Move Auditor

Move Smart Contract Security Audit

You are the orchestrator of a parallelized Move security audit.

Mode Selection

Exclude pattern: skip directories tests/, examples/, doc/, scripts/ and files matching *_test.move, *Test*.move or *Mock*.move.

• Default (no arguments): scan all .move files using the exclude pattern. Use Bash find (not Glob).
• $filename ...: scan the specified file(s) only.

Flags:

• --file-output (off by default): also write the report to a markdown file (path per skills/validation/SKILL.md). Never write a report file unless explicitly passed.

Orchestration Flow

Turn 0 — Banner

Print the banner:

bash scripts/banner.sh

Turn 1 — Detect Platform

Run the detection script:

python3 scripts/detect-platform.py <project_path>

This recursively scans for Move.toml files and checks their dependencies:

• MystenLabs/sui.git → sui
• aptos-labs/aptos-core.git → aptos

Store the result as {platform}.

Turn 2 — Discover

Make these parallel tool calls in one message:

a. Bash find for in-scope .move files per mode selection and exclude pattern. b. Read skills/validation/SKILL.md c. Bash mktemp -d /tmp/move-audit-XXXXXX → store as {bundle_dir}

If no .move files found, print: No Move source files found. and stop.

Turn 3 — Prepare

Build all bundles in a single Bash command using cat:

1. {bundle_dir}/source.md — ALL in-scope .move files, each with a ### path/to/file.move header and fenced code block.

2. Agent bundles = source.md + common references + agent definition + platform-specific skill modules:

Every bundle includes the two common references:

• skills/move-auditor/references/common/move-language.md
• skills/move-auditor/references/common/move-vulnerabilities.md

Common bundles (all platforms):

Platform-specific bundles:

cat source.md references/common/move-language.md references/common/move-vulnerabilities.md references/{platform}/CORE_VULNERABILITIES.md references/{platform}/{platform-vuln-file}.md agents/{agent-file}.md references/{platform}/{skill-1}.md references/{platform}/{skill-2}.md agents/shared-rules.md > agent-N-bundle.md

• {platform-vuln-file} = SUI_VULNERABILITIES.md for Sui, APTOS_VULNERABILITIES.md for Aptos.

Append agents/shared-rules.md to every bundle.

Print line counts for every bundle and source.md. Do NOT inline file content into agent prompts.

Turn 4 — Run Specialists

In one message, spawn all 8 specialists as parallel foreground Agent calls. Prompt template:

Your bundle file is {bundle_dir}/agent-N-bundle.md (XXXX lines).
The bundle contains all in-scope source code, your agent instructions, specialized methodology, and shared rules.
Read the bundle fully before producing findings.
Focus on {platform}-specific ability and type safety / ownership / flash loan / token flow / access control / oracle / dependency / migration.

Each agent reads its bundle and independently produces FINDINGs and LEADs per the specialist output format.

Turn 5 — Depth Analysis

After all breadth agents return, assess which findings warrant deeper analysis. For each breadth finding that meets depth trigger criteria:

Spawn relevant depth agents in parallel. Each receives source + specific findings + agent definition from agents/.

If no breadth findings meet depth trigger criteria, skip this turn entirely.

Turn 6 — Deduplicate, Validate & Report

Single-pass: deduplicate all breadth + depth results, gate-evaluate, and produce the final report in one turn.

1. Deduplicate

Parse every FINDING and LEAD from all agents. Group by group_key field (format: Module | function | bug-class). Exact-match first; then merge synonymous bug_class tags. Keep best version per group, number sequentially, annotate [agents: N].

2. Gate Evaluation

Run each finding through the four gates defined in skills/validation/SKILL.md.

3. Confidence Scoring

Apply confidence scoring per skills/validation/SKILL.md.

4. Lead Promotion

• Promote LEAD → FINDING (confidence 75) if: complete exploit chain traced, OR [agents: 2+] flagged same issue, OR depth agent confirmed.
• No deployer-intent reasoning — evaluate what the code allows.

5. Fix Verification (confidence >= 80 only)

Trace the attack with fix applied; verify no new DoS, reentrancy, or broken invariants.

6. Format and Print

Format per skills/validation/SKILL.md. Exclude rejected items. If --file-output: also write to file.

Vulnerability Categories

Sui-Specific (S1–S10)

Aptos-Specific (A1–A10)

Detection Commands

Sui

# Find object definitions and transfers
rg "public struct.*has key" sources/
rg "sui::transfer::public_transfer|public_share_object" sources/

# Find shared objects
rg "sui::transfer::share_object|shared_object" sources/

# Find kiosk operations
rg "sui::kiosk" sources/

# Find dynamic fields
rg "sui::dynamic_field|dynamic_object_field" sources/

# Find capabilities
rg "AdminCap|OwnerCap|UpgradeCap" sources/

# Find witness patterns
rg "Witness|witness|has drop" sources/

Aptos

# Find signer usage
rg "signer|signer::address_of" sources/

# Find entry functions
rg "public entry fun|entry fun" sources/

# Find resource operations
rg "move_to|move_from|borrow_global|exists" sources/

# Find FungibleAsset operations
rg "fungible_asset::|FungibleAsset" sources/

# Find event emissions
rg "event::emit|emit_event" sources/

# Find capabilities
rg "SignerCapability|MintRef|BurnRef|TransferRef" sources/

# Find witness patterns
rg "Witness|witness|has drop" sources/

Skill Modules Reference

The following specialized skill modules are available. Files in references/common/ apply to all platforms; files in references/{platform}/ are loaded based on detected platform.

Common (always loaded)

Per-Platform Modules (references/{platform}/)

Sui-Only Modules (references/sui/)

Aptos-Only Modules (references/aptos/)