Sui says an audit cannot carry the whole load

One Audit, One Moment

The @SuiNetwork Foundation is pushing back against the idea that a smart contract audit alone is sufficient protection. In a post published on September 17, the Foundation argued that an audit covers only one version of a codebase at one point in time, making continuous monitoring essential as code evolves and administrative permissions expand.

According to the Foundation's own blog post, past incidents on the Sui network illustrate the problem clearly. Applications with audited contracts have been affected by issues in shared code they depended on, and by weaknesses in administrative access rather than in contract logic. The lesson, as the Foundation frames it, is that security must account for dependencies and administrative authority, not just the logic written at launch.

The Foundation also pointed to a broader industry pattern. Individual teams cannot see the whole ecosystem. Someone, it argues, needs to map the connections between applications, identify where exposure is growing, and coordinate a response when shared infrastructure fails.

What Sui Is Building

To address this, the Foundation outlined a set of planned tools and infrastructure. The goal is to let teams verify that published source code matches what is actually running onchain, monitor changes in code and behaviour over time, and trace which applications depend on shared packages so that a vulnerability in one library can be assessed across the whole ecosystem. The tools are also intended to direct attention toward the contracts where value is most concentrated, on the basis that security resources should follow risk.

The Foundation has already taken steps in this direction. Following a series of DeFi incidents in summer 2025, it created a $10 million fund for ecosystem security, covering subsidised audits, formal verification, expanded bug bounties, and shared monitoring tooling. The new infrastructure push is described as the next phase of that effort.

Prevention, verification, ongoing analysis, and response should operate as parts of one security system, the Foundation wrote, adding that security should begin before an application launches, continue as it changes, and follow where value is most exposed. An audit, it concluded, still matters. It just cannot carry the whole load.

Sources:
Sui Foundation: Security Should Follow Value
Sui Security Overview