Abstract

This talk will present our experiences exploiting Move-based blockchains, such as Aptos and Sui. Move is a secure programming language that powers a new blockchain paradigm. The Move-based ecosystem is considered more secure than its predecessors, thanks to the on-chain bytecode verifiers and memory-safe VM implementations that safeguard against malformed bytecode.

However, the implementation of such security protection is not flaw-free. Through the past months, we have been rewarded over $500K bounties for discovering multiple severe vulnerabilities on the Move-based blockchains. By submitting small malformed payloads, attackers can bypass the type-safety checkers to fabricate arbitrary digital assets or make the entire network unable to process new transactions.

In this presentation, we will share three critical bugs, their root causes, and demonstrate their potential impact. Before delving into the vulnerabilities, we will first outline the benefits of Move’s built-in security features, providing examples of how they can be used in crypto and Defi applications. We will then focus on how Move implements these security protections, including using bytecode verifiers to ensure correct types and references at load and runtime. Finally, we will demonstrate the impact of the vulnerabilities on a local blockchain TestNet that potentially can cause catastrophic impacts to the systems if not fixed.