MoveBit

🥳🥳

🧲 Sui Devnet Fixes Two Cryptographic Issues

On November 9, Mysten Labs released Sui Devnet v1.84.0, bumping the protocol version to 142. Two changes merit close attention: a fix for an integer overflow during ECDSA public key recovery, and stricter validation for Groth16 zero-knowledge proof verification keys.

Why should builders care about low-level protocol updates?

Because the security of the Move ecosystem isn't solely defined by smart contract code. When utilizing features like signature verification and ZK-proofs, developers inherently rely on the chain's underlying cryptographic primitives. If these primitives mishandle malformed inputs, those risks can propagate straight into upper-layer applications.

🔋 1. ECDSA Public Key Recovery: Overflow Cannot Be Ignored

The bug resided in the secp256r1_ecrecover function. During the calculation of r + n, if the result exceeded the bounds of a 256-bit integer, the legacy logic would suffer a numerical wrap-around, ultimately outputting an incorrect public key.

The fix is straightforward: the protocol now halts execution immediately upon detecting an overflow, abandoning the flawed result rather than proceeding with it.

🔋 2. Groth16: Verifying Keys Need Strict Length Checks

Groth16 is a widely used ZK-proof verification scheme. During verification, the number of elements in the key's vk_gamma_abc must precisely match the count of public inputs.

Previously, this logic lacked rigorous length checks. This update introduces strict validation: if the counts mismatch, the protocol throws an EInvalidVerifyingKey error, explicitly rejecting invalid keys upfront.

What Does This Mean for Move Developers?

Neither issue is structurally complex—one is an integer overflow, the other an array length mismatch. Yet, they serve as a reminder that security flaws don't always stem from sophisticated attack vectors; sometimes, they're simply the result of poor edge-case input handling.

For Move developers and security auditors, looking beyond contract permissions, state changes, and business logic is no longer enough. You must also scrutinize input validation, boundary handling, and error propagation in underlying crypto primitives.

This is why MoveBit continuously tracks core infrastructure shifts across Move-based ecosystems like Sui and Aptos : a genuinely comprehensive security audit evaluates not just what your contract writes, but whether the underlying capabilities it relies on are bulletproof.

Note: These updates pertain strictly to Sui Devnet v1.84.0. They do not constitute a Sui Mainnet upgrade, nor do they indicate any actively exploited vulnerabilities.

Why Upgrading a Package Does Not Eliminate Legacy Security Risks? x.com/i/article/2112…

A single missing access control check can put an entire DeFi protocol at risk on @SuiNetwork, so every privileged operation involving shared objects deserves careful security review. x.com/i/article/2109…

Security coverage is extending beyond pre-deployment smart contract audits toward continuous verification throughout the protocol lifecycle.