We’ve just released a new research work from MoveBit
Belobog: A Real-World Attack-Oriented Fuzzing Framework for Move
📄 Read Paper (arXiv preprint): arxiv.org/abs/2512.02918
🌪️ Move is often seen as “safer by design.” But in real audits, the most serious issues rarely come from syntax or type errors
— they emerge from system-level behavior: cross-module interactions, privilege assumptions, state-machine edges, and composable call sequences.
Fuzzing Move is hard because inputs must be type-correct and semantically reachable. If transactions can’t execute, deep states — and real exploit paths — are never reached.
Belobog treats Move’s type system as guidance, not a barrier:
💍 type-guided transaction generation
💍 concolic execution to break through heavy constraints
💍 evaluated on 109 real-world Move projects, detecting 100% of Critical and 79% of Major vulnerabilities confirmed by experts, and reproducing full exploits from real incidents
👉 Paper (arXiv preprint): arxiv.org/abs/2512.02918
(Submitted to PLDI’26 — we’ll share updates after peer review.)
