Sui
KLEAR3 ResearchPublished Updated
SuiSUISui, published by Mysten Labs and now stewarded by the Sui Foundation, has run its own network under the Mysticeti consensus protocol since Mainnet launched in May 2023. Its gas fee splits into two destinations at once: a share paid to this epoch's validators, and a share set aside for the validators of epochs yet to come.
What does Sui actually do?
Sui describes itself as "a next-generation smart contract platform with high throughput, low latency, and an asset-oriented programming model powered by the Move programming language." It settles through Mysticeti, a consensus protocol built on a directed acyclic graph rather than a single chain of blocks, live on its own network since May 2023.
That sentence is the project's own, not ours: pulled from the summary it attaches to its own code repository, word for word. Three words in it carry the weight: asset-oriented programming model. They are also the only technical description the project volunteers about its own design in that particular spot.
Source GitHub, read 2026-10-21
Mysticeti is the part that settles the network. The documentation names it plainly: a directed acyclic graph consensus protocol, built to optimise for low latency and high throughput at the same time rather than trading one for the other. It has run Sui's mainnet without interruption since the chain went live.
Source docs.sui.io, read 2026-10-21
Two organisations sit behind the one chain, and the distinction is worth keeping straight. Mysten Labs built it: its own site describes the company as developing "crucial infrastructure to power a more decentralized internet." The Sui Foundation now stewards it, describing itself as "an independent organization dedicated to supporting and strengthening the Sui ecosystem."
Source mystenlabs.com + sui.io, read 2026-10-21
Is the code actually open?
Yes, and generously: the repository has published its code under the Apache-2.0 licence since November 2021, one of the more permissive terms available, and has cut 398 versioned releases. An open licence does not say whether anyone has actually read the code for flaws, and that question has a more complicated answer.
Apache-2.0 grants outsiders the right to read, reuse and build on the code, in writing, from the moment the repository went public. It is a different question from whether that right has ever been used to look for a flaw, and the two are easy to mix up.
Source GitHub, read 2026-10-21
Source GitHub, read 2026-10-21
On that second question, the Sui Foundation keeps its own public registry of security reviews: 27 reports from 8 different firms, dated between 2022-10-06 and 2025-12-09. No single one of them signs off on the whole network at once; each covers a narrow slice.
We separated those slices into two kinds. 5 firms, across 13 named reports, reviewed something close to the execution layer itself: the transaction adapter and bytecode verifier, the Move virtual machine, the JSON RPC surface, denial-of-service testing, the staking system, and the cryptographic primitives underneath consensus. The rest of the registry covers wallets, SDKs, and separate protocols built on Sui rather than Sui itself, which carry their own distinct audits and are not counted in that narrower figure.
Source sui-foundation/security-audits, read 2026-10-21
Is anyone still working on it?
Very much so: 487 commits from 52 distinct Git identities landed in the 90 days to 21 October 2026, the most recent the day before we read it. Fifty-two is a floor on the number of people behind them, not a headcount, since one person can sign with several identities and several can share one.
That count is a window, not a total, and it slides on its own: the fenced period ends the day we read it and begins exactly ninety days earlier. A repeat of the same measure next month will differ without anything having gone wrong.
Source GitHub, read 2026-10-21
The process that decides how the protocol itself changes is a separate, public one: the Sui Improvement Proposal repository, opened the same week Mainnet launched. It has merged 24 pull requests so far, publishing 15 numbered proposals, on the same model as Bitcoin's BIPs or Ethereum's EIPs. Avalanche runs the same shape of process under a different name: no token vote either way, only a written proposal that node operators choose to adopt by upgrading.
Source sui-foundation/sips, read 2026-10-21
What shows it is running
- The network answers — checkpoint 336,365,819
- The repository is still being worked on — 487 commits over the 90 days to 2026-10-21, 52 distinct Git identities
Source graphql.mainnet.sui.io · GitHub, read 2026-10-21
- The repository goes public
- Sui Mainnet goes live
- The SIP proposal repository opens, the same week
- This page, checked and published
Where does it actually run?
On one network, its own: a public endpoint answered with checkpoint 336,365,819 on 21 October 2026, confirming the chain is live and advancing. Sui does not run as a second deployment bolted onto Ethereum or any other base layer; everything it settles happens on this one ledger.
We checked that ourselves rather than taking a block explorer's word for it: the network's own public GraphQL endpoint, not a mirror or a dashboard. A checkpoint is Sui's equivalent of a block height, a number that only ever goes up.
The classic JSON-RPC calls other sites still cite for this kind of check now answer with a deprecation notice on public nodes; the live path runs through GraphQL instead, a detail easy to miss if the only source consulted is an older guide.
Source graphql.mainnet.sui.io, read 2026-10-21
SuiNetwork verified by reading its current block height on a public node.
What the token actually does
Yes, SUI pays for gas, and only gas: the total supply is capped at 10,000,000,000, of which 4,118,270,447.64 already circulates. The fee itself splits in two the moment it is paid, and the token carries no vote over protocol upgrades, which move through written proposals instead.
SUI is spent on gas and staked with validators; nothing else gives it a function in the protocol. The cap is fixed at 10,000,000,000, and the aggregator we read puts 4,118,270,447.64 of that in circulation today, up from roughly 5% when Mainnet opened on 2023-05-03.
Source CoinGecko, read 2026-10-21
What we did not find, at a primary source, is the detailed curve between those two points: how much of the cap sits in a community reserve, how much went to Mysten Labs, to early investors, and on what unlock calendar. Third-party trackers publish a breakdown of their own; we have not confirmed it ourselves, so it stays off this page.
Source sui.io, read 2026-10-21
- In circulation4,118,270,447.64
- Issued, not circulating5,881,729,552.36
- What the token is forDirectly verified
- How many existThird-party supported
- How new ones appearNot verified
- Who can change the rulesDirectly verified
The KLEAR3 rating
3.7out of 5 in the KLEAR3 rating
Each axis gets 0 to 5 from the facts in the register, against thresholds written in advance. The overall score is their weighted average, and it only appears once at least 5 of the 6 axes rest on a measured fact.
- Audits ×1.3
- Open code ×1.2
- Business model ×1.1
- Token alignment ×1
- Governance ×1
- Maturity ×0.7
- Open code5
public repository · Apache-2.0 licence · 398 published releases · 487 commits in 90 days
- Audits3
5 firms on the core · overlapping reviews · 13 audited scopes · code reviewed in the open: 487 commits in 90 days, 4 years in production
What holds it back no report opened: we do not know what they found
- Business model5
business model published by the protocol · paid by whoever sends the transaction · collected by the epoch’s validators and whoever delegated stake to them, in proportion to that stake · The storage share is paid into the Storage Fund, invested to earn stake rewards of its own and paid out over time to the validators of future epochs; up to 99% of it is refunded if the stored data is later deleted.
- Governance3
decided by a public proposal process (SIP), with no vote · 15 improvement proposals published
- Token alignment2
supply capped at 10 billion · 41% already in circulation
What holds it back emission schedule unknown
- Maturity4
4 years of public code · 1 network verified by us
We rate the protocol: how it is built, how much of it can be checked, how its token lines up. Never an investment. A high score is not advice to buy, and a low one is not advice to sell.
What we could not establish
Three things above all. We did not open the individual PDF files behind the 27 audits in the official registry, so we cannot say how many findings were critical or how many stayed open. We also did not find a detailed token-unlock schedule published at a primary source, only the launch-day share.
Both gaps are closeable, and neither is a reason to assume the worst: a report that exists but that we have not read is not the same thing as a report that was never written, and a schedule we could not source is not the same thing as a schedule that does not exist.
Frequently asked questions
Does Sui have a native cryptocurrency that works like Bitcoin’s?
Yes and no. SUI is Sui’s native token, used to pay every transaction fee and to stake with a validator, but unlike Bitcoin it carries no vote over the rules that govern it: protocol changes move through a public proposal process instead.
Sui launched Mainnet on 2023-05-03 with roughly 5 percent of the 10,000,000,000 cap already circulating. The aggregator we read today reports 4,118,270,447.64 in circulation, out of a total supply that has not moved since launch: the cap itself is fixed, only the unlocked share grows.
That circulating share buys gas and a stake, never a ballot anywhere on the network. Fifteen numbered proposals sit in Sui's own public improvement-process repository, opened the same week Mainnet launched, with twenty-four separate pull requests merged into it since then: the token pays for the network; the proposals change it.
Who audited Sui, and did they find anything serious?
Eight different firms have reviewed parts of Sui since October 2022, according to the project’s own public registry of reports. We counted five of them on the execution layer itself: the adapter, the Move virtual machine, the denial-of-service surface and the underlying cryptography.
The other three firms in the registry reviewed wallets, SDKs and zkLogin's circuits, which matter for users but sit outside the chain's own execution. DeepBook and Walrus are two separate protocols Mysten Labs also built, and they carry their own distinct audits, not counted here.
We have not opened the twenty-seven report files themselves, so we cannot say how many findings were critical or how many remain unfixed. A firm's name on a cover page is easy to list; reading its findings is the real gap, and we have not done that yet.
Does a validator, or Sui itself, keep every transaction fee?
Not entirely, and not right away either. A transaction’s fee splits in two the moment it is paid: the computation share goes to this epoch’s validators, while the storage share is set aside in a separate fund rather than handed out immediately.
That storage fund is invested to earn stake rewards of its own, and the proceeds pay out later, to the validators of future epochs rather than the one that collected the fee. Up to ninety-nine percent of the storage charge comes back to whoever paid it if the stored data is later deleted.
That is a different shape from a chain like Bitcoin, where the miner who includes a transaction keeps the whole bid at once and nothing is deferred to a future block. Sui spreads the payment across time instead of paying it out in full on the spot.
Where to read on, at the source — every address answered 200 on 2026-10-21.
Read next: our Ethereum profile covers the other chain in this catalogue whose upgrades move through a written-proposal process rather than a token ballot, and our Cardano profile shows the opposite choice: a chain whose newer client feeds an on-chain vote most of this catalogue does not have.
Ask an assistant to summarise it and check what it claims.