853,"props":2949,"children":2951},{"class":2855,"line":2950},5,[2952,2956,2961,2965],{"type":40,"tag":2853,"props":2953,"children":2954},{"style":2885},[2955],{"type":45,"value":2888},{"type":40,"tag":2853,"props":2957,"children":2958},{"style":2891},[2959],{"type":45,"value":2960},"Date",{"type":40,"tag":2853,"props":2962,"children":2963},{"style":2885},[2964],{"type":45,"value":2888},{"type":40,"tag":2853,"props":2966,"children":2967},{"style":2901},[2968],{"type":45,"value":2969},": [current date]\n",{"type":40,"tag":2853,"props":2971,"children":2973},{"class":2855,"line":2972},6,[2974,2978,2983,2987],{"type":40,"tag":2853,"props":2975,"children":2976},{"style":2885},[2977],{"type":45,"value":2888},{"type":40,"tag":2853,"props":2979,"children":2980},{"style":2891},[2981],{"type":45,"value":2982},"Reviewer",{"type":40,"tag":2853,"props":2984,"children":2985},{"style":2885},[2986],{"type":45,"value":2888},{"type":40,"tag":2853,"props":2988,"children":2989},{"style":2901},[2990],{"type":45,"value":2991},": Claude Code (move-code-review skill)\n",{"type":40,"tag":295,"props":2993,"children":2995},{"id":2994},"findings-table",[2996],{"type":45,"value":2997},"Findings Table",{"type":40,"tag":2842,"props":2999,"children":3001},{"className":2844,"code":3000,"language":2846,"meta":2847,"style":2847},"### Findings Summary\n\n| # | ID | Severity | Weight | Category | File | One-line Summary |\n|---|-----|----------|--------|----------|------|-----------------|\n| 1 | SEC-AC-1 | S1 | 10 | Access Control | sources\u002Fadmin.move:45 | Unprotected public mint function |\n| 2 | SEC-AR-1 | S1 | 10 | Arithmetic | sources\u002Fpool.move:112 | Division by zero in fee calculation |\n| ... | ... | ... | ... | ... | ... | ... |\n",[3002],{"type":40,"tag":81,"props":3003,"children":3004},{"__ignoreMap":2847},[3005,3018,3025,3097,3105,3175,3243],{"type":40,"tag":2853,"props":3006,"children":3007},{"class":2855,"line":29},[3008,3013],{"type":40,"tag":2853,"props":3009,"children":3010},{"style":2859},[3011],{"type":45,"value":3012},"### ",{"type":40,"tag":2853,"props":3014,"children":3015},{"style":2865},[3016],{"type":45,"value":3017},"Findings Summary\n",{"type":40,"tag":2853,"props":3019,"children":3020},{"class":2855,"line":2871},[3021],{"type":40,"tag":2853,"props":3022,"children":3023},{"emptyLinePlaceholder":2875},[3024],{"type":45,"value":2878},{"type":40,"tag":2853,"props":3026,"children":3027},{"class":2855,"line":2881},[3028,3033,3038,3042,3047,3051,3056,3060,3065,3069,3074,3078,3083,3087,3092],{"type":40,"tag":2853,"props":3029,"children":3030},{"style":2859},[3031],{"type":45,"value":3032},"|",{"type":40,"tag":2853,"props":3034,"children":3035},{"style":2901},[3036],{"type":45,"value":3037}," # ",{"type":40,"tag":2853,"props":3039,"children":3040},{"style":2859},[3041],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3043,"children":3044},{"style":2901},[3045],{"type":45,"value":3046}," ID ",{"type":40,"tag":2853,"props":3048,"children":3049},{"style":2859},[3050],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3052,"children":3053},{"style":2901},[3054],{"type":45,"value":3055}," Severity ",{"type":40,"tag":2853,"props":3057,"children":3058},{"style":2859},[3059],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3061,"children":3062},{"style":2901},[3063],{"type":45,"value":3064}," Weight ",{"type":40,"tag":2853,"props":3066,"children":3067},{"style":2859},[3068],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3070,"children":3071},{"style":2901},[3072],{"type":45,"value":3073}," Category ",{"type":40,"tag":2853,"props":3075,"children":3076},{"style":2859},[3077],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3079,"children":3080},{"style":2901},[3081],{"type":45,"value":3082}," File ",{"type":40,"tag":2853,"props":3084,"children":3085},{"style":2859},[3086],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3088,"children":3089},{"style":2901},[3090],{"type":45,"value":3091}," One-line Summary ",{"type":40,"tag":2853,"props":3093,"children":3094},{"style":2859},[3095],{"type":45,"value":3096},"|\n",{"type":40,"tag":2853,"props":3098,"children":3099},{"class":2855,"line":2907},[3100],{"type":40,"tag":2853,"props":3101,"children":3102},{"style":2859},[3103],{"type":45,"value":3104},"|---|-----|----------|--------|----------|------|-----------------|\n",{"type":40,"tag":2853,"props":3106,"children":3107},{"class":2855,"line":2950},[3108,3112,3117,3121,3126,3130,3135,3139,3144,3148,3153,3157,3162,3166,3171],{"type":40,"tag":2853,"props":3109,"children":3110},{"style":2859},[3111],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3113,"children":3114},{"style":2901},[3115],{"type":45,"value":3116}," 1 ",{"type":40,"tag":2853,"props":3118,"children":3119},{"style":2859},[3120],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3122,"children":3123},{"style":2901},[3124],{"type":45,"value":3125}," SEC-AC-1 ",{"type":40,"tag":2853,"props":3127,"children":3128},{"style":2859},[3129],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3131,"children":3132},{"style":2901},[3133],{"type":45,"value":3134}," S1 ",{"type":40,"tag":2853,"props":3136,"children":3137},{"style":2859},[3138],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3140,"children":3141},{"style":2901},[3142],{"type":45,"value":3143}," 10 ",{"type":40,"tag":2853,"props":3145,"children":3146},{"style":2859},[3147],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3149,"children":3150},{"style":2901},[3151],{"type":45,"value":3152}," Access Control ",{"type":40,"tag":2853,"props":3154,"children":3155},{"style":2859},[3156],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3158,"children":3159},{"style":2901},[3160],{"type":45,"value":3161}," sources\u002Fadmin.move:45 ",{"type":40,"tag":2853,"props":3163,"children":3164},{"style":2859},[3165],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3167,"children":3168},{"style":2901},[3169],{"type":45,"value":3170}," Unprotected public mint function ",{"type":40,"tag":2853,"props":3172,"children":3173},{"style":2859},[3174],{"type":45,"value":3096},{"type":40,"tag":2853,"props":3176,"children":3177},{"class":2855,"line":2972},[3178,3182,3187,3191,3196,3200,3204,3208,3212,3216,3221,3225,3230,3234,3239],{"type":40,"tag":2853,"props":3179,"children":3180},{"style":2859},[3181],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3183,"children":3184},{"style":2901},[3185],{"type":45,"value":3186}," 2 ",{"type":40,"tag":2853,"props":3188,"children":3189},{"style":2859},[3190],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3192,"children":3193},{"style":2901},[3194],{"type":45,"value":3195}," SEC-AR-1 ",{"type":40,"tag":2853,"props":3197,"children":3198},{"style":2859},[3199],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3201,"children":3202},{"style":2901},[3203],{"type":45,"value":3134},{"type":40,"tag":2853,"props":3205,"children":3206},{"style":2859},[3207],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3209,"children":3210},{"style":2901},[3211],{"type":45,"value":3143},{"type":40,"tag":2853,"props":3213,"children":3214},{"style":2859},[3215],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3217,"children":3218},{"style":2901},[3219],{"type":45,"value":3220}," Arithmetic ",{"type":40,"tag":2853,"props":3222,"children":3223},{"style":2859},[3224],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3226,"children":3227},{"style":2901},[3228],{"type":45,"value":3229}," sources\u002Fpool.move:112 ",{"type":40,"tag":2853,"props":3231,"children":3232},{"style":2859},[3233],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3235,"children":3236},{"style":2901},[3237],{"type":45,"value":3238}," Division by zero in fee calculation ",{"type":40,"tag":2853,"props":3240,"children":3241},{"style":2859},[3242],{"type":45,"value":3096},{"type":40,"tag":2853,"props":3244,"children":3246},{"class":2855,"line":3245},7,[3247,3251,3256,3260,3264,3268,3272,3276,3280,3284,3288,3292,3296,3300,3304],{"type":40,"tag":2853,"props":3248,"children":3249},{"style":2859},[3250],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3252,"children":3253},{"style":2901},[3254],{"type":45,"value":3255}," ... ",{"type":40,"tag":2853,"props":3257,"children":3258},{"style":2859},[3259],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3261,"children":3262},{"style":2901},[3263],{"type":45,"value":3255},{"type":40,"tag":2853,"props":3265,"children":3266},{"style":2859},[3267],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3269,"children":3270},{"style":2901},[3271],{"type":45,"value":3255},{"type":40,"tag":2853,"props":3273,"children":3274},{"style":2859},[3275],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3277,"children":3278},{"style":2901},[3279],{"type":45,"value":3255},{"type":40,"tag":2853,"props":3281,"children":3282},{"style":2859},[3283],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3285,"children":3286},{"style":2901},[3287],{"type":45,"value":3255},{"type":40,"tag":2853,"props":3289,"children":3290},{"style":2859},[3291],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3293,"children":3294},{"style":2901},[3295],{"type":45,"value":3255},{"type":40,"tag":2853,"props":3297,"children":3298},{"style":2859},[3299],{"type":45,"value":3032},{"type":40,"tag":2853,"props":3301,"children":3302},{"style":2901},[3303],{"type":45,"value":3255},{"type":40,"tag":2853,"props":3305,"children":3306},{"style":2859},[3307],{"type":45,"value":3096},{"type":40,"tag":295,"props":3309,"children":3311},{"id":3310},"detailed-findings",[3312],{"type":45,"value":3313},"Detailed Findings",{"type":40,"tag":48,"props":3315,"children":3316},{},[3317],{"type":45,"value":3318},"For each finding, use this exact template:",{"type":40,"tag":2842,"props":3320,"children":3322},{"className":2844,"code":3321,"language":2846,"meta":2847,"style":2847},"---\n\n### [#N] [ID]: [One-line Summary]\n\n**Severity**: [S1 Critical | S2 High | S3 Medium | S4 Low] (Weight: [N])\n**Category**: [Full category name]\n**File**: `[path]:[line]`\n\n**Issue**: [Precise description of what is wrong]\n\n**Impact**: [What could go wrong if this is not fixed — concrete scenario]\n\n**Current code**:\n```move\n\u002F\u002F The problematic code snippet\n",[3323],{"type":40,"tag":81,"props":3324,"children":3325},{"__ignoreMap":2847},[3326,3334,3341,3350,3357,3415,3441,3471,3479,3505,3513,3539,3547,3570,3584],{"type":40,"tag":2853,"props":3327,"children":3328},{"class":2855,"line":29},[3329],{"type":40,"tag":2853,"props":3330,"children":3331},{"style":2859},[3332],{"type":45,"value":3333},"---\n",{"type":40,"tag":2853,"props":3335,"children":3336},{"class":2855,"line":2871},[3337],{"type":40,"tag":2853,"props":3338,"children":3339},{"emptyLinePlaceholder":2875},[3340],{"type":45,"value":2878},{"type":40,"tag":2853,"props":3342,"children":3343},{"class":2855,"line":2881},[3344],{"type":40,"tag":2853,"props":3345,"children":3347},{"style":3346},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[3348],{"type":45,"value":3349},"### [#N] [ID]: [One-line Summary]\n",{"type":40,"tag":2853,"props":3351,"children":3352},{"class":2855,"line":2907},[3353],{"type":40,"tag":2853,"props":3354,"children":3355},{"emptyLinePlaceholder":2875},[3356],{"type":45,"value":2878},{"type":40,"tag":2853,"props":3358,"children":3359},{"class":2855,"line":2950},[3360,3366,3371,3375,3380,3384,3390,3395,3400,3406,3410],{"type":40,"tag":2853,"props":3361,"children":3363},{"style":3362},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[3364],{"type":45,"value":3365},"*",{"type":40,"tag":2853,"props":3367,"children":3368},{"style":2901},[3369],{"type":45,"value":3370},"*Severity**: ",{"type":40,"tag":2853,"props":3372,"children":3373},{"style":2859},[3374],{"type":45,"value":2931},{"type":40,"tag":2853,"props":3376,"children":3377},{"style":2934},[3378],{"type":45,"value":3379},"S1 Critical | S2 High | S3 Medium | S4 Low",{"type":40,"tag":2853,"props":3381,"children":3382},{"style":2859},[3383],{"type":45,"value":2942},{"type":40,"tag":2853,"props":3385,"children":3387},{"style":3386},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[3388],{"type":45,"value":3389}," (Weight",{"type":40,"tag":2853,"props":3391,"children":3392},{"style":2859},[3393],{"type":45,"value":3394},":",{"type":40,"tag":2853,"props":3396,"children":3397},{"style":2859},[3398],{"type":45,"value":3399}," [",{"type":40,"tag":2853,"props":3401,"children":3403},{"style":3402},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[3404],{"type":45,"value":3405},"N",{"type":40,"tag":2853,"props":3407,"children":3408},{"style":2859},[3409],{"type":45,"value":2942},{"type":40,"tag":2853,"props":3411,"children":3412},{"style":2934},[3413],{"type":45,"value":3414},")\n",{"type":40,"tag":2853,"props":3416,"children":3417},{"class":2855,"line":2972},[3418,3422,3427,3431,3436],{"type":40,"tag":2853,"props":3419,"children":3420},{"style":3362},[3421],{"type":45,"value":3365},{"type":40,"tag":2853,"props":3423,"children":3424},{"style":2901},[3425],{"type":45,"value":3426},"*Category**: ",{"type":40,"tag":2853,"props":3428,"children":3429},{"style":2859},[3430],{"type":45,"value":2931},{"type":40,"tag":2853,"props":3432,"children":3433},{"style":2934},[3434],{"type":45,"value":3435},"Full category name",{"type":40,"tag":2853,"props":3437,"children":3438},{"style":2859},[3439],{"type":45,"value":3440},"]\n",{"type":40,"tag":2853,"props":3442,"children":3443},{"class":2855,"line":3245},[3444,3448,3453,3457,3462,3466],{"type":40,"tag":2853,"props":3445,"children":3446},{"style":3362},[3447],{"type":45,"value":3365},{"type":40,"tag":2853,"props":3449,"children":3450},{"style":2901},[3451],{"type":45,"value":3452},"*File**: `",{"type":40,"tag":2853,"props":3454,"children":3455},{"style":2859},[3456],{"type":45,"value":2931},{"type":40,"tag":2853,"props":3458,"children":3459},{"style":2934},[3460],{"type":45,"value":3461},"path",{"type":40,"tag":2853,"props":3463,"children":3464},{"style":2859},[3465],{"type":45,"value":2942},{"type":40,"tag":2853,"props":3467,"children":3468},{"style":2934},[3469],{"type":45,"value":3470},":[line]`\n",{"type":40,"tag":2853,"props":3472,"children":3474},{"class":2855,"line":3473},8,[3475],{"type":40,"tag":2853,"props":3476,"children":3477},{"emptyLinePlaceholder":2875},[3478],{"type":45,"value":2878},{"type":40,"tag":2853,"props":3480,"children":3482},{"class":2855,"line":3481},9,[3483,3487,3492,3496,3501],{"type":40,"tag":2853,"props":3484,"children":3485},{"style":3362},[3486],{"type":45,"value":3365},{"type":40,"tag":2853,"props":3488,"children":3489},{"style":2901},[3490],{"type":45,"value":3491},"*Issue**: ",{"type":40,"tag":2853,"props":3493,"children":3494},{"style":2859},[3495],{"type":45,"value":2931},{"type":40,"tag":2853,"props":3497,"children":3498},{"style":2934},[3499],{"type":45,"value":3500},"Precise description of what is wrong",{"type":40,"tag":2853,"props":3502,"children":3503},{"style":2859},[3504],{"type":45,"value":3440},{"type":40,"tag":2853,"props":3506,"children":3508},{"class":2855,"line":3507},10,[3509],{"type":40,"tag":2853,"props":3510,"children":3511},{"emptyLinePlaceholder":2875},[3512],{"type":45,"value":2878},{"type":40,"tag":2853,"props":3514,"children":3516},{"class":2855,"line":3515},11,[3517,3521,3526,3530,3535],{"type":40,"tag":2853,"props":3518,"children":3519},{"style":3362},[3520],{"type":45,"value":3365},{"type":40,"tag":2853,"props":3522,"children":3523},{"style":2901},[3524],{"type":45,"value":3525},"*Impact**: ",{"type":40,"tag":2853,"props":3527,"children":3528},{"style":2859},[3529],{"type":45,"value":2931},{"type":40,"tag":2853,"props":3531,"children":3532},{"style":2934},[3533],{"type":45,"value":3534},"What could go wrong if this is not fixed — concrete scenario",{"type":40,"tag":2853,"props":3536,"children":3537},{"style":2859},[3538],{"type":45,"value":3440},{"type":40,"tag":2853,"props":3540,"children":3542},{"class":2855,"line":3541},12,[3543],{"type":40,"tag":2853,"props":3544,"children":3545},{"emptyLinePlaceholder":2875},[3546],{"type":45,"value":2878},{"type":40,"tag":2853,"props":3548,"children":3550},{"class":2855,"line":3549},13,[3551,3555,3560,3565],{"type":40,"tag":2853,"props":3552,"children":3553},{"style":3362},[3554],{"type":45,"value":3365},{"type":40,"tag":2853,"props":3556,"children":3557},{"style":2901},[3558],{"type":45,"value":3559},"*Current ",{"type":40,"tag":2853,"props":3561,"children":3562},{"style":3386},[3563],{"type":45,"value":3564},"code**",{"type":40,"tag":2853,"props":3566,"children":3567},{"style":2859},[3568],{"type":45,"value":3569},":\n",{"type":40,"tag":2853,"props":3571,"children":3573},{"class":2855,"line":3572},14,[3574,3579],{"type":40,"tag":2853,"props":3575,"children":3576},{"style":2901},[3577],{"type":45,"value":3578},"```",{"type":40,"tag":2853,"props":3580,"children":3581},{"style":2934},[3582],{"type":45,"value":3583},"move\n",{"type":40,"tag":2853,"props":3585,"children":3587},{"class":2855,"line":3586},15,[3588],{"type":40,"tag":2853,"props":3589,"children":3590},{"style":2934},[3591],{"type":45,"value":3592},"\u002F\u002F The problematic code snippet\n",{"type":40,"tag":48,"props":3594,"children":3595},{},[3596,3601],{"type":40,"tag":66,"props":3597,"children":3598},{},[3599],{"type":45,"value":3600},"Recommended fix",{"type":45,"value":3394},{"type":40,"tag":2842,"props":3603,"children":3607},{"className":3604,"code":3605,"language":3606,"meta":2847,"style":2847},"language-move shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F The corrected code snippet or pattern to follow\n","move",[3608],{"type":40,"tag":81,"props":3609,"children":3610},{"__ignoreMap":2847},[3611],{"type":40,"tag":2853,"props":3612,"children":3613},{"class":2855,"line":29},[3614],{"type":40,"tag":2853,"props":3615,"children":3616},{},[3617],{"type":45,"value":3605},{"type":40,"tag":48,"props":3619,"children":3620},{},[3621,3626,3627],{"type":40,"tag":66,"props":3622,"children":3623},{},[3624],{"type":45,"value":3625},"Rationale",{"type":45,"value":2926},{"type":40,"tag":2853,"props":3628,"children":3629},{},[3630],{"type":45,"value":3631},"Why this fix is appropriate — reference to Move patterns if relevant",{"type":40,"tag":2842,"props":3633,"children":3637},{"className":3634,"code":3636,"language":45},[3635],"language-text","\n### Score Summary\n\n```markdown\n### Risk Score\n\n| Severity | Count | Weight Each | Subtotal |\n|----------|-------|-------------|----------|\n| S1 Critical | N | 10 | N×10 |\n| S2 High | N | 7 | N×7 |\n| S3 Medium | N | 4 | N×4 |\n| S4 Low | N | 2 | N×2 |\n| **Total** | **N** | | **X** |\n\n**Risk Rating**: [Critical \u002F High \u002F Moderate \u002F Low \u002F Clean]\n- Critical: Any S1 finding, OR Total ≥ 40\n- High: Any S2 finding (no S1), OR Total ≥ 20\n- Moderate: Total ≥ 8 (no S1, no S2)\n- Low: Total > 0 (S3\u002FS4 only)\n- Clean: Total = 0\n",[3638],{"type":40,"tag":81,"props":3639,"children":3640},{"__ignoreMap":2847},[3641],{"type":45,"value":3636},{"type":40,"tag":295,"props":3643,"children":3645},{"id":3644},"positive-findings",[3646],{"type":45,"value":3647},"Positive Findings",{"type":40,"tag":2842,"props":3649,"children":3651},{"className":2844,"code":3650,"language":2846,"meta":2847,"style":2847},"### Strengths\n- [What is done well — be specific]\n",[3652],{"type":40,"tag":81,"props":3653,"children":3654},{"__ignoreMap":2847},[3655,3667],{"type":40,"tag":2853,"props":3656,"children":3657},{"class":2855,"line":29},[3658,3662],{"type":40,"tag":2853,"props":3659,"children":3660},{"style":2859},[3661],{"type":45,"value":3012},{"type":40,"tag":2853,"props":3663,"children":3664},{"style":2865},[3665],{"type":45,"value":3666},"Strengths\n",{"type":40,"tag":2853,"props":3668,"children":3669},{"class":2855,"line":2871},[3670,3675],{"type":40,"tag":2853,"props":3671,"children":3672},{"style":2859},[3673],{"type":45,"value":3674},"-",{"type":40,"tag":2853,"props":3676,"children":3677},{"style":2901},[3678],{"type":45,"value":3679}," [What is done well — be specific]\n",{"type":40,"tag":295,"props":3681,"children":3683},{"id":3682},"next-steps",[3684],{"type":45,"value":3685},"Next Steps",{"type":40,"tag":2842,"props":3687,"children":3689},{"className":2844,"code":3688,"language":2846,"meta":2847,"style":2847},"### Recommended Next Steps\n1. Fix all S1 Critical findings before any deployment\n2. Address S2 High findings before mainnet deployment\n3. Review S3 Medium findings for design improvements\n4. Consider S4 Low findings for long-term code health\n5. Run `\u002Fmove-code-quality` for syntax and idiom compliance\n",[3690],{"type":40,"tag":81,"props":3691,"children":3692},{"__ignoreMap":2847},[3693,3705,3718,3731,3744,3757],{"type":40,"tag":2853,"props":3694,"children":3695},{"class":2855,"line":29},[3696,3700],{"type":40,"tag":2853,"props":3697,"children":3698},{"style":2859},[3699],{"type":45,"value":3012},{"type":40,"tag":2853,"props":3701,"children":3702},{"style":2865},[3703],{"type":45,"value":3704},"Recommended Next Steps\n",{"type":40,"tag":2853,"props":3706,"children":3707},{"class":2855,"line":2871},[3708,3713],{"type":40,"tag":2853,"props":3709,"children":3710},{"style":2859},[3711],{"type":45,"value":3712},"1.",{"type":40,"tag":2853,"props":3714,"children":3715},{"style":2901},[3716],{"type":45,"value":3717}," Fix all S1 Critical findings before any deployment\n",{"type":40,"tag":2853,"props":3719,"children":3720},{"class":2855,"line":2881},[3721,3726],{"type":40,"tag":2853,"props":3722,"children":3723},{"style":2859},[3724],{"type":45,"value":3725},"2.",{"type":40,"tag":2853,"props":3727,"children":3728},{"style":2901},[3729],{"type":45,"value":3730}," Address S2 High findings before mainnet deployment\n",{"type":40,"tag":2853,"props":3732,"children":3733},{"class":2855,"line":2907},[3734,3739],{"type":40,"tag":2853,"props":3735,"children":3736},{"style":2859},[3737],{"type":45,"value":3738},"3.",{"type":40,"tag":2853,"props":3740,"children":3741},{"style":2901},[3742],{"type":45,"value":3743}," Review S3 Medium findings for design improvements\n",{"type":40,"tag":2853,"props":3745,"children":3746},{"class":2855,"line":2950},[3747,3752],{"type":40,"tag":2853,"props":3748,"children":3749},{"style":2859},[3750],{"type":45,"value":3751},"4.",{"type":40,"tag":2853,"props":3753,"children":3754},{"style":2901},[3755],{"type":45,"value":3756}," Consider S4 Low findings for long-term code health\n",{"type":40,"tag":2853,"props":3758,"children":3759},{"class":2855,"line":2972},[3760,3765,3770,3775,3779,3783],{"type":40,"tag":2853,"props":3761,"children":3762},{"style":2859},[3763],{"type":45,"value":3764},"5.",{"type":40,"tag":2853,"props":3766,"children":3767},{"style":2901},[3768],{"type":45,"value":3769}," Run ",{"type":40,"tag":2853,"props":3771,"children":3772},{"style":2859},[3773],{"type":45,"value":3774},"`",{"type":40,"tag":2853,"props":3776,"children":3777},{"style":2934},[3778],{"type":45,"value":86},{"type":40,"tag":2853,"props":3780,"children":3781},{"style":2859},[3782],{"type":45,"value":3774},{"type":40,"tag":2853,"props":3784,"children":3785},{"style":2901},[3786],{"type":45,"value":3787}," for syntax and idiom compliance\n",{"type":40,"tag":124,"props":3789,"children":3790},{},[],{"type":40,"tag":54,"props":3792,"children":3794},{"id":3793},"guidelines",[3795],{"type":45,"value":3796},"Guidelines",{"type":40,"tag":98,"props":3798,"children":3799},{},[3800,3817,3827,3837,3847,3857,3873,3883,3900,3910,3920],{"type":40,"tag":102,"props":3801,"children":3802},{},[3803,3808,3810,3815],{"type":40,"tag":66,"props":3804,"children":3805},{},[3806],{"type":45,"value":3807},"Use exact Finding IDs",{"type":45,"value":3809}," — Always reference the registry ID (e.g., ",{"type":40,"tag":81,"props":3811,"children":3813},{"className":3812},[],[3814],{"type":45,"value":344},{"type":45,"value":3816},"). Never invent new IDs. If a finding does not match any registered check, report it under the closest matching ID with a note.",{"type":40,"tag":102,"props":3818,"children":3819},{},[3820,3825],{"type":40,"tag":66,"props":3821,"children":3822},{},[3823],{"type":45,"value":3824},"Never override severity",{"type":45,"value":3826}," — The severity is pre-assigned in the registry. Report exactly as defined. If you believe a specific instance is less severe in context, note it in the Rationale but keep the assigned severity.",{"type":40,"tag":102,"props":3828,"children":3829},{},[3830,3835],{"type":40,"tag":66,"props":3831,"children":3832},{},[3833],{"type":45,"value":3834},"Be specific",{"type":45,"value":3836}," — Always include file paths and line numbers. Never give generic advice without pointing to the exact code.",{"type":40,"tag":102,"props":3838,"children":3839},{},[3840,3845],{"type":40,"tag":66,"props":3841,"children":3842},{},[3843],{"type":45,"value":3844},"Show concrete fixes",{"type":45,"value":3846}," — Every finding must include a \"Recommended fix\" code snippet or clear pattern description.",{"type":40,"tag":102,"props":3848,"children":3849},{},[3850,3855],{"type":40,"tag":66,"props":3851,"children":3852},{},[3853],{"type":45,"value":3854},"Explain impact",{"type":45,"value":3856}," — Describe what could go wrong in a concrete scenario, not abstract risk.",{"type":40,"tag":102,"props":3858,"children":3859},{},[3860,3865,3867,3872],{"type":40,"tag":66,"props":3861,"children":3862},{},[3863],{"type":45,"value":3864},"Do not duplicate move-code-quality",{"type":45,"value":3866}," — Do not flag: module label syntax, import style, method syntax vs function syntax, macro usage (do!, fold!, etc.), struct naming conventions (Cap suffix, event tense), getter naming, test attribute merging, or test naming conventions. Those belong to ",{"type":40,"tag":81,"props":3868,"children":3870},{"className":3869},[],[3871],{"type":45,"value":86},{"type":45,"value":88},{"type":40,"tag":102,"props":3874,"children":3875},{},[3876,3881],{"type":40,"tag":66,"props":3877,"children":3878},{},[3879],{"type":45,"value":3880},"Acknowledge strengths",{"type":45,"value":3882}," — Always include at least one positive finding. Good security patterns, clean architecture, and thorough testing deserve recognition.",{"type":40,"tag":102,"props":3884,"children":3885},{},[3886,3891,3893,3898],{"type":40,"tag":66,"props":3887,"children":3888},{},[3889],{"type":45,"value":3890},"Multi-package awareness",{"type":45,"value":3892}," — When analyzing a workspace with multiple packages, check ",{"type":40,"tag":81,"props":3894,"children":3896},{"className":3895},[],[3897],{"type":45,"value":982},{"type":45,"value":3899}," callers across all packages before flagging PAT-CP-2.",{"type":40,"tag":102,"props":3901,"children":3902},{},[3903,3908],{"type":40,"tag":66,"props":3904,"children":3905},{},[3906],{"type":45,"value":3907},"Context over rules",{"type":45,"value":3909}," — If a VecMap is provably bounded (e.g., enum-like set of 5 values), do not flag DES-OM-1. Use judgment on context, but document your reasoning.",{"type":40,"tag":102,"props":3911,"children":3912},{},[3913,3918],{"type":40,"tag":66,"props":3914,"children":3915},{},[3916],{"type":45,"value":3917},"Order findings by severity",{"type":45,"value":3919}," — List S1 findings first, then S2, S3, S4. Within the same severity, order alphabetically by category ID.",{"type":40,"tag":102,"props":3921,"children":3922},{},[3923,3928],{"type":40,"tag":66,"props":3924,"children":3925},{},[3926],{"type":45,"value":3927},"Suppress false positives",{"type":45,"value":3929}," — If you inspect a potential finding and determine it's a false positive (e.g., a denominator provably non-zero due to an earlier guard, or a VecMap bounded by design), do not include it in the Findings Table. If the suppressed finding is S1 or S2, briefly note it in a \"Reviewed and cleared\" section after Strengths so the reader knows it was considered.",{"type":40,"tag":124,"props":3931,"children":3932},{},[],{"type":40,"tag":54,"props":3934,"children":3936},{"id":3935},"interactive-follow-up",[3937],{"type":45,"value":3938},"Interactive Follow-up",{"type":40,"tag":48,"props":3940,"children":3941},{},[3942],{"type":45,"value":3943},"After presenting the review:",{"type":40,"tag":1751,"props":3945,"children":3946},{},[3947,3952,3957,3962],{"type":40,"tag":102,"props":3948,"children":3949},{},[3950],{"type":45,"value":3951},"Offer to fix Critical and High findings automatically",{"type":40,"tag":102,"props":3953,"children":3954},{},[3955],{"type":45,"value":3956},"Provide deeper explanations for any specific finding",{"type":40,"tag":102,"props":3958,"children":3959},{},[3960],{"type":45,"value":3961},"Discuss architectural alternatives for Design findings",{"type":40,"tag":102,"props":3963,"children":3964},{},[3965],{"type":45,"value":3966},"Help write tests for identified TST gaps",{"type":40,"tag":124,"props":3968,"children":3969},{},[],{"type":40,"tag":54,"props":3971,"children":3973},{"id":3972},"example-interactions",[3974],{"type":45,"value":3975},"Example Interactions",{"type":40,"tag":48,"props":3977,"children":3978},{},[3979,3984,3986,3991,3992],{"type":40,"tag":66,"props":3980,"children":3981},{},[3982],{"type":45,"value":3983},"User",{"type":45,"value":3985},": \"Review this Move package for security issues\"\n",{"type":40,"tag":66,"props":3987,"children":3988},{},[3989],{"type":45,"value":3990},"You",{"type":45,"value":2926},{"type":40,"tag":2853,"props":3993,"children":3994},{},[3995],{"type":45,"value":3996},"Run the full analysis workflow, produce the complete report with findings table, detailed findings, and risk score",{"type":40,"tag":48,"props":3998,"children":3999},{},[4000,4004,4006,4010,4011],{"type":40,"tag":66,"props":4001,"children":4002},{},[4003],{"type":45,"value":3983},{"type":45,"value":4005},": \"Check the access control in my staking module\"\n",{"type":40,"tag":66,"props":4007,"children":4008},{},[4009],{"type":45,"value":3990},{"type":45,"value":2926},{"type":40,"tag":2853,"props":4012,"children":4013},{},[4014],{"type":45,"value":4015},"Run Phase 1 discovery + Phase 2 SEC-AC checks only on the specified module, produce a focused report",{"type":40,"tag":48,"props":4017,"children":4018},{},[4019,4023,4025,4029,4030],{"type":40,"tag":66,"props":4020,"children":4021},{},[4022],{"type":45,"value":3983},{"type":45,"value":4024},": \"Is this function safe?\"\n",{"type":40,"tag":66,"props":4026,"children":4027},{},[4028],{"type":45,"value":3990},{"type":45,"value":2926},{"type":40,"tag":2853,"props":4031,"children":4032},{},[4033],{"type":45,"value":4034},"Run SEC checks on the specific function, check its callers and callees, produce a scoped report",{"type":40,"tag":48,"props":4036,"children":4037},{},[4038,4042,4044,4048,4049],{"type":40,"tag":66,"props":4039,"children":4040},{},[4041],{"type":45,"value":3983},{"type":45,"value":4043},": \"What's the risk score for this package?\"\n",{"type":40,"tag":66,"props":4045,"children":4046},{},[4047],{"type":45,"value":3990},{"type":45,"value":2926},{"type":40,"tag":2853,"props":4050,"children":4051},{},[4052],{"type":45,"value":4053},"Run full scan, produce the Findings Summary table and Risk Score section — skip detailed findings unless asked",{"type":40,"tag":4055,"props":4056,"children":4057},"style",{},[4058],{"type":45,"value":4059},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4061,"total":29},[4062],{"slug":4,"name":4,"fn":5,"description":6,"org":4063,"tags":4064,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4065,4066,4067,4068],{"name":17,"slug":18,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":14,"slug":8,"type":15},{"items":4070,"total":4240},[4071,4087,4098,4108,4121,4139,4154,4167,4188,4200,4211,4227],{"slug":4072,"name":4072,"fn":4073,"description":4074,"org":4075,"tags":4076,"stars":4084,"repoUrl":4085,"updatedAt":4086},"move-bytecode-comprehension","analyze and disassemble Move bytecode","Use when reading or reasoning about compiled Move bytecode or `sui move disassemble` output. Mental model for the binary format, what survives compilation (and what's lost), and how to read disassembly soundly. Trigger on \"what does this package do?\", \"read this .mv module\", \"interpret this disassembly\", or whenever an analysis needs to interpret bytecode faithfully.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4077,4080,4083],{"name":4078,"slug":4079,"type":15},"Code Analysis","code-analysis",{"name":4081,"slug":4082,"type":15},"Engineering","engineering",{"name":14,"slug":8,"type":15},7724,"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002Fsui","2026-07-16T05:59:32.904886",{"slug":4088,"name":4088,"fn":4089,"description":4090,"org":4091,"tags":4092,"stars":4084,"repoUrl":4085,"updatedAt":4097},"official-sui-skills","access official Sui development resources","Pointer to the official Mysten Labs skills for building on Sui — language fundamentals, object model, PTBs, SDKs, publishing, upgrades, frontend integration, accessing on-chain data. Maintained upstream at github.com\u002FMystenLabs\u002Fskills; pinned to the same ref the audit catalog derives from (see maintenance\u002FUPSTREAMS.md). Trigger on \"build a contract\", \"publish a package\", \"upgrade a module or package\", \"use the TypeScript SDK\", \"write a PTB\", \"set up a Sui client\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4093,4096],{"name":4094,"slug":4095,"type":15},"Documentation","documentation",{"name":14,"slug":8,"type":15},"2026-07-16T06:00:59.641382",{"slug":4099,"name":4099,"fn":4100,"description":4101,"org":4102,"tags":4103,"stars":4084,"repoUrl":4085,"updatedAt":4107},"sui-and-move-tools","disassemble Sui Move bytecode","Use to get bytecode for a deployed Sui package and produce a disassembled working view. One GraphQL call fetches every module's raw bytecode bytes; `sui move disassemble` (already on the system, running `sui prompt`) produces `.asm` files for analysis. Trigger on \"fetch this package's bytecode\", \"get me the .mv for package X\", \"disassemble this package\", or \"I need to read a deployed Sui package\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4104,4105,4106],{"name":4078,"slug":4079,"type":15},{"name":4081,"slug":4082,"type":15},{"name":14,"slug":8,"type":15},"2026-07-16T06:02:25.3633",{"slug":4109,"name":4109,"fn":4110,"description":4111,"org":4112,"tags":4113,"stars":4084,"repoUrl":4085,"updatedAt":4120},"sui-move-security-review","audit Sui Move smart contracts","Use when auditing, reviewing, or hunting for vulnerabilities in Move code on Sui. Applies equally to source code (.move files) and to disassembly of compiled bytecode (on-chain packages). A checklist of invariants whose VIOLATION causes exploitable bugs: access control & capabilities, struct abilities & type safety, object lifecycle & ownership, shared-object and PTB attack surface, dynamic fields & collections, arithmetic & coins, init\u002FOTW\u002Fpackage upgrades, hot-potato composability, time & on-chain randomness, and test-only code leakage. Trigger on \"audit this Move code\", \"find vulnerabilities in this Sui contract\", \"security review\", \"is this package safe?\", \"I suspect there's a bug in X\", \"something is wrong with this contract\", or when reasoning about whether a Move function can be abused.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4114,4115,4118,4119],{"name":20,"slug":21,"type":15},{"name":4116,"slug":4117,"type":15},"Security","security",{"name":23,"slug":24,"type":15},{"name":14,"slug":8,"type":15},"2026-07-16T06:02:55.691149",{"slug":4122,"name":4122,"fn":4123,"description":4124,"org":4125,"tags":4126,"stars":4136,"repoUrl":4137,"updatedAt":4138},"memwal","integrate Walrus Memory SDK","Walrus Memory SDK — portable agent memory that works across apps, sessions, and workflows.\n\nUse when users say:\n- \"add memory to my app\"\n- \"portable agent memory\"\n- \"integrate Walrus Memory\"\n- \"AI agent memory\"\n- \"memory across agents\"\n- \"Walrus memory storage\"\n- \"setup Walrus Memory\"\n- \"recall memories\"\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4127,4130,4133],{"name":4128,"slug":4129,"type":15},"Agents","agents",{"name":4131,"slug":4132,"type":15},"Memory","memory",{"name":4134,"slug":4135,"type":15},"SDK","sdk",57,"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002FMemWal","2026-07-16T06:02:39.838395",{"slug":4140,"name":4140,"fn":4141,"description":4142,"org":4143,"tags":4144,"stars":3481,"repoUrl":4152,"updatedAt":4153},"accessing-data","read data from the Sui network","How to read data from the Sui network. Use when choosing or implementing a data access strategy — queries for on-chain state, indexing pipelines, historical lookups, event subscriptions, cross-chain reads, or off-chain blob storage. Covers the two live Sui APIs (gRPC and GraphQL RPC), the Archival Store, the General-Purpose Indexer, the `sui-indexer-alt` custom indexing framework, and Walrus for off-chain blobs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4145,4148,4149],{"name":4146,"slug":4147,"type":15},"Data Analysis","data-analysis",{"name":14,"slug":8,"type":15},{"name":4150,"slug":4151,"type":15},"Web3","web3","https:\u002F\u002Fgithub.com\u002FMystenLabs\u002Fskills","2026-08-01T05:44:32.775598",{"slug":4155,"name":4155,"fn":4156,"description":4157,"org":4158,"tags":4159,"stars":3481,"repoUrl":4152,"updatedAt":4166},"composable-move-functions","design composable Sui Move functions","Use when writing Move functions on Sui, especially public APIs. Applies to function visibility (public vs entry), parameter ordering, and return patterns. Use whenever designing function signatures or deciding whether functions should transfer objects or return them.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4160,4163,4164,4165],{"name":4161,"slug":4162,"type":15},"API Development","api-development",{"name":23,"slug":24,"type":15},{"name":14,"slug":8,"type":15},{"name":4150,"slug":4151,"type":15},"2026-07-16T06:02:49.198495",{"slug":4168,"name":4168,"fn":4169,"description":4170,"org":4171,"tags":4172,"stars":3481,"repoUrl":4152,"updatedAt":4187},"frontend-apps","build Sui dApps with dapp-kit","Sui frontend \u002F dApp development with @mysten\u002Fdapp-kit-react (React) and @mysten\u002Fdapp-kit-core (Vue, vanilla JS, Svelte, Web Components, other frameworks). Use when building browser apps that connect Sui wallets, query on-chain state, or submit transactions. Covers wallet connection, network switching, transaction execution, query patterns with TanStack React Query, and the specific pitfalls of browser + wallet + async-indexer environments. Pair with the `sui-sdks` skill for @mysten\u002Fsui Transaction construction patterns and the `ptbs` skill for PTB semantics.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4173,4176,4179,4180,4183,4186],{"name":4174,"slug":4175,"type":15},"Frontend","frontend",{"name":4177,"slug":4178,"type":15},"React","react",{"name":14,"slug":8,"type":15},{"name":4181,"slug":4182,"type":15},"Svelte","svelte",{"name":4184,"slug":4185,"type":15},"Vue","vue",{"name":4150,"slug":4151,"type":15},"2026-08-01T05:44:28.958473",{"slug":4189,"name":4189,"fn":4190,"description":4191,"org":4192,"tags":4193,"stars":3481,"repoUrl":4152,"updatedAt":4199},"generate-sui-agent-config","generate configuration files for Sui projects","Generate a CLAUDE.md or AGENT.md configuration file for Sui projects. Use when setting up a new Sui project, when user mentions \"CLAUDE.md\", \"AGENT.md\", \"agent config\", or when working on a Sui project that does not already have a CLAUDE.md or AGENT.md in the project root.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4194,4197,4198],{"name":4195,"slug":4196,"type":15},"Configuration","configuration",{"name":4094,"slug":4095,"type":15},{"name":14,"slug":8,"type":15},"2026-07-16T06:00:59.981056",{"slug":4201,"name":4201,"fn":4202,"description":4203,"org":4204,"tags":4205,"stars":3481,"repoUrl":4152,"updatedAt":4210},"modern-move-syntax","write Move 2024 edition code for Sui","Use when writing Move code on Sui to ensure 2024 edition syntax is used. Applies to method calls, string literals, vector operations, option handling, loops, and struct unpacking. Use whenever writing Move code to avoid legacy function-call syntax patterns.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4206,4207,4208,4209],{"name":4081,"slug":4082,"type":15},{"name":23,"slug":24,"type":15},{"name":14,"slug":8,"type":15},{"name":4150,"slug":4151,"type":15},"2026-07-16T06:02:43.277596",{"slug":4212,"name":4212,"fn":4213,"description":4214,"org":4215,"tags":4216,"stars":3481,"repoUrl":4152,"updatedAt":4226},"move-unit-testing","write unit tests for Sui Move contracts","Use when writing unit tests for Move smart contracts on Sui. Applies to test function naming, assertions, test attributes, context usage, and cleanup patterns. Use whenever user asks to write tests, add tests, or test a Move module.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4217,4220,4221,4222,4225],{"name":4218,"slug":4219,"type":15},"QA","qa",{"name":23,"slug":24,"type":15},{"name":14,"slug":8,"type":15},{"name":4223,"slug":4224,"type":15},"Testing","testing",{"name":4150,"slug":4151,"type":15},"2026-08-01T05:44:30.788585",{"slug":4228,"name":4228,"fn":4229,"description":4230,"org":4231,"tags":4232,"stars":3481,"repoUrl":4152,"updatedAt":4239},"naming-conventions","apply Sui Move naming conventions","Use when writing or reviewing Move smart contracts on Sui. Applies to naming structs, error constants, regular constants, events, getter functions, capability types, hot potato types, and dynamic field keys. Use whenever creating new types, functions, or constants in Move code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4233,4236,4237,4238],{"name":4234,"slug":4235,"type":15},"Best Practices","best-practices",{"name":23,"slug":24,"type":15},{"name":14,"slug":8,"type":15},{"name":4150,"slug":4151,"type":15},"2026-07-16T06:02:48.830052",37]