Belobog: New Fuzzing Tool Catches Move Smart Contract Bugs at Scale

Move, a resource-oriented language for secure smart contract development, powers billions of dollars in digital assets across blockchains like Sui. While its strong type system and explicit resource semantics prevent certain categories of bugs—like data races and invalid asset transfers—vulnerabilities can still slip through. Testing Move contracts has proven challenging for existing security tools because of the language's strict typing requirements.

A New Testing Framework#

Researchers have introduced Belobog, the first fuzzing framework built specifically for Move smart contracts. Unlike existing fuzzers that struggle with Move's stringent type constraints, Belobog generates and mutates test transactions that are guaranteed to be well-typed. The tool constructs a dependency graph based on Move's type system and uses it to guide both transaction generation and mutation. To handle the language's complex validation rules, the team also implemented a concolic executor—a hybrid approach that combines concrete and symbolic execution.

Real-World Results#

Testing on 109 production Move projects, Belobog detected 100% of critical vulnerabilities and 79% of major ones that had been identified through manual human audits. The framework also successfully reproduced full exploit chains from two high-profile incidents in the Move ecosystem—Cetus and Nemo—without any advance knowledge of the attacks. In three ongoing auditing engagements, Belobog uncovered seven new vulnerabilities (two critical, two major, three medium), all confirmed by project developers.

Why It Matters#

Move's growing role in securing blockchain assets makes specialized testing tools essential. Belobog bridges a critical gap by enabling developers and auditors to automatically discover flaws that existing security frameworks cannot reach, potentially preventing costly exploits before they happen.