zero-state-return

Detect return-to-zero vulnerabilities in Sui Move shared objects.

276|56|Updated Mar 16, 2026

Search Tags:#vulnerability #move #security-audit #sui #re-entry #return-to-zero #shared-objects

Ready to run

npx skills add https://github.com/PlamenTSV/plamen --skill zero-state-return

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: zero-state-return
Source: https://github.com/PlamenTSV/plamen/tree/main/agents/skills/sui/zero-state-return
Command: npx skills add https://github.com/PlamenTSV/plamen --skill zero-state-return

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies and analyzes return-to-zero state vulnerabilities in Sui shared objects, extending ZERO_STATE_ECONOMICS to cover residual states and re-entry risks after full exits.

Core Features & Use Cases

Extend ZERO_STATE_ECONOMICS to detect zero-state re-entry vulnerabilities in Sui shared objects.
Assess residual assets, including rewards, fees, and dust, that persist after total_supply hits zero.
Evaluate re-entry scenarios and potential for first-depositor attacks on re-initialized pools.

Quick Start

Run the zero-state-return scan against your Sui Move vault objects to identify lingering state and potential re-entry paths

Frequently Asked Questions about zero-state-return

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is a return-to-zero vulnerability in Sui Move shared objects?▼

A return-to-zero vulnerability in Sui Move shared objects occurs when residual assets like rewards or fees persist after total_supply hits zero, allowing attackers to re-enter and exploit the re-initialized pool state.

How do I audit Sui Move vaults for residual assets and re-entry risks?▼

You audit Sui Move vaults for re-entry risks by running a structured analysis workflow that evaluates zero-state transitions, checks for residual rewards or dust after full exits, and assesses first-depositor attack scenarios.

Can I detect first-depositor attacks on re-initialized Sui pools?▼

Yes, you can detect first-depositor attacks by evaluating re-entry scenarios and potential exploitation paths on re-initialized pools, specifically analyzing protocol state transitions and admin reset implications in Sui Move.

Does this zero-state security audit apply to Sui pools with admin reset functions?▼

Yes, this zero-state security audit explicitly applies to Sui pools with admin reset functions by analyzing admin reset implications and evaluating whether they introduce re-entry vulnerabilities across protocol state transitions.

What are the limitations of analyzing zero-state economics in Sui Move?▼

The analysis is limited to Sui Move-based vaults and pools, focusing strictly on zero-state transitions, residual asset checks, and re-entry vulnerability assessment, without covering non-Move smart contract architectures.