move-vulnerability-database

KO | EN

gitlite — search

#react #ai #typescript #llm #golang #go #rust #linux #nodejs #java #cli #kubernetes #pytorch #open-source

move-vulnerability-database

(★ 90)

Move Vulnerability Database

File Explorer

Download Latest Version (.zip)

- - mdbook.yml
  - validate-data.yml
- vulnerabilities.jsonl
- CONTRIBUTING_DATA.md
- vulnerability.schema.json
- dedup_fingerprint.py
- export_jsonl.py
- validate_jsonl.py
- - about.md
  - appendix.md
  - CHANGELOG.md
  - overview.md
  - placeholder.md
  - README.md
  - resources.md
  - SUMMARY.md
- about.md
- appendix.md
- overview.md
- placeholder.md
- README.md
- resources.md
- SUMMARY.md
- - access_control.md
  - access_control_crit.md
  - access_control_high.md
  - access_control_low.md
  - access_control_med.md
- - business_logic.md
  - business_logic_crit.md
  - business_logic_high.md
  - business_logic_low.md
  - business_logic_med.md
- - calculation_errors.md
  - calculation_errors_crit.md
  - calculation_errors_high.md
  - calculation_errors_low.md
  - calculation_errors_med.md
- - centralization_risk.md
  - centralization_risk_high.md
  - centralization_risk_low.md
  - centralization_risk_med.md
  - SUMMARY.md
- - code_optimization.md
  - code_optimization_low.md
- - coding_mistake.md
  - coding_mistake_low.md
- - collision.md
  - collision_low.md
  - collision_med.md
- - constant_definition.md
  - constant_definition_crit.md
  - constant_definition_high.md
  - constant_definition_low.md
  - constant_definition_med.md
- - cross_implementation.md
  - cross_implementation_low.md
  - cross_implementation_med.md
- - data_inconsistency.md
  - data_inconsistency_crit.md
  - data_inconsistency_high.md
  - data_inconsistency_low.md
  - data_inconsistency_med.md
- - documentation_mismatch.md
  - documentation_mismatch_low.md
- - dos.md
  - dos_crit.md
  - dos_high.md
  - dos_low.md
  - dos_med.md
- - front_running.md
  - front_running_high.md
  - front_running_low.md
  - front_running_med.md
- - gas_related_issues.md
  - gas_related_issues_med.md
- - inflation_attacks.md
  - inflation_attacks_low.md
  - inflation_attacks_med.md
- - input_validation.md
  - input_validation_crit.md
  - input_validation_high.md
  - input_validation_low.md
  - input_validation_med.md
- - looping_issues.md
  - looping_issues_crit.md
  - looping_issues_high.md
  - looping_issues_low.md
  - looping_issues_med.md
- - missing_functions.md
  - missing_functions_crit.md
  - missing_functions_high.md
  - missing_functions_low.md
  - missing_functions_med.md
- - missing_version_check.md
  - missing_version_check_high.md
  - missing_version_check_low.md
  - missing_version_check_med.md
- - oracle_issues.md
  - oracle_issues_crit.md
  - oracle_issues_high.md
  - oracle_issues_low.md
  - oracle_issues_med.md
- - race_condition.md
  - race_condition_low.md
- - rundev_low.md
  - runtime_dev.md
  - runtime_dev_med.md
- - signature_replay.md
  - signature_replay_low.md
- - state_management.md
  - state_management_crit.md
  - state_management_high.md
  - state_management_low.md
  - state_management_med.md
- - appendix.md
  - third_party_risk.md
  - third_party_risk_low.md
- CHANGELOG.md
- overview.md
- placeholder.md
- resources.md
- SUMMARY.md
about.md
appendix.md
book.toml
CHANGELOG.md
overview.md
README.md
resources.md
taxonomy_map.json

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## Welcome to the Move Vulnerability Database (MVD) v3.0!

A comprehensive collection of vulnerability patterns in the Move ecosystem.

### What's Inside

- **[Vulnerability Patterns](overview.md)** - Categorized security issues with examples and severity ratings
- **[Appendix](appendix.md)** - Audit reports and protocol references  
- **[Learning Resources](resources.md)** - Curated materials for learning Move security

---

This resource consolidates 1000+ security vulnerabilities extracted from 200+ public Move audit reports across multiple firms and auditors. The database categorizes vulnerabilities into common patterns—from Input Validation and Business Logic flaws to Access Control and State Management issues—providing a central reference for developers, auditors, and security researchers to understand, recognize, and learn from real-world mistakes in Move codebases.

| Vulnerability Patterns      | Findings |
| -------------------------- | -------- |
| Business Logic             | 296      |
| Input Validation           | 170      |
| Calculation Errors         | 148      |
| Coding Mistake             | 76       |
| Access Control             | 73       |
| State Management           | 64       |
| Code Optimization          | 43       |
| Denial of Service          | 40       |
| Missing Functions          | 37       |
| Data Inconsistency         | 31       |
| Oracle Issues              | 27       |
| Centralization Risk        | 25       |
| Constant Definition        | 21       |
| Cross-Implementation       | 16       |
| Runtime/Development Issues | 15       |
| Missing Version Check      | 12       |
| Gas-related Issues         | 11       |
| Looping Issues             | 10       |
| Front-running              | 7        |
| Collision                  | 5        |
| Inflation Attacks          | 5        |
| Documentation Mismatch     | 3        |
| Signature Replay           | 3        |
| Third-Party Risk           | 2        |
| Race Condition             | 1        |
| **Total**                  | **1141** |

Data sourced from public Move audit reports by the following auditors/firms:

| Audit Firm/Auditor | Report Links |
| --- | --- |
| OtterSec | [Sampled Public Audit Reports (OtterSec Notion)](https://www.notion.so/Sampled-Public-Audit-Reports-a296e98838aa4fdb8f3b192663400772) |
| MoveBit | [MoveBit — Sampled Audit Reports](https://github.com/movebit/Sampled-Audit-Reports/tree/main) |
| MoveJay | [MoveJay (Jayfromthe13th)](https://github.com/Jayfromthe13th) |
| Zellic | [Zellic Reports](https://reports.zellic.io/) |
| Spearbit | [Spearbit Reports](https://github.com/spearbit/portfolio) |
| Cantina |[Cantina Reports](https://cantina.xyz/portfolio) |
| Code4Arena | [Code4Arena Reports](https://code4rena.com/reports) |
| Certora | [Certora Security Reports](https://github.com/Certora/SecurityReports/tree/main/Reports) |
| Hacken | [Hacken Audits](https://hacken.io/audits/) |
| Pashov Audit Group | [Pashov Audit Group — Audits](https://github.com/pashov/audits/tree/master) |
| ExVul Security| [ExVul Audits](https://github.com/ExVul-Sec/AuditReport) |
| Quantstamp | [Quantstamp Reports](https://certificate.quantstamp.com) |
| SlowMist | [SlowMist Reports](https://github.com/slowmist/Knowledge-Base/tree/master/open-report-V2) |
| Three Sigma | [Three Sigma Reports](https://threesigma.xyz/case-studies) |
| Asymptotic | [Asymptotic Reports](https://info.asymptotic.tech/audit-reports) |
| Sherlock | [Sherlock Reports](https://github.com/sherlock-audit) |

Refer to the [Appendix](appendix.md) for the full list of reports and protocols.

### ⚠️ Disclaimer

All findings and summaries in this database are sourced from **publicly available audit reports**.

I **do not own or claim ownership** of any reports, documents, or content referenced here — all rights belong to their respective auditors, firms, and project teams.

This repository is an **independent, educational, and non-commercial project** created to help the community study and understand common vulnerability patterns in the Move ecosystem.

While I aim for accuracy, there may be **typos, errors, broken links, or misattributed information**.

If you spot any mistakes or missing details, please **open an issue or reach out** so I can correct them.

### 💬 Support & Contributions

If you'd like to learn more about the project or support future development, see the [About](about.md) section.

move-vulnerability-database

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

move-vulnerability-database

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README