FVscan: On-Chain Scanner for Function Visibility Vulnerability in Move Smart Contracts

Abstract

Function visibility vulnerability is one of the most important issues in blockchain and smart contract security as it allows attackers to easily gain access to huge amounts of digital assets. Move is a security-focused smart contract programming language adopted by blockchain projects with large market capitalization like Aptos and Sui. To reduce the possibility of developers incorrectly defining privileged functions to be accessed by anyone, Move makes function visibility private by default. However, Move's prevention of function visibility vulnerability has limitations and its complex function visibility definition specification increases the security risk. This paper analyzes the function visibility vulnerability in Move from the perspective of principle and real-world example, showing that function visibility vulnerability still exists in Move. To address this issue, we propose FVscan, a tool designed to detect incorrect function visibility definitions in on-chain Move smart contracts. We conducted a 24-hour experiment using FVscan on the Aptos and Sui mainnet and found a total of 1,850 functions with incorrect visibility definitions. Evaluation results show that FV scan is effective in detecting function visibility definition.