Sui Move Security — OpenZeppelin Contracts for Sui

Purpose

In May 2025 a single flawed overflow check in a shared math library — a checked_shl-class function that silently passed a value it should have rejected — led to the Cetus exploit: ~$223M drained from the largest DEX on Sui, and a corrupted fixed-point intermediate that multiple downstream protocols depended on. The lesson is structural, not incidental: value-path math and privileged-capability handling must come from audited primitives, never be hand-rolled.

OpenZeppelin Contracts for Sui (MIT) is that library. This skill is the map; the SSOT is upstream — start from the machine-readable entry point when you need detail: https://raw.githubusercontent.com/OpenZeppelin/contracts-sui/main/llms.txt

Hard rules (apply to every Move review and every new module)