Out of Scope

Blackshear et al. prove resource safety for an executable Move bytecode model using linear resource types. The result constrains creation, copying, destruction, and movement of resources under the language rules. It does not prove arbitrary contract logic, protocol integration, oracle design, economic safety, or the security of deployed Sui applications.

The Move Prover verifies code against written specifications through a translation to Boogie and SMT solving. That is a genuine formal-methods contribution. Its guarantee remains conditional on the property expressed, the adequacy of the specification, and the supported model. That guarantee supplies no automatic certificate that the specification captured every economically important behavior.

Narwhal and Tusk separate transaction dissemination from ordering and report controlled WAN experiments. Mysticeti develops uncertified DAG consensus and a fast commit path, with proofs and experiments under stated assumptions. Those results support protocol claims within their models and experimental environments. They do not, without further evidence, establish arbitrary-application throughput, operator independence, incident governance, adoption, or market value.

The papers deserve credit precisely because their claims are bounded. Respecting that boundary is part of reading the scholarship correctly.

Sui Foundation’s April 2023 performance update describes the original 120,000 TPS figure as a single-validator, batched peak demonstration on an 8-core M1 MacBook Pro. It also reports a later 100-validator experiment using 24-core AMD machines, 256 GB of memory, 25 Gbps network interfaces, a dedicated load generator, and homogeneous payment operations inside Programmable Transaction Blocks.

The later experiment reported different results for different PTB sizes. Sui counted the individual operations inside each PTB as transactions. That convention can serve an internal capacity study, but it is not interchangeable with every dashboard’s count of externally submitted transactions, blocks, or user demand.

The former essay divided the controlled benchmark by point-in-time public-chain telemetry and compared the quotient with other networks. Those ratios are removed. Their numerator and denominator differed in unit, workload, batching, topology, hardware, offered load, time, and collection method. Division concealed those differences behind a single quotient.

A supported comparison would pre-register an operation unit, workload and contention mix, PTB composition, validator hardware and topology, software commit, protocol version, offered load, duration, repetitions, finality rule, failure distribution, and accounting method. This audit did not run that study, so the throughput question stays where the sources left it.

The July 15 Sui source pin records that disable_preconsensus_locking sends all transactions through consensus and moves owned-object conflict detection after consensus. Repository history records that flag enabled at protocol version 105 and, in a later cleanup, describes the retired branch as “QD/original fastpath mode” and the enabled branch as “MFP mode.”

At the preserved July Mainnet observation, the endpoint reported protocol version 128 with both:

The old draft treated the first flag as a refutation of Sui’s fast-path account. Coexistence of the two flags defeats that inference. Migration away from pre-consensus owned-object locking left Mysticeti FastPath in place, and “fast path” names different mechanisms across that history.

The live capture closes one former gap: the official endpoint reported the source-defined flag in Mainnet protocol configuration. It does not close source-to-runtime identity. The packet does not prove which binary each validator ran or that every deployed binary was built from the July checkout.

The Cetus record holds two phases that the former discussion collapsed into one.

First, the incident-era repository contained a node-local TransactionDenyConfig. The code checked that address list when a validator considered signing a transaction. This establishes a censorship capability for validators that adopted a configuration. It does not establish the actual incident list, who authored or transmitted it, which validators loaded it, when they did so, or what historical stake threshold adopted it. The former attribution of a Foundation-distributed blacklist is withdrawn.

Second, recovery used a separate public process. The Sui Foundation published a validator-voting package whose repository source implements the deduction of Foundation-delegated stake before result calculation. Separately, the observed deployed package emitted the preserved finalization event: the recovered Mainnet governance object reports Passed, with 99 yes, 2 no, and 2 abstain votes. Replaying its historical stake maps yields 90.8776488815211 percent yes of eligible stake. A reproducible Move build and normalized package-byte comparison are still required before attributing the source semantics to that deployment.

Sui then implemented narrowly bounded aliases in the recovery-alias source: a designated signer could act for each attacker address only for a specified transaction digest, while those transactions bypassed the address denial. Sui later removed that temporary protocol-config feature, leaving the alias path a bounded episode in repository history.

This record supports a mixed institutional description. Emergency signing discretion existed at the validator-configuration layer; the later asset-moving recovery rested on an on-chain, stake-weighted authorization and a transaction-specific code path. Exact incident dollar figures are omitted because this audit did not preserve a checkpoint-pinned asset inventory and valuation rule.

The July system-state response contained 127 active validator addresses. At the address level, the largest stake share was about 3.05 percent and the top ten held about 20.33 percent.

Those observations describe one epoch. They do not identify beneficial ownership, common operational control, Foundation delegation by validator, shared hosting or key-management dependencies, jurisdiction, or informal coordination. A validator address is not automatically an independent operator, and a count is not a decentralization measure.

The old delegation argument is therefore withdrawn. No evidence in the packet shows that academic reputation affected a delegator’s decision.

The audit withdraws the proposition that Sui’s publication record caused favorable venture terms, exchange treatment, ecosystem allocations, validator delegation, adoption, or valuation. It also withdraws the fee, valuation, TVL, subsidy, and “unsubsidized activity” claims previously used to animate that proposition. The underlying vendor exports, definitions, transformations, and synchronized observation windows were not preserved.

No decision files, interviews, comparative cohort, treatment definition, counterfactual, or estimator connect the credential to those outcomes. Quality selection, ordinary team reputation, technical execution, market timing, liquidity, incentives, and many other explanations remain open. Calling one account more parsimonious did not test them.

The label “credibility transfer” may still name a research question. It is not a result of this case.

This reconstruction preserves a bounded source note. A renewed causal paper would require four closures:

Beyond those closures, a renewed causal paper would still require a comparative design and direct decision evidence. The supported contribution here is methodological: when the claim changes domain, the evidentiary burden starts again.

The result covers one protocol family, read at pinned source checkouts and a single Mainnet observation. Source claims rest on the full MystenLabs/sui checkout at the July 15 pin, with the April checkout retained alongside it. Configuration claims come from checksummed Mainnet RPC responses captured at the July observation, which reported protocol version 128. Governance claims draw on the sui-foundation/recovery-vote pin, the deployed package’s finalization event, and the replayed historical stake maps. Claims about the scholarship reach no further than what Blackshear et al., the Move Prover, Narwhal and Tusk, and Mysticeti state under their own models and experimental conditions.

The six claim domains named in the lede stay separate throughout. Endpoint capture identifies configuration and not the binary any validator executed. Source pinning identifies capability and not use. Attribution of the recovery-vote source semantics to the deployed package waits on a reproducible Move build and a normalized package-byte comparison.

Three restrictions bound the claim domain further. Validator observations describe one epoch and address-level stake, leaving beneficial ownership, operational control, delegation by validator, hosting and key-management dependency, jurisdiction, and informal coordination unobserved. The benchmark reading describes what the reported experiments measured and supplies no comparable performance design or preserved raw data. On the Cetus record, the audit describes a validator-configuration capability and a later on-chain authorization without an incident-era custody record for configurations, communications, historical stake, assets, or valuation. Financing, listings, grants, ecosystem allocations, delegation, adoption, and valuation lie outside the result entirely.

The affirmative claim is narrow: on the preserved record, each artifact answers only the question its own domain poses, and nothing in the packet carries a proof, a benchmark, a source capability, a reported state, or a governance act across a boundary into the next domain. Five observations would defeat that claim, each at a named point in the argument.

Each condition names a record that could be produced: a decision file, a pre-registered run, a build attestation, a package comparison, or an operator map. None appears in the preserved packet. Items three and four would be resolved against the packet’s own artifacts; the remaining three require records produced outside it. Where a condition bears on a withdrawal, it would show that withdrawal to be premature rather than wrong, and where it bears on a separation or a refusal stated in the argument, it would defeat that statement directly.