Audit report published Dec 2025. Sui · Move.
| Severity | Count |
|---|---|
| High | 2 |
| Medium | 2 |
| Low | 5 |
| Informational | 3 |
| Total | 12 |
Safe Edges reviewed Clique's token distributor for Sui, written in Move, in November 2025. Twelve issues were identified: two High, two Medium, five Low and three Informational. The High issues concerned claim tracking keyed on the recipient rather than the handler, which can block valid claims, and handlers being able to send claimed tokens away from the recipient approved off-chain. The original report does not record a resolution status for any finding.
H-01 Claimed Tracking Uses Recipient Address resulting in Blocked ClaimsH-02 Handler Can Redirect Tokens Away From Offchain Approved RecipientM-01 Default Hook Collision with Strategies hook breaks Claim functionality temporarilyM-02 Unbounded Claimed Table GrowthL-01 Missing Input Validation in Fee Configuration Allows Invalid Fee ParametersL-02 Withdrawal Function Allows Token Extraction During Active DistributionL-03 Allowing removal of Active Merkle Root Configuration Blocks Valid ClaimsL-04 Fee Calculation Ignores Decimal Differences Between Airdrop and Fee TokensL-05 Missing Signature Expiration Enables Indefinite Signature ValidityI-01 Missing Wrapped Token handling as per DocsI-02 Typo in FeeMode Enum Variant NameI-03 Missing Access Control Enables Claim Denial of ServiceSend the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.