ref-lifecycle

Skill: Reference Lifecycle Analysis

Type: Thought-template (instantiate before use) Trigger Pattern: Always (Aptos Move) -- ConstructorRef/TransferRef/MintRef/BurnRef lifecycle Inject Into: Breadth agents, depth-state-trace, depth-token-flow Research basis: Aptos Object model capability-based access control, permanent reference semantics

Background

In Aptos Move, object capabilities (Refs) are unforgeable tokens that grant specific permissions over objects. Unlike role-based access control in EVM, Refs are permanent once created -- they CANNOT be revoked. A leaked or improperly stored Ref grants permanent capability to its holder.

Key Ref types:

• ConstructorRef: Created once during object::create_*. Parent of all other Refs. Grants ability to generate TransferRef, MintRef, BurnRef, DeleteRef, and ExtendRef.
• TransferRef: Grants ability to transfer an object even when its TransferRef is frozen. Bypasses ungated_transfer restrictions.
• MintRef: Grants ability to mint FungibleAsset. Unlimited minting if held.
• BurnRef: Grants ability to burn FungibleAsset from any FungibleStore.
• DeleteRef: Grants ability to delete an object.
• ExtendRef: Grants ability to generate a signer for the object, enabling further resource manipulation.

Trigger Patterns

ConstructorRef|TransferRef|MintRef|BurnRef|DeleteRef|ExtendRef|
object::create_named_object|object::create_sticky_object|object::create_object|
fungible_asset::generate_mint_ref|fungible_asset::generate_burn_ref|
fungible_asset::generate_transfer_ref|object::generate_delete_ref|
object::generate_extend_ref|object::generate_transfer_ref

Reasoning Template

Step 1: Reference Inventory

Enumerate ALL Ref types found in the codebase. For each:

Ref Type	Created In (module::function)	Stored Location	Access Control	Capability Granted
ConstructorRef	{module}::{init_fn}	{consumed / stored in resource}	{who can access}	Generate all other Refs
MintRef	{module}::{init_fn}	{global resource at @addr}	{who can access}	Unlimited minting of {asset}
BurnRef	{module}::{init_fn}	{global resource at @addr}	{who can access}	Burn {asset} from any store
TransferRef	{module}::{init_fn}	{global resource at @addr}	{who can access}	Transfer {asset} bypassing freeze
DeleteRef	{module}::{init_fn}	{global resource at @addr}	{who can access}	Delete {object}
ExtendRef	{module}::{init_fn}	{global resource at @addr}	{who can access}	Generate signer for {object}