Move audits for Aptos and Sui, by auditors who think in resources.

Linear types mean an asset cannot be duplicated or silently dropped, and the bytecode verifier enforces it. That eliminates many reentrancy and accounting bugs by construction. It does not eliminate logic bugs, authorisation bugs or economic bugs. The incidents we see on Aptos and Sui are about who is allowed to call what, which objects are shared, whether a capability can be obtained by someone it was not meant for, and whether the maths in a pool or a lending market holds under adversarial inputs. Those require a human reading the modules with the protocol's intent in mind.

On Sui, ownership is explicit and visible: an owned object can only be used by its owner, a shared object by anyone. Many findings come from the wrong choice — a treasury that should be owned but is shared, a shared object whose mutation is not guarded, dynamic fields that let anyone attach data, or transfer policies on Kiosk assets that can be bypassed. We also review programmable transaction block composition, since attackers can combine your entry points with other modules in a single transaction in ways the design never anticipated.

On Aptos, resources live under accounts and the signer is the root of authority, so signer capabilities and resource accounts deserve the closest look: who holds the SignerCapability, where is it stored, can it be borrowed through a public function? We review the Aptos Framework integrations — coin and fungible asset standards, objects, staking and governance — and the package upgrade policy, since an upgradable package with a compatible policy is only as safe as its upgrade key.

Move ships with a prover, and for the invariants that matter most — total supply conservation, access control on privileged functions, no-negative-balance properties — writing specs is worth the effort. We review existing specifications for gaps, recommend which properties would pay back the investment, and can write the specs as part of the engagement.

A small set of Move modules takes about a week; a full protocol with several packages and economic logic takes two to three weeks. Quotes are fixed and in writing, retest included.