Sui: who orders transactions?

Control profile

Transaction ordering

A validator set on the order of 110-125, with the Foundation's delegation program seating and rebalancing stake monthly

Escape hatch

n/a — L1

Upgrade authority

Mysten Labs writes all node software and every protocol upgrade; validators can only install or decline. One production implementation exists.

Liveness record

Four halts, every restart waiting on a Mysten Labs patch: 2024-11-21 (~2.5h, scheduling bug), 2026-01-14 (6h+, checkpoint divergence), 2026-05-28 (~6h44m, v1.72 gas bug), and a second stall the next day. Two halts eleven weeks before this review.

Ketju control assessment

ADVERSE CONTROL ASSESSMENT. , and the deciding event is the one Sui's community counts as its proudest moment. In May 2025 the Cetus exploiter's ~$162M was frozen within hours, validators deny-listing within about 80 minutes, effective once a third of stake complied, with no vote needed. Seven days later the seizure was authorized: 90.9% of stake, in a Foundation-organized vote, approved a protocol upgrade carrying two hardcoded transactions that moved the frozen objects without the owner's keys. Good news for the exploit's victims, and fatal for the property this sleeve exists to provide: holdings on Sui can be frozen by a third of stake and seized by two-thirds plus a Mysten-authored upgrade, demonstrated, not theoretical. A validator set that can freeze on request will eventually be compelled to. The surrounding structure makes compliance the default: the Foundation controls a majority of total supply, most of it unvested through 2030, seats validators through its delegation program with monthly performance reviews, and Mysten writes the only node implementation. Add four full halts including two in one week eleven weeks before this review, each waiting on a Mysten patch. The freeze threshold, one-third of stake, is also the halt threshold, and third-party trackers put Sui's Nakamoto coefficient in the high teens, so the parties who must agree to stop the chain and the parties who must comply to freeze an account are the same small room.

Observable review triggers

• The standing per-validator deny lists removed from the protocol
• The status of the Cetus upgrade-aliasing machinery disclosed, and removed if still present
• Foundation and Mysten share of active stake disclosed and falling below 20%
• A second production node implementation running meaningful stake
• Twelve months without a halt that required a single-vendor patch to restart

These triggers make the assessment monitorable. They are not predictions; each identifies a fact that would change or reopen the current control assessment.

Advisor implementation questions

1. Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
2. Can the client exit without cooperation from the normal transaction-ordering party?
3. Who can upgrade bridges or contracts, and what delay applies?
4. Does the asset introduce an issuer weaker than the chain grade?
5. What evidence will show a halt, censorship event, or governance change?