AI is here to stay


authentic news


Great news


informative piece


Alleged Kenyan cult leader and suspects to face charges, prosecutor says

https://media.cnn.com/api/v1/images/stellar/prod/230602182428-screengrab-kenya-starvation-doomsday-cult-paul-mackenzie.jpg?c=16x9&q=h_653,w_1160,c_fill/f_webp


Pope Francis addresses pushback from African bishops on same-sex blessing

https://media.cnn.com/api/v1/images/stellar/prod/230201110603-03-pope-francis-africa-tour-013123-kinshasa.jpg?c=16x9&q=h_653,w_1160,c_fill/f_webp


Liberia’s President George Weah concedes victory after tight run-off election

https://media.cnn.com/api/v1/images/stellar/prod/171226143132-01-george-weah-joseph-boakai-split.jpg?q=x_0,y_0,h_1688,w_2999,c_fill/h_653,w_1160/f_webp


A history of African artists at the Grammys


Sierra Leone is losing its forests. This sanctuary is trying to save chimpanzees and their vital habitat


Huge gas explosion and fire kills at least 3, injures hundreds in Kenyan capital

https://media.cnn.com/api/v1/images/stellar/prod/240202122250-nairobi-explosion-screengrab-vpx.jpg?c=16x9&q=w_850,c_fill

https://media.cnn.com/api/v1/images/stellar/prod/gettyimages-1971232336.jpg?q=w_1110,c_fill/f_webp

https://media.cnn.com/api/v1/images/stellar/prod/gettyimages-1971231887.jpg?q=w_1110,c_fill/f_webp

https://media.cnn.com/api/v1/images/stellar/prod/img-1335.JPG?q=w_1110,c_fill/f_webp


Bishop TD Jakes and Sarah Jake Roberts: The father-daughter duo changing lives together


Period poverty: How air pollution in Kenya could make periods heavier, more painful and more expensive

https://cdn.cnn.com/cnnnext/dam/assets/231204171233-06-as-equals-period-air-pollution-120423-super-169.jpg


Away from threat of Islamist violence or floods, health risks for pregnant women in Nigeria's refugee camps remain high

https://cdn.cnn.com/cnnnext/dam/assets/231124134520-02-maternal-health-nigeria-super-169.jpg

https://cdn.cnn.com/cnnnext/dam/assets/231124134522-03-maternal-health-nigeria-super-169.jpg

https://cdn.cnn.com/cnnnext/dam/assets/231124134523-04-maternal-health-nigeria-super-169.jpg


US strikes Iran-backed groups as Israel-Hamas war rages

https://dynaimage.cdn.cnn.com/cnn/digital-images/org/548229cc-aaf6-40a3-a200-908bccdc1d42.jpg


A draft to delete


## 1 INTRODUCTION

Sui is a decentralized permissionless smart contract platform biased
towards low-latency management of assets. It uses the Move programming language to define assets as objects that may be owned
by an address. Move programs define operations on these typed
objects including custom rules for their creation, the transfer of
these assets to new owners, and operations that mutate assets.

Sui is maintained by a permissionless set of authorities that play
a role similar to validators or miners in other blockchain systems. It
uses a Byzantine consistent broadcast protocol between authorities
to ensure the safety of common operations on assets, ensuring lower
latency and better scalability as compared to Byzantine agreement.
It only relies on Byzantine agreement for the safety of shared objects.
As well as governance operations and check-pointing, performed
off the critical latency path. Execution of smart contracts is also
naturally parallelized when possible. Sui supports light clients that
can authenticate reads as well as full clients that may audit all
transitions for integrity. These facilities allow for trust-minimized
bridges to other blockchains.

A native asset SUI is used to pay for gas for all operations. It is
also used by its owners to delegate stake to authorities to operate
Sui within epochs, and periodically, authorities are reconfigured
according to the stake delegated to them. Used gas is distributed to
authorities and their delegates according to their stake and their
contribution to the operation of Sui.

This whitepaper is organized in two parts, with Sect. 2 describing
the Sui programming model using the Move language, and Sect. 4
describing the operations of the permissionless decentralized system that ensures safety, liveness and performance for Sui.

## 2 SUI SMART CONTRACT PROGRAMMING

Sui smart contracts are written in the Move language. Move
is safe and expressive, and its type system and data model naturally support the parallel agreement/execution strategies that make
Sui scalable. Move is an open-source programming language for
building smart contracts originally developed at Facebook for the
Diem blockchain. The language is platform-agnostic, and in addition to being adopted by Sui, it has been gaining popularity on
other platforms (e.g., 0L, StarCoin).

In this section we will discuss the main features of the Move language and explain how it is used to create and manage assets on Sui. A more thorough explanation of Move’s features can be found in the Move Programming Language book and more Sui-specific Move content can be found in the Sui Developer Portal, and a more formal description of Move in the context of Sui can be found in Section 3.

**2.1 Overview**

Sui’s global state includes a pool of programmable objects created
and managed by Move packages that are collections of Move modules (see Section 2.1.1 for details) containing Move functions and types. Move packages themselves are also objects. Thus, Sui objects can be partitioned into two categories:

***• Struct data values:*** Typed data governed by Move modules. Each object is a struct value with fields that can contain primitive types (e.g. integers, addresses), other objects, and non-object structs.

***• Package code values:*** a set of related Move bytecode modules published as an atomic unit. Each module in a package can depend both on other modules in that package and on modules in previously published packages. Objects can encode assets (e.g., fungible or non-fungible tokens), capabilities granting the permission to call certain functions or create other objects, “smart contracts” that manage other assets, and so on–it’s up to the programmer to decide. The Move code to
declare a custom Sui object type looks like this:

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704532414693-YAKIHONNES3.png)

All structs representing Sui objects (but not all Move struct
values) must have the `$$id$$` field and the `$$key$$` ability indicating that the value can be stored in Sui’s global object pool.

*2.1.1 Modules.* A Move program is organized as a set of modules, each consisting of a list of struct declarations and function declarations. A module can import struct types from other modules and invoke functions declared by other modules.

Values declared in one Move module can flow into another– e.g., module OtherObj in the example above could be defined in a different module than the module defining `Obj`. This is different from most smart contract languages, which allow only unstructured bytes to flow across contract boundaries. However, Move is able to support this because it provides encapsulation features to help programmers write robustly safe code. Specifically, Move’s type system ensures that a type like Obj above can only be created, destroyed, copied, read, and written by functions inside the module that declares the type. This allows a module to enforce strong invariants on its declared types that continue to hold even when
they flow across smart contract trust boundaries.

*2.1.2 Transactions and Entrypoints.* The global object pool is updated via transactions that can create, destroy, read, and write objects. A transaction must take each existing object it wishes to operate on as an input. In addition, a transaction must include the versioned ID of a package object, the name of a module and function inside that package, and arguments to the function (including input objects). For example, to call the function

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704533275306-YAKIHONNES3.png)

a transaction must supply ID’s for three distinct objects whose type is `Obj` and an integer to bind to `x`. The `TxContext` is a special parameter filled in by the runtime that contains the sender address and information required to create new objects.

Inputs to an entrypoint (and more generally, to any Move function) can be passed with different mutability permissions encoded in the type. An Obj input can be read, written, transferred, or destroyed. A `$$&mut$$` `Obj `input can only be read or written, and a `&Obj`
can only be read. The transaction sender must be authorized to use
each of the input objects with the specified mutability permissions–
see Section 4.4 for more detail.

*2.1.3 Creating and Transferring Objects.* Programmers can create
objects by using the TxContext passed into the entrypoint to generate a fresh ID for the object:

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704533674610-YAKIHONNES3.png)

This code takes two objects of type OtherObj and Obj as input, uses the first one and the generated ID to create a new Obj, and then transfers both Obj objects to the transaction sender. Once an object has been transferred, it flows into the global object pool and cannot be accessed by code in the remainder of the transaction. The Transfer module is part of the Sui standard library, which includes functions for transferring objects to user addresses and to other objects.

We note that if the programmer code neglected to include one of the transfer calls, this code would be rejected by the Move type system. Move enforces resource safety protections to ensure that objects cannot be created without permission, copied, or accidentally destroyed. Another example of resource safety would be an attempt to transfer the same object twice, which would also be rejected by the Move type system.

## 3 THE SUI PROGRAMMING MODEL

In this section, we expand on the informal description of the Sui programming model from Section 2 by presenting detailed semantic definitions. The previous section showed examples of Move source code; here we define the structure of Move bytecode. Developers write, test, and formally verify [10, 16] Move source code locally, then compile it to Move bytecode before publishing it to the blockchain. Any Move bytecode be published on-chain must pass through a bytecode verifier[4, 5] to ensure that it satisfies key properties such as type, memory, and resource safety. As mentioned in Section 2, Move is a platform-agnostic language which can be adapted to fit specific needs of different systems without forking the core language. In the following description, we define both concepts from core Move language (denoted in black text) and Sui-specific features extending the core Move language (denoted with orange text).

**3.1 Modules**

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704534077100-YAKIHONNES3.png)

Move code is organized into *modules* whose structure is defined in Table 1. A module consists of a collection of named *struct* declarations and a collection of named *function* declarations (examples of these declaration are provided in Section 2.1). A module also contains a special function declaration serving as the module *initializer*. This function is invoked exactly once at the time the module is published on-chain.

A struct declaration is a collection of named fields, where a field name is mapped to a storeable type. Its declaration also includes an optional list of abilities (see Section 2 for a description of storeable types and abilities). A struct declaration may also include a list of *generic parameters* with ability constraints, in which case we call it a *generic struct* declaration, for example `struct Wrapper<T: copy >{ t: T }`. A generic parameter represents a type to be used when declaring struct fields – it is unknown at the time of struct declaration, with a concrete type provided when the struct is instantiated (i.e., as struct value is created).

A function declaration includes a list of parameter types, a list of
return types, and a list of instructions forming the function’s body.
A function declaration may also include a list of generic parameters
with ability constraints, in which case we call it a generic function
declaration, for example `fun unwrap<T: copy>(p: Wrapper<T>){}`.
Similarly to struct declarations, a generic parameter represents
a type unknown at function declaration time, but which is nevertheless used when declaring function parameters, return values and a function body (concrete type is provided when a function is called).

Instructions that can appear in a function body include all ordinary Move instructions with the exception of global storage instructions (e.g., `
move_to, move_from, borrow_global `). See for a complete list of core Move’s instructions and their semantics. In Sui persistent storage is supported via Sui’s global object pool rather than the account-based global storage of core Move.

There are four Sui-specific object operations. Each of these operations changes the ownership metadata of the object (see Section 3.3) and returns it to the global object pool. Most simply, a Sui object can be transferred to the address of a Sui end-user. An object can also be transferred to another parent object–this operation requires the caller to supply a mutable reference to the parent object in addition to the child object. An object can be mutably shared so it can be read/written by anyone in the Sui system. Finally, an object can be immutably shared so it can be read by anyone in the Sui system, but not written by anyone.

The ability to distinguish between different kinds of ownership is a unique feature of Sui. In other blockchain platforms we are aware of, every contract and object is mutably shared. As we will explain in Section 4, Sui leverages this information for parallel transaction execution (for all transactions) and parallel agreement (for transactions involving objects without shared mutability).

**3.2 Types and Abilities**

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704535240784-YAKIHONNES3.png)

A Move program manipulates both data stored in Sui global object
pool and transient data created when the Move program executes. Both objects and transient data are Move values at the language level. However, not all values are created equal – they may have different properties and different structure as prescribed by their types.

The types used in Move are defined in Table 2. Move supports many of the same primitive types supported in other programming languages, such as a boolean type or unsigned integer types of various sizes. In addition, core Move has an `$$address $$`type representing an end-user in the system that is also used to identify the sender of a transaction and (in Sui) the owner of an object. Finally, Sui defines an `$$id$$` type representing an identity of a Sui object– see Section 3.3 for details.

A struct type describes an instance (i.e., a value) of a struct declared in a given module (see Section 3.1 for information on struct
declarations). A struct type representing a generic struct declaration (i.e., generic struct type) includes a list of storeable types – this
list is the counterpart of the generic parameter list in the struct declaration. A storeable type can be either a concrete type (a primitive
or a struct) or a generic type. We call such types storeable because
they can appear as fields of structs and in objects stored persistently
on-chain, whereas reference types cannot.

For example, the Wrapper`<u64>` struct type is a generic struct type parameterized with a concrete (primitive) storeable type `u64` – this kind of type can be used to create a struct instance (i.e.,value). On the other hand, the same generic struct type can be parameterized with a generic type (e.g., `struct Parent<T> { w: Wrapper<T> }`) coming from a generic parameter of the enclosing struct or function declaration – this kind of type can be used to declare struct fields, function params, etc. Structurally, a generic type is an integer index (defined as N in Table 5) into the list of generic parameters in the enclosing struct or function declaration.
*A vector type* in Move describes a variable length collection of homogenous values. A Move vector can only contain storeable types, and it is also a storeable type itself.

A Move program can operate directly on values or access them indirectly via references. A *reference type* includes both the storeable type referenced and a *mutability qualifier* used to determine (and enforce) whether a value of a given type can be read and written (`mut`) or only read (`immut`). Consequently, the most general form of a Move value type (Type in Table 2) can be either a storeable type or a reference type.

Finally, *abilities* in Move control what actions are permissible
for values of a given type, such as whether a value of a given type
can be copied (duplicated). Abilities constraint struct declarations
and generic type parameters. The Move bytecode verifier is responsible for ensuring that sensitive operations like copies can only be
performed on types with the corresponding ability

**3.3 Objects and Ownership**
![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704535950148-YAKIHONNES3.png)

Each Sui object has a globally unique identifier (ObjID in Table 3) that serves as the persistent identity of the object as it flows between owners and into and out of other objects. This ID is assigned to the object by the transaction that creates it. An object ID is created by applying a collision-resistant hash function to the contents of the current transaction and to a counter recording how many objects the transaction has created. A transaction (and thus its digest) is guaranteed to be unique due to constraints on the input objects of the transaction, as we will explain subsequently.

In addition to an ID, each object carries metadata about its ownership. An object is either uniquely owned by an address or another object, shared with write/read permissions, or shared with only read permissions. The ownership of an object determines whether and how a transaction can use it as an input. Broadly, a uniquely owned object can only be used in a transaction initiated by its owner or including its parent object as an input, whereas a shared object can be used by any transaction, but only with the specified mutability permissions. See Section 4.4 for a full explanation.

There are two types of objects: package code objects, and struct data objects. A package object contains of a list of modules. A struct object contains a Move struct value and the Move type of that value.

The contents of an object may change, but its ID, object type (package vs struct) and Move struct type are immutable. This ensures that objects are strongly typed and have a persistent identity.

Finally, an object contains a version. Freshly created objects have version 0, and an object’s version is incremented each time a transaction takes the object as an input.

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704536309878-YAKIHONNES3.png)

An address is the persistent identity of a Sui end-user (although note that a single user can have an arbitrary number of addresses). To transfer an object to another user, the sender must know the address of the recipient.

As we will discuss shortly, a Sui transaction must contain the address of the user sending (i.e., initiating) the transaction and an authenticator whose digest matches the address. The separation between addresses and authenticators enables cryptographic agility. An authenticator can be a public key from any signature scheme, even if the schemes use different key lengths (e.g., to support postquantum signatures). In addition, an authenticator need not be a single public key–it could also be (e.g.) a K-of-N multisig key.

**3.5 Transactions**

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704536536654-YAKIHONNES3.png)

Sui has two different transaction types: publishing a new Move package, and calling a previously published Move package. A publish transaction contains a package–a set of modules that will be published together as a single object, as well as the dependencies of all the modules in this package (encoded as a list of object references that must refer to already-published package objects). To execute a publish transaction, the Sui runtime will run the Move bytecode verifier on each package, link the package against its dependencies, and run the module initializer of each module. Module initializers are useful for bootstrapping the initial state of an application implemented by the package.

A call transaction’s most important arguments are object inputs. Object arguments are either specified via an object reference (for single-owner and shared immutable objects) or an object ID (for shared mutable objects). An object reference consists of an object

ID, an object version, and the hash of the object value. The Sui runtime will resolve both object ID’s and object references to object values stored in the global object pool. For object references, the runtime will check the version of the reference against the version of the object in the pool, as well as checking that the reference’s hash matches the pool object. This ensures that the runtime’s view of the object matches the transaction sender’s view of the object.

In addition, a call transaction accepts type arguments and pure value arguments. Type arguments instantiate generic type parameters of the entrypoint function to be invoked (e.g., if the entrypoint function is `send_coin<T>(c: Coin<T>, ...`), the generic type parameter `T` could be instantiated with the type argument SUI to send the Sui native token). Pure values can include primitive types and vectors of primitive types, but not struct types.

The function to be invoked by the call is specified via an object reference (which must refer to a package object), a name of a module in that package, and a name of a function in that package. To execute a call transaction, the Sui runtime will resolve the function, bind the type, object, and value arguments to the function parameters, and use the Move VM to execute the function.

Both call and publish transactions are subject to gas metering and gas fees. The metering limit is expressed by a maximum gas budget. The runtime will execute the transaction until the budget is reached, and will abort with no effects (other than deducting fees and reporting the abort code) if the budget is exhausted.

The fees are deducted from a gas object specified as an object reference. This object must be a Sui native token (i.e., its type must be Coin<SUI>). Sui uses EIP1559-style fees: the protocol defines a base fee (denominated in gas units per Sui token) that is algorithmically adjusted at epoch boundaries, and the transaction sender can also include an optional tip (denominated in Sui tokens). Under normal system load, transactions will be processed promptly even with no tip. However, if the system is congested, transactions with a larger tip will be prioritized. The total fee deduced from the gas object is (GasUsed ∗ BaseFee) + Tip.

**3.6 Transaction Effects**

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704537519713-YAKIHONNES3.png)

Transaction execution generates transaction effects which are different in the case when execution of a transaction is successful (SuccessEffects in Table 6) and when it is not (`AbortEffects` in Table 6).

Upon successful transaction execution, transaction effects include information about changes made to Sui’s global object pool (including both updates to existing objects and freshly created objects) and events generated during transaction execution. Another effect of successful transaction execution could be object removal (i.e., deletion) from the global pool and also wrapping (i.e., embedding) one object into another, which has a similar effect to removal – a wrapped object disappears from the global pool and exists only as a part of the object that wraps it. Since deleted and wrapped objects are no longer accessible in the global pool, these effects are represented by the ID and version of the object.

Events encode side effects of successful transaction execution beyond updates to the global object pool. Structurally, an event consists of a Move struct and its type. Events are intended to be consumed by actors outside the blockchain, but cannot be read by Move programs.

Transactions in Move have an all-or-nothing semantics – if execution of a transaction aborts at some point (e.g., due to an unexpected failure), even if some changes to objects had happened (or some events had been generated) prior to this point, none of these effects persist in an aborted transaction. Instead, an aborted transaction effect includes a numeric abort code and the name of a module where the transaction abort occurred. Gas fees are still charged for aborted transactions.

## 4 THE SUI SYSTEM

In this section we describe Sui from a systems’ perspective, including the mechanisms to ensure safety and liveness across authorities despite Byzantine failures. We also explain the operation of clients, including light clients that need some assurance about the system state without validating its full state.

**Brief background.** At a systems level Sui is an evolution of the FastPay low-latency settlement system, extended to operate on arbitrary objects through user-defined smart contracts, and with a permissionless delegated proof of stake committee composition. Basic asset management by object owners is based on a variant of Byzantine consistent broadcast that has lower latency and is easier to scale across many machines as compared to traditional implementations of Byzantine consensus. When full agreement is required we use a high-throughput DAG-based consensus, e.g. [9] to manage locks, while execution on different shared objects
is parallelized.

**Protocol outline.** Figure 1 illustrates the high-level interactions between a client and Sui authorities to commit a transaction. We describe them here briefly:
- A user with a private signing key creates and signs a user
transaction to mutate objects they own, or shared objects,
within Sui. Subsequently, user signature keys are not needed,
and the remaining of the process may be performed by the
user client, or a gateway on behalf of the user (denoted as
keyless operation in the diagram).

- The user transaction is sent to the Sui authorities, that each
check it for validity, and upon success sign it and return the *signed transaction* to the client. The client collects the responses from a quorum of authorities to form a *transaction certificate.*
-  The transaction certificate is then sent back to all authorities, and if the transaction involves shared objects it is also sent to a *Byzantine agreement protocol* operated by the Sui authorities. Authorities check the certificate, and in case shared objects are involved also wait for the agreement protocol to sequence it in relation to other shared
object transactions, and then execute the transaction and summarize its effects into a *signed effects* response.
- Once a quorum of authorities has executed the certificate its effects are final (denoted as finality in the diagram). Clients can collect a quorum of authority responses and create an *effects certificate* and use it as a proof of the finality of the transactions effects.

This section describes each of these operations in detail, as well as operations to reconfigure and manage state across authorities.

**4.1 System Model**

Sui operates in a sequence of epochs denoted by `$$𝑒 ∈ {0, . . .}.$$` Each epoch is managed by a committee `$$𝐶𝑒 = (𝑉𝑒, 𝑆𝑒 (·))$$`, where `$$𝑉𝑒$$` is a set of authorities with known public verification keys and network end-points. The function `$$𝑆𝑒 (𝑣)$$` maps each authority `$$𝑣 ∈ 𝑉𝑒$$` to a number of units of delegated stake. We assume that 𝐶𝑒 for each
epoch is signed by a quorum (see below) of authority stake at epoch `$$𝑒 −1$$`. (Sect. 4.7 discusses the formation and management of committees). Within an epoch, some authorities are correct (they follow the protocol faithfully and are live), while others are Byzantine (they deviate arbitrarily from the protocol). The security assumption is that the set of honest authorities `$$𝐻𝑒 ⊆ 𝑉𝑒$$` is assigned a quorum of stake
![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704538988106-YAKIHONNES3.png)
(and refer to any set of authorities with over two-thirds stake as a quorum).

There exists at least one live and correct party that acts as a relay for each certificate (see Sect. 4.3) between honest authorities. This ensures liveness, and provides an eventual delivery property to the Byzantine broadcast (see totality of reliable broadcast in). Each authority operates such a relay, either individually or through a collective dissemination protocol. External entities, including Sui light clients, replicas and services may also take on this role. The distinction between the passive authority core, and an internal or external active relay component that is less reliable or trusted, ensures a clear demarcation and minimization of the Trusted Computing Base on which Sui’s safety and liveness relies.

**4.2 Authority & Replica Data Structures**

Sui authorities rely on a number of data structures to represent state. We define these structures based on the operations they support. They all have a deterministic byte representation. An Object (Obj) stores user smart contracts and data within Sui. They are the Sui system-level encoding of the Move objects introduced in Sect. 2. They support the following set of operations:

- ref(Obj) returns the reference (ObjRef) of the object, namely
a triplet (ObjID, Version, ObjDigest). ObjID is practically

![image](https://yakihonne.s3.ap-east-1.amazonaws.com/f6a5c82faa64ea7f0812323ce745bd47ad24515cb7ff2578866318873aa6f2a0/files/1704539300996-YAKIHONNES3.png)

unique for all new objects created, and Version is an increasing positive integer representing the object version as
it is being mutated.
- *owner*(Obj) returns the authenticator Auth of the owner of the object. In the simplest case, Auth is an address, representing a public key that may use this object. More complex authenticators are also available (see Sect. 4.4).
- *read-only*(Obj) returns true if the object is read-only. Readonly objects may never be mutated, wrapped or deleted. They may also be used by anyone, not just their owners.
- *parent*(Obj) returns the transaction digest (TxDigest) that last mutated or created the object.
- *contents*(Obj) returns the object type Type and data Data that can be used to check the validity of transactions and carry the application-specific information of the object.

The object reference (ObjRef) is used to index objects. It is also
used to authenticate objects since ObjDigest is a commitment to
their full contents.
A *transaction* (Tx) is a structure representing a state transition for
one or more objects. They support the following set of operations:

- digest(Tx) returns the TxDigest, which is a binding cryptographic commitment to the transaction.
- epoch(Tx) returns the EpochID during which this transaction may be executed.
• inputs(Tx) returns a sequence of object [ObjRef] the transaction needs to execute.
• payment(Tx) returns a reference to an ObjRef to be used
to pay for gas, as well as the maximum gas limit, and a
conversion rate between a unit of gas and the unit of value
in the gas payment object.
• valid(Tx, [Obj]) returns true if the transaction is valid, given
the requested input objects provided. Validity is discussed
in Sect. 4.4, and relates to the transactions being authorized
to act on the input objects, as well as sufficient gas being
available to cover the costs of its execution.
• exec(Tx, [Obj]) executes the transaction and returns a structure Effects representing its effects. A valid transaction execution is infallible, and its output is deterministic.
A transaction is indexed by its TxDigest, which may also be used
to authenticate its full contents. All valid transactions (except the
special hard-coded genesis transaction) have at least one owned
input, namely the objects used to pay for gas.
A transaction effects (Effects) structure summarizes the outcome
of a transaction execution. It supports the following operations:
• digest(Effects) is a commitment EffDigest to the Effects
structure, that may be used to index or authenticate it.
• transaction(Effects) returns the TxDigest of the executed
transaction yielding the effects.
• dependencies(Effects) returns a sequence of dependencies
[TxDigest] that should be executed before the transaction
with these effects may execute.
• contents(Effects) returns a summary of the execution. Status
reports the outcome of the smart contract execution. The
lists Created, Mutated, Wrapped, Unwrapped and Deleted,
list the object references that underwent the respective operations. And Events lists the events emitted by the execution.
A transaction certificate TxCert on a transaction contains the
transaction itself as well as the identifiers and signatures from a
quorum of authorities. Note that a certificate may not be unique, in
that the same logical certificate may be represented by a different set
of authorities forming a quorum. Additionally, a certificate might
not strictly be signed by exactly a 2/3 quorum, but possibly more
if more authorities are responsive. However, two different valid
certificates on the same transaction should be treated as representing semantically the same certificate. A partial certificate (TxSign)
contains the same information, but signatures from a set of authorities representing stake lower than the required quorum, usually
a single authority. The identifiers of signers are included in the
certificate (i.e., accountable signatures [? ]) to identify authorities

ready to process the certificate, or that may be used to download
past information required to process the certificate (see Sect. 4.8).
Similarly, an effects certificate EffCert on an effects structure
contains the effects structure itself, and signatures from authorities5
that represent a quorum for the epoch in which the transaction is
valid. The same caveats, about non-uniqueness and identity apply
as for transaction certificates. A partial effects certificate, usually
containing a single authority signature and the effects structure is
denoted as EffSign.
Persistent Stores. Each authority and replica maintains a set of
persistent stores. The stores implement persistent map semantics and can be represented as a set of key-value pairs (denoted
𝑚𝑎𝑝 [𝑘𝑒𝑦] → 𝑣𝑎𝑙𝑢𝑒), such that only one pair has a given key. Before
a pair is inserted a contains(𝑘𝑒𝑦) call returns false, and get(𝑘𝑒𝑦)
returns an error. After a pair is inserted contains(𝑘𝑒𝑦) calls returns
true, and get(𝑘𝑒𝑦) return the value. An authority maintains the
following persistent stores:
• The order lock map Lock𝑣 [ObjRef] → TxSignOption records the first valid transaction Tx seen and signed by the
authority for an owned object version ObjRef, or None if
the object version exists but no valid transaction using as an
input it has been seen. It may also record the first certificate
seen with this object as an input. This table, and its update
rules, represents the state of the distributed locks on objects
across Sui authorities, and ensures safety under concurrent
processing of transactions.
• The certificate map Ct𝑣 [TxDigest] → (TxCert, EffSign)
records all full certificates TxCert, which also includes Tx,
processed by the authority within their validity epoch,
along with their signed effects EffSign. They are indexed
by transaction digest TxDigest
• The object map Obj𝑣
[ObjRef] → Obj records all objects
Obj created by transactions included in certificates within
Ct𝑣 indexed by ObjRef. This store can be completely derived by re-executing all certificates in Ct𝑣 . A secondary index is maintained that maps ObjID to the latest object with
this ID. This is the only information necessary to process
new transactions, and older versions are only maintained
to facilitate reads and audit.
• The synchronization map Sync𝑣
[ObjRef] → TxDigest indexes all certificates within Ct𝑣 by the objects they create,
mutate or delete as tuples ObjRef. This structure can be
fully re-created by processing all certificates in Ct𝑣 , and
is used to help client synchronize transactions affecting
objects they care about.
Authorities maintain all four structures, and also provide access
to local checkpoints of their certificate map to allow other authorities and replicas to download their full set of processed certificates.
A replica does not process transactions but only certificates, and
re-executes them to update the other tables as authorities do. It also
maintains an order lock map to audit non-equivocation.