You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Movy** is a Move testing framework that offers deep testing abilities for Move smart contracts. This book serves as documents and tutorials for movy.
3
+

4
4
5
-
Please note that Movy is at __pre-alpha__ stage, which typically means it could contain bugs. However, rest assured that Movy **never** makes any real transactions to the live chain and thus your assets and private keys will always remain safe.
5
+
**Movy** is a Move testing framework that offers:
6
+
7
+
- Modular low-level building bricks for Move language. Specifically, the executor and tracer abstractions and layered database design borrowed from [revm](https://github.com/bluealloy/revm) that allow you to emulate and inspect an execution.
8
+
- Static analysis capabilities inherited from [MoveScan](https://dl.acm.org/doi/10.1145/3650212.3680391), the state-of-the-art static analyzer.
9
+
- Cutting-edge fuzzing reimplemented from scratch learned from [Belobog](https://github.com/abortfuzz/belobog) that supports both property testing and on-chain fuzzing, in the a flavor similar to [foundry](https://getfoundry.sh/forge/advanced-testing/overview) by writing invariants in Move language.
10
+
- And a lot of more...
11
+
12
+
This book serves as documents and tutorials for Movy.
13
+
14
+
> Please note that Movy is at __pre-alpha__ stage, which typically means it could contain bugs. However, rest assured that Movy **never** makes any real transactions to the live chain and thus your assets and private keys will always remain safe.
6
15
7
16
## Citation
8
17
9
18
Consider citing our works:
10
19
11
20
```bibtex
12
-
@misc{movy,
21
+
@misc{belobog,
13
22
title={Belobog: Move Language Fuzzing Framework For Real-World Smart Contracts},
14
23
author={Wanxu Xia and Ziqiao Kong and Zhengwei Li and Yi Lu and Pan Li and Liqun Yang and Yang Liu and Xiapu Luo and Shaohua Li},
15
24
year={2025},
@@ -20,20 +29,20 @@ Consider citing our works:
20
29
}
21
30
22
31
@inproceedings{movescan,
23
-
author = {Song, Shuwei and Chen, Jiachi and Chen, Ting and Luo, Xiapu and Li, Teng and Yang, Wenwu and Wang, Leqing and Zhang, Weijie and Luo, Feng and He, Zheyuan and Lu, Yi and Li, Pan},
24
-
title = {Empirical Study of Move Smart Contract Security: Introducing MoveScan for Enhanced Analysis},
25
-
year = {2024},
26
-
isbn = {9798400706127},
27
-
publisher = {Association for Computing Machinery},
28
-
address = {New York, NY, USA},
29
-
url = {https://doi.org/10.1145/3650212.3680391},
30
-
doi = {10.1145/3650212.3680391},
31
-
abstract = {Move, a programming language for smart contracts, stands out for its focus on security. However, the practical security efficacy of Move contracts remains an open question. This work conducts the first comprehensive empirical study on the security of Move contracts. Our initial step involves collaborating with a security company to manually audit 652 contracts from 92 Move projects. This process reveals eight types of defects, with half previously unreported. These defects present potential security risks, cause functional flaws, mislead users, or waste computational resources. To further evaluate the prevalence of these defects in real-world Move contracts, we present MoveScan, an automated analysis framework that translates bytecode into an intermediate representation (IR), extracts essential meta-information, and detects all eight defect types. By leveraging MoveScan, we uncover 97,028 defects across all 37,302 deployed contracts in the Aptos and Sui blockchains, indicating a high prevalence of defects. Experimental results demonstrate that the precision of MoveScan reaches 98.85\%, with an average project analysis time of merely 5.45 milliseconds. This surpasses previous state-of-the-art tools MoveLint, which exhibits an accuracy of 87.50\% with an average project analysis time of 71.72 milliseconds, and Move Prover, which has a recall rate of 6.02\% and requires manual intervention. Our research also yields new observations and insights that aid in developing more secure Move contracts.},
32
-
booktitle = {Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis},
33
-
pages = {1682–1694},
34
-
numpages = {13},
35
-
keywords = {Defect, Move language, Program analysis, Smart contract},
36
-
location = {Vienna, Austria},
37
-
series = {ISSTA 2024}
38
-
}
32
+
author = {Song, Shuwei and Chen, Jiachi and Chen, Ting and Luo, Xiapu and Li, Teng and Yang, Wenwu and Wang, Leqing and Zhang, Weijie and Luo, Feng and He, Zheyuan and Lu, Yi and Li, Pan},
33
+
title = {Empirical Study of Move Smart Contract Security: Introducing MoveScan for Enhanced Analysis},
34
+
year = {2024},
35
+
isbn = {9798400706127},
36
+
publisher = {Association for Computing Machinery},
37
+
address = {New York, NY, USA},
38
+
url = {https://doi.org/10.1145/3650212.3680391},
39
+
doi = {10.1145/3650212.3680391},
40
+
abstract = {Move, a programming language for smart contracts, stands out for its focus on security. However, the practical security efficacy of Move contracts remains an open question. This work conducts the first comprehensive empirical study on the security of Move contracts. Our initial step involves collaborating with a security company to manually audit 652 contracts from 92 Move projects. This process reveals eight types of defects, with half previously unreported. These defects present potential security risks, cause functional flaws, mislead users, or waste computational resources. To further evaluate the prevalence of these defects in real-world Move contracts, we present MoveScan, an automated analysis framework that translates bytecode into an intermediate representation (IR), extracts essential meta-information, and detects all eight defect types. By leveraging MoveScan, we uncover 97,028 defects across all 37,302 deployed contracts in the Aptos and Sui blockchains, indicating a high prevalence of defects. Experimental results demonstrate that the precision of MoveScan reaches 98.85\%, with an average project analysis time of merely 5.45 milliseconds. This surpasses previous state-of-the-art tools MoveLint, which exhibits an accuracy of 87.50\% with an average project analysis time of 71.72 milliseconds, and Move Prover, which has a recall rate of 6.02\% and requires manual intervention. Our research also yields new observations and insights that aid in developing more secure Move contracts.},
41
+
booktitle = {Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis},
42
+
pages = {1682–1694},
43
+
numpages = {13},
44
+
keywords = {Defect, Move language, Program analysis, Smart contract},
0 commit comments