Sui: who orders transactions?

Who controls it

Transaction ordering

About 110 to 125 validators. The Foundation’s delegation program seats validators and rebalances stake each month.

Escape hatch

n/a: L1

Upgrade authority

Mysten Labs writes all node software and every protocol upgrade; validators can only install or decline it. One production implementation exists.

Halts and outages

Sui has halted four times, and each restart waited on a Mysten Labs patch. The halts came on 2024-11-21 (about 2.5 hours, scheduling bug), 2026-01-14 (6+ hours, checkpoint divergence), 2026-05-28 (about 6 hours 44 minutes, v1.72 gas bug), and a second stall the next day. Two of the halts came eleven weeks before this review.

Ketju assessment

Ketju does not approve Sui: in May 2025 its validators froze the Cetus exploiter’s ~$162M within hours, and a later upgrade moved the frozen funds without the owner’s keys. Sui’s community counts this event as its proudest moment. Validators began deny-listing within about 80 minutes. The freeze took effect once a third of stake complied, and it needed no vote. Seven days later, 90.9% of stake approved the seizure in a Foundation-organized vote. The approved protocol upgrade carried two hardcoded transactions that moved the frozen objects. The action helped the exploit’s victims. It also shows that a third of stake can freeze holdings on Sui, and two-thirds plus a Mysten-authored upgrade can seize them. Ketju expects that a validator set able to freeze on request will one day be compelled to. The rest of the structure makes compliance the default. The Foundation controls a majority of total supply, most of it unvested through 2030. It seats validators through its delegation program, with monthly performance reviews, and Mysten writes the only node implementation. Sui has also halted four times, twice in one week eleven weeks before this review, and each restart waited on a Mysten patch. One-third of stake is both the freeze threshold and the halt threshold. Third-party trackers put Sui’s Nakamoto coefficient in the high teens. So the same small group of parties can stop the chain or freeze an account.

Review triggers

• The standing per-validator deny lists removed from the protocol
• The status of the Cetus upgrade-aliasing machinery disclosed, and removed if still present
• Foundation and Mysten share of active stake disclosed and falling below 20%
• A second production node implementation running meaningful stake
• Twelve months without a halt that required a single-vendor patch to restart

Each trigger names a fact anyone can observe. If one occurs, Ketju will review the assessment again. None is a forecast.

Questions before use

1. Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
2. Can the client withdraw without help from the party that normally orders transactions?
3. Who can upgrade bridges or contracts, and what delay applies?
4. Does the asset introduce an issuer weaker than the chain grade?
5. What evidence will show a halt, censorship event, or governance change?