<!-- .slide: class="title-slide" --> <svg class="emblem" viewBox="0 0 120 120" aria-hidden="true"> <g transform="translate(36 60) matrix(0.55 -0.35 0 1 0 0)"> <rect x="-22" y="-37" width="44" height="74" rx="6" fill="#e8c35a" stroke="#9c7a22" stroke-width="2"></rect> <circle cx="-7.7" cy="-20.4" r="5" fill="#fff" stroke="#9c7a22" stroke-width="1.5"></circle> <circle cx="6.6" cy="1.9" r="6" fill="#fff" stroke="#9c7a22" stroke-width="1.5"></circle> <circle cx="-3.3" cy="22.9" r="4.5" fill="#fff" stroke="#9c7a22" stroke-width="1.5"></circle> </g> <g transform="translate(84 60) matrix(0.55 -0.35 0 1 0 0)"> <rect x="-22" y="-37" width="44" height="74" rx="6" fill="#e8c35a" stroke="#9c7a22" stroke-width="2"></rect> <circle cx="6.6" cy="-25.9" r="4.5" fill="#fff" stroke="#9c7a22" stroke-width="1.5"></circle> <circle cx="-5.5" cy="-11.1" r="5" fill="#fff" stroke="#9c7a22" stroke-width="1.5"></circle> <circle cx="5.5" cy="13" r="5" fill="#fff" stroke="#9c7a22" stroke-width="1.5"></circle> </g> <g stroke="#dc2626" stroke-width="3" stroke-linecap="round" fill="#dc2626"> <line x1="2" y1="59.6" x2="42.2" y2="59.6"></line> <line x1="48.1" y1="59.6" x2="75.5" y2="59.6"></line> <polygon points="82,59.6 75,55.6 75,63.6" stroke-width="1"></polygon> <line x1="84.5" y1="57.6" x2="89" y2="56" stroke-width="2"></line> <line x1="84.5" y1="61.6" x2="89" y2="63.2" stroke-width="2"></line> <line x1="83" y1="64.5" x2="84.5" y2="69" stroke-width="2"></line> <line x1="83" y1="54.7" x2="84.5" y2="50.2" stroke-width="2"></line> </g> </svg> # Defense-in-Depth Runtime Safety in Move <div class="authors"> Victor Gao · Wolfgang Grieskamp · <span class="speaker">Vineeth Kashyap</span> · George Mitenkov<br> Teng Zhang · Runtian Zhou · Andrea Cappa · Marco Ilardi </div> <div class="venue">Aptos Labs · Runtime Verification 2026</div> --- ## Aptos blockchain <div class="anim" data-anim="s02_aptos"></div> --- ## Permissionless <div class="anim" data-anim="s02b_permissionless"></div> --- ## Move: typed resources with abilities <div class="anim" data-anim="s04_abilities"></div> --- ## Move: modular encapsulation <div class="anim" data-anim="s05a_encapsulation"></div> --- ## Move: aliasing rules <div class="anim" data-anim="s05b_aliasing"></div> --- ## Move: Rust-like aliasing <div class="anim" data-anim="s05b_rust_compare"></div> --- ## Move: execution pipeline <div class="anim" data-anim="s05c_verification"></div> --- ## Bytecode verification <div class="anim" data-anim="s05d_borrow_graphs"></div> --- ## A single point of failure <div class="anim" data-anim="s06_single_slice"></div> --- ## Defense in depth: an independent second layer <div class="anim" data-anim="s07_two_slices"></div> --- <div class="statement"> Re-check the static <span class="verifier">verifier's</span> guarantees with an independent <span class="runtime">runtime monitor</span>. <span class="small">Move on Aptos is the only production VM that pairs a static verifier with a runtime safety layer.</span> <span class="small">The runtime monitor is more precise with no false positives.</span> </div> --- ## Runtime type and ability checking <div class="anim" data-anim="s08b_runtime_checks"></div> --- ## Type confusion: forging a capability <div class="anim" data-anim="s08_type_confusion"></div> --- ## Enums turn aliasing bugs into type confusion <div class="anim" data-anim="s11_enum_alias"></div> --- ## Type safety requires <div class="anim" data-anim="s11b_requirement"></div> --- ## An enum aliasing exploit <div class="anim" data-anim="s11c_enum_exploit"></div> --- ## An enum aliasing exploit <div class="anim" data-anim="s11d_verifier_bug"></div> --- ## Reference counting does not work <div class="anim" data-anim="s12_temp_alias"></div> --- ## Runtime reference safety: shadow semantics <div class="anim" data-anim="s13_shadow"></div> --- ## Runtime reference safety <div class="anim" data-anim="s13b_executed_path"></div> --- ## References point into trees of places <div class="anim" data-anim="s14_place_trees"></div> --- ## Lazy poisoning <div class="anim" data-anim="s15_poison"></div> --- ## Replay: the valid program <div class="anim" data-anim="s16_replay_valid"></div> --- ## Replay: the exploit <div class="anim" data-anim="s17_replay_exploit"></div> --- ## Compositional across calls <div class="anim" data-anim="s18_calls"></div> --- ## A relaxed semantics of the borrow checker <div class="anim" data-anim="s19_relaxed"></div> --- <!-- .slide: class="title-slide" --> # Defense-in-Depth Runtime Safety in Move <div class="code-link"> <span>open source</span> <a href="https://github.com/aptos-labs/aptos-core"><code>github.com/aptos-labs/aptos-core</code></a> </div> <div class="authors"><code>vineeth@aptoslabs.com</code></div> <div class="venue">Thank you! · Questions?</div>