Defense-in-Depth Runtime Safety in Move
For blockchain developers and users, this work adds a safety layer to prevent asset loss and state corruption due to verifier bugs.
The paper describes runtime safety checks in the Move smart-contract language on the Aptos blockchain to protect against bugs in the static verifier and malicious bytecode, providing defense-in-depth safety.
Move is a smart-contract language used to execute transactions on the Aptos blockchain. Move programs execute in a sandboxed VM as typed bytecode. The VM statically verifies foundational safety properties like type safety and reference safety at code loading time. In principle, this design gives strong guarantees for Move. However, the static verification logic is complex and continually evolving with the language; like any software, it is not immune to bugs. In a live blockchain setting, a missed rule violation can translate directly into loss of assets, forged authority, or unrecoverable corruption of on-chain state. For this reason, Aptos relies on defense-in-depth runtime safety checks that independently verify the critical invariants during execution, providing protection against latent verifier bugs and malicious bytecode. This paper motivates and describes the runtime safety checks for Move on Aptos.