Open source Sui Move security scanner + live exploit monitor, tested against 7 protocols including the Cetus exploit pattern

Sui Network
, ,
1

Introducing SuiSentinel: open source Sui Move security scanner + live exploit monitor

Hey everyone, sharing a project I’ve been building: SuiSentinel, an open source security pipeline for Sui Move contracts.

It does two things:

1. Static scanner. Scans .move source pre-deployment for known vulnerability patterns. In testing across 7 real Sui protocols (including a direct scan of the Cetus CLMM interface source), it correctly flagged the large-literal/overflow-threshold pattern class responsible for the $223M Cetus exploit, the same category of bug caused by the flawed checked_shlw implementation.

2. Live monitor. Watches deployed mainnet packages in real time and pushes (THE SUI TEAM WILL NEVER ASK YOU TO LEAVE THIS SITE) alerts when transaction activity matches exploit-like patterns. Since Cetus wasn’t an isolated bug (Kriya, Momentum, and Bluefin all had related exposure through the same shared integer-mate library), the goal is to give protocol teams and the wider community a proactive first line of detection, not just post-mortem forensics after funds are already gone.

Tech: Python, CLI-driven (--watch, --scan-source, --dry-run-sample), outputs both JSON findings and HTML reports.

Repo: GitHub - NanoJS10/sui-sentinel: Sui Move static security scanner and live exploit monitor — tested against 7 protocols · GitHub (fully open source)

This is early, v0.3.0, actively developed, and I’d genuinely welcome feedback, bug reports, or collaborators who want to help expand the detection rule set beyond the overflow-threshold class. Also, does anyone here know the current, working link for the Sui Foundation’s Developer Grant / RFP application? I’ve been trying to track it down and keep hitting outdated or mismatched pages. Any pointer appreciated. Happy to answer questions about the detection approach or the Cetus findings specifically.

nanojs@proton.me

2

Hi @Nanojs10, great work on the Sui Move security side! I definitely agree this area deserves more focus, as Sui’s security tooling is still in its early stages compared to more mature ecosystems like Ethereum and Solana. I’d love to help test it out on my live product and give you some feedback!

Also, if you want to get more visibility and gather more feedback, I’d highly recommend sharing your project in the Discord #dev-showcase channel and the Shinami Riders TG group—a lot of devs showcase their work there.

Regarding the grant/RFP applications, as far as I know, those specific programs have been closed, but Sui has rolled out new ones. Feel free to check out the program-funding page to stay updated on the latest opportunities.

3

Thanks so much, this is really helpful! Would genuinely appreciate you testing SuiSentinel against your live product, that kind of real-world feedback is exactly what the tool needs at this stage. Feel free to open an issue on my GitHub with anything you find, or reach me directly at nanojs@proton.me.
Also thanks for the pointer on the grant programs being closed, that explains a lot of dead links I’ve been chasing. Will check the program-funding page for what’s currently open. And appreciate the tip on #dev-showcase and Shinami Riders, will drop the project there too.