object-ownership

OBJECT_OWNERSHIP Skill

Trigger Pattern: Always required for Sui Move audits -- object lifecycle and ownership model Inject Into: Breadth agents, depth-state-trace, depth-token-flow Finding prefix: [OO-N] Rules referenced: R4, R5, R9, R10, R13

Sui's object-centric model is fundamentally different from account-based chains. Every struct with the key ability is an on-chain object with a globally unique ID, and its ownership model (owned/shared/frozen/wrapped) determines who can access and mutate it. Incorrect ownership choices, missing transfer restrictions, orphaned UIDs, and uncontrolled dynamic fields are the primary Sui-specific vulnerability classes.

---

1. Object Inventory

For EVERY struct with key ability in the codebase, build this table:

#	Object Name (Module)	Abilities	Ownership Model	Created Where	Transferred Where	Destroyed Where	Has store?
1	{name} ({module})	{key, store, ...}	OWNED / SHARED / FROZEN / WRAPPED / MIXED	{function:line}	{function:line or NEVER}	{function:line or NEVER}	YES/NO

Ability rules:

• key alone: Object can exist on-chain but CANNOT be transferred by generic transfer::public_transfer (requires module-defined transfer logic).
• key + store: Object CAN be transferred by anyone via transfer::public_transfer. This is a permissive choice -- verify it is intentional.
• key + store + copy: Object can be duplicated -- extremely rare for value-bearing objects. FLAG if found on any object holding balances.
• key + store + drop: Object can be silently discarded without calling a destructor. FLAG if the object holds Balance<T> or other value -- tokens can be lost.

Ownership model classification:

• OWNED: Created and transferred to a specific address via transfer::transfer or transfer::public_transfer. Only the owner can pass it as a transaction argument.
• SHARED: Made accessible to all via transfer::public_share_object. Any transaction can read/write it. CRITICAL access control implications.
• FROZEN: Made immutable via transfer::public_freeze_object. Anyone can read, no one can mutate.
• WRAPPED: Stored as a field inside another object (not directly addressable on-chain). Accessible only through the parent.
• MIXED: Object starts as one type and transitions to another (e.g., created as owned, then shared). Document the transition path.