Sui Analytics

(DeepBook) Read live bids, asks, spread, mid price and resting-liquidity imbalance for a DeepBook v3 pool. DeepBook is a central limit order book, so its liquidity is the resting orders listed here. Omit pool_name to list available pools.

(DeepBook) Recent fills for a DeepBook v3 pool, with the maker and taker balance manager IDs behind each trade. Filter by balance manager to attribute trading activity to one account during an incident window, or by time range to reconstruct what traded when.

(Incident investigation) Remove a finding by id, for retracting something that turned out to be wrong. Use list_findings to get ids. Requires SUI_STORE_PATH.

(Security) Compare two Move package versions for upgrade changes or backdoors. Reports added and removed modules/functions, visibility changes, changed function instructions, unified hunks and dependency relinks with calls to diff those dependencies. A dependency alone can change behavior even when no local module changed. Renumbering caused only by recompilation is counted but excluded from hunks; renumbering_only_functions names functions with no other change. Hunks stay within the named declaration even if compilation reordered functions. By default, compares the previous version to the lat…

(Developer) Read Move bytecode assembly for a package ID or MVR name, without an external binary. Lower-level than decompiled source. Omit module_name to list modules; set all_modules for the package. Use function_name with module_name to read one function with its referenced imports and constants; a whole module can reach 250 KB. Annotates abort messages, opaque constants, shift truncation and the linked dependency versions actually run.

Description is built at runtime.

(Incident investigation) Render a case's findings as a Markdown report, Mermaid diagram, graph JSON or CSV. Markdown groups findings by evidence tier (chain-derived, indexer-attested, heuristic), highest confidence first within each, with an optional appendix of full addresses. Requires SUI_STORE_PATH.

(Incident investigation) Find value paths from one address to another through priced coins and custody-changing objects. Searches forward from `from` and backward from `to` using trace_flow_graph's engine, expanding by depth while queued nodes fit the limit and prioritizing larger shares once they do not. Object paths show each object id, type and USD value at its transaction's checkpoint. Returns paths with each hop's transaction digests and amounts in time order. `to` may be an account on another chain (EVM, Solana or CAIP-10); a path then ends at a Sui bridge exit whose chain-derived benefi…

(Incident investigation) Follow a wallet's first funding transaction and sender, then each funder's funding. Stops at labels (see manage_labels), cycles, dead ends, funders paying over 50 addresses at least 0.01 SUI or $0.10 each, or a funder whose payment came after its own first 12 transactions. Service ancestry and an established funder's earlier funding cannot attribute this payment; dust-only recipients do not count toward the service threshold. Each hop reports funder popularity. dust_skipped lists ignored inflows; sponsored_by lists gas payers even if no funding qualifies; a wallet can …

(Incident investigation) Trace funding for up to 100 addresses together, cheaper than repeated find_funding_source calls. Walks stop at funders that paid over 50 addresses. Reports common funders with fan-out and flow shape, counted up to the first funder that is a walked subject; co-funding compared with each transaction's total recipients; direct subject-to-subject funding; later signed payments between subjects (subject_paid_subject); and fundings within one minute as possible scripted setup. related_addresses (up to 500) are subjects that are not walked: split a larger set across calls and…

Find pools for an exact token pair across Cetus, DeepBook v2/v3, Turbos, BlueMove v1, Bluefin, Momentum, FlowX CLMM/v2, Magma, Aftermath AMM and Kriya v2. Both token orders are searched. Venue statuses distinguish complete searches from failed or capped reads. The response includes pool IDs and coin types.

(Multisig investigation) Given several addresses you already suspect are related, find any multisig wallet they jointly control, even one that never appeared in your trace. Works by deriving every committee those keys could form and checking which of those addresses exist on chain, so a hit is proof (the address IS the hash of its committee), not a guess. Use it when a trace links wallets and you want to know whether they also share a treasury. Each address must have SENT a transaction, since that is where its public key becomes visible.

(Incident investigation) Measure how many distinct addresses an address pays and is paid by over its newest transactions. Use it on a shared funder before reading common funding as a link: an exchange hot wallet or another service funds unrelated wallets, so common ancestry through it links nobody. Returns recipient_count, sender_count, counterparty_count, a classification (hub, distributor or narrow), out_in_ratio and flow_shape (disperser, collector or balanced). flow_shape separates funders with similar counts: an exchange runs balanced, while a sybil funder pays many and is paid by few. A …

Read one coin's liquid balance for a Sui address or object, now or at a past time/checkpoint; the default coin is SUI. The total includes Coin<T> objects and address-balance funds, so no coin objects does not mean no funds. Only its defining module can withdraw an object's address balance. This excludes staking and DeFi positions: check get_staking_summary and get_defi_positions before assessing holdings; use get_wallet_overview for every coin. Historical reads are direct within the consistent range (about the last hour), reconstructed for older points and exact only when complete:true. Recons…

Get current Sui network info: chain ID, epoch, checkpoint height, timestamp, and reference gas price. Optionally pass an epoch number to get details for a specific epoch.

Get a Sui checkpoint by sequence number, digest or timestamp, or the latest if none is given. Returns its timestamp, epoch and network transaction count. Use it to turn a checkpoint number into a time, or a time into a checkpoint: with `timestamp` it returns the checkpoint nearest that moment, plus the last checkpoint before it and the first at or after it, which are the exact edges for a checkpoint-range filter. query_transactions, query_events, build_timeline and aggregate_events also accept ISO times directly.

Get on-chain metadata for a token/coin given its exact coin type string (e.g. '0x2::sui::SUI'). Returns name, symbol, decimals, description, icon URL, and total supply. If you only have a name or symbol, use search_token first to find the coin type.

Find and value a wallet's staked SUI with rewards, issuer-rate liquid-staking coins, CLMM/AMM liquidity, lending and balances inside owned objects. Positions include asset legs, valuation method and evidence tier; USD is null if any leg lacks a price, with unpriced_reason. Totals sum only priced positions. coverage lists unrecognised owned-object types and counts; unread lists failed reads. Lending includes protocol health ratios. leads flags near-borrow-limit positions and operated shared vaults with their holdings.

(Developer) Get a specific Move function signature from a Sui package. Returns parameters, type parameters, return type, and visibility.

Read TradePort, BlueMove and OriginByte NFT sale events over a recent window, with volume and per-marketplace totals. Records sale-derived kiosk ownership for get_top_holders.

Get a Sui object by its ID. Returns type, owner, version, content (JSON), and digest. Automatically extracts display metadata (name, description, image_url) for NFTs. For the LATEST version it also lists `address_balances` (funds the object holds in its own address balance, which are not among its fields and which only its defining module can withdraw) and, for a kiosk, `kiosk_cap_holder`: who actually controls it today, since `content.owner` is self-declared and not kept in sync with the KioskOwnerCap transfer that does. Neither is read for a specific `version`: both are current state and wou…

(Developer) Get a Sui Move package by its ID. By default returns a per-module summary: function and struct counts, entry and public function names. Pass `modules: ['pool']` for those modules' structs (abilities + ordered fields in BCS declaration order) and function signatures by visibility (entry, public, friend, private), or `detail: 'full'` for every module. `dependencies` lists each non-framework package this version is linked against and the version it runs: `linked_id` is the ID to pass to disassemble_module to read the code that runs, since bytecode names a dependency by its original ID…

(Developer) Get the dependency graph of a Sui Move package from its linkage table: every package it is linked against, with the exact version linked (`linked_version`), which can be older than the dependency's current version. With depth > 1 each dependency's own linkage is read too, up to depth 3. System packages (0x1, 0x2, 0x3) upgrade in place, so their nodes show the current version while the edge shows the one linked.

Get stats for a DeFi liquidity pool on Sui given its object ID. Auto-detects the protocol (Cetus, DeepBook, Turbos, etc.) and returns token pair, reserves, fees, and current prices.

Get directly held StakedSui positions and principal, now or at as_of. Historical budget stops return a continuation; totals stay null until replay finishes. Excludes wrapped stakes and liquid-staking tokens.

Get USD prices for Sui coins by full coin type, current by default or at a past moment when `at` is set. Needs no API key. Each price names its source, confidence and sample time, and each coin that could not be priced is listed under `unpriced` with the reason. The 24h change is null when DefiLlama lacks the current or day-earlier price. An unverified coin is priced only by its exact coin type, never by a symbol-matched feed.

Scan objects of a Move type and report holders. NFT collections are ranked by count; tokens by balance across Coin<T> objects and address balances. A truncated scan returns sampled_holders, unranked and with no supply share; a token ranking is complete only when both walks, coin objects and address balances, reach the end. Kiosk-held NFTs use sale-derived owner snapshots that get_nft_sales records, where available; remaining kiosk owner fields are self-declared and marked. Accepts a Move type, coin type or mainnet collection name. A scan stops at its time budget and reports time_budget_reached…

Read one Sui transaction's sender, status, gas, balance changes, decoded actions and event fields; no hand-written GraphQL is needed to read event values. It identifies protocols from calls and events (including wrappers), and unnamed packages by their curated publishing key; protocols_unchecked marks unread publishers. It shows address-balance deposits and withdrawals, requested withdrawals and gas source; non-sender object deliveries (coins separately when no other object moved); sender-owned capabilities mutated without transfer; and router coin round trips with cost from pool events, or nu…

(Recommended for wallet activity) Read a wallet's decoded protocols, actions and coin flows; prefer this to query_transactions for exploring activity. from/to bound the chain query: ISO times are inclusive, checkpoint numbers exclusive. Rows use complete balance changes and commands. Newest first by default; oldest starts at the first transaction in the window. Pass next_cursor as cursor with the same from, to and order. address_poisoning always checks the shown page only, so empty pairs clear nothing older. subject_flow is the queried wallet's signed change per coin; token_flow is the sender'…

Read 1-50 transaction digests in batched calls. Returns sender, status, timing, balance changes, non-coin object transfers and objects created for other owners, Move calls, decoded events and protocols. GraphQL misses are retried through the archive. object_changes_truncated marks an incomplete bounded object read; use get_transaction for that digest. Summary caps displayed rows with counts and omitted retrieval; detail: 'full' removes display caps, not object or event read bounds.

(Incident investigation) Read upgrade governance across a package lineage: each version's ID, transaction, time, publisher, signing scheme and UpgradeCap holder then. Schemes include single key, zkLogin, passkey and multisig with threshold and actual signers. Flags cap round trips around upgrades, single-key upgrades of usually multisig-held caps, policy changes, and caps destroyed, wrapped, frozen, shared or sent to unspendable addresses. as_of gives the cap holder and newest version at that moment. It lists non-framework dependency relinks and the dependencies run by the latest and as_of ver…

List current Sui validators, or return detailed info for one `address` (credentials, staking stats, network addresses). The default summary shows name, address, stake, commission, voting power and at-risk status within a compact output budget; at-risk validators are always kept. Ranking, active_validator_count and total_stake cover the whole set; validator_count counts the rows shown. `detail: full` returns every full row unless `limit` is set. Omitted rows and fields name a same-network full call without a limit.

(Recommended first tool for wallets) Overview of a Sui wallet: every coin balance, SuiNS name, staked SUI and kiosk counts, 50 newest transactions with an older-history continuation, and a time-bounded scan of package versions it published or upgraded in the first 20 sent transactions (`package_activity.scan.next_call` continues; `package_activity_next_call` retries if unavailable). include_prices adds USD values, coins ranked by value, and DeFi positions (staked SUI with rewards, liquid staking, liquidity, lending, and balances inside owned objects), each totalled apart. `coverage` says which…

List package versions created by publish or upgrade transactions sent from this wallet address. Scans 20 sent transactions per call, oldest first; `scan.complete` is true only when all pages and transactions were read. `scan.next_call` continues with an opaque cursor that carries prior unread counts. `scan.incomplete_transactions` names unread digests on this page and `scan.prior_incomplete_transactions` counts them on earlier pages. Each package carries its creating transaction, lineage root and version; an alias may have signed for the sender, and the sender is not necessarily the current Up…

(Recommended first step) Classify a Sui address as wallet, package, validator or object before choosing other tools. For wallets, package_activity scans the first 20 sent transactions for publishes/upgrades and provides next_call to continue; the result also includes balance and name context. Package results include modules and bridge labels on defined objects; bridge_carrier identifies bytecode calls into curated bridge exits. Validator results include stake information. A wallet's first_seen is the oldest transaction GraphQL returns where it sent or was affected, with received coins read acr…

(Developer) List dynamic fields of a Sui object. Returns field names, types, and values. Useful for inspecting on-chain tables, kiosk contents, or other dynamic collections.

(Incident investigation) List recorded findings, or every case with its finding count. Call with no arguments to see what cases exist. Requires SUI_STORE_PATH.

Description is built at runtime.

(Recommended for NFTs) List NFTs owned by a wallet, including kiosk-stored NFTs. Each row has an object id, `collection_ref` (zero-based index into this page's exact `collection_types`), kiosk and display metadata. `detail: 'full'` adds raw Move contents and valuation evidence. `est_usd` is a heuristic NFT estimate; other valued objects carry `value_usd` and a tier. `value: false` skips valuation. Pass `next_cursor` as `cursor` for the next page; its absence means the wallet is fully enumerated. Use list_nft_collections for a per-collection summary and wallet total.

Scan current top-level Sui objects matching a Move struct or module filter across every owner kind. Objects wrapped inside another object's fields are not indexed by type and are not listed. Reports scanned and matched counts, owner kinds, integer sums/min/max over selected fields, and the largest rows. `where: {field:'offer',gt:'0'}` keeps funded objects only. Nested paths use dots. A total is given only when every amount is in one unit: a Balance<T> field adds up per coin T with its decimals, any other field per object type; mixed units are listed in `sum_units`. Types are rewritten to the p…

List raw objects owned by a Sui address with optional type filter and pagination. `count` covers every object of the page; the default view lists the objects that fit about 30k characters in page order and states the rest under `omitted`, and `detail: 'full'` lists the whole page. `next_cursor` continues after the whole page, rows under `omitted` included. For NFTs specifically, prefer list_nfts (resolves kiosk storage, extracts display metadata). For a wallet summary, prefer get_wallet_overview.

Manage chain-qualified address labels for investigation and trace sinks. Actions list, lookup, add, remove, import a batch, or export in importable form. Added/imported labels persist with SUI_STORE_PATH; otherwise they last this session. Remove deletes their stored copy, but cannot remove the read-only SUI_LABELS_FILE or shipped labels. Precedence is local additions > override file > shipped disclosed labels > shipped inferred exchange deposits; export excludes inferred deposits. A label on one chain does not apply on another. List counts all categories/sources and shows local additions first…

Get the full Move Registry record for a single package name: metadata (description, homepage, icon), current version, on-chain package_address, the package_info object ID, and git source info (repo, branch, path) when registered.

Resolve one or more Move Registry (MVR) names to their on-chain package IDs. Names use the form '@org/app' (latest version) or '@org/app/N' for a pinned version. Use this to translate human-readable package names like '@suins/core' or '@deepbook/core' into addresses for use with other tools.

Resolve fully-qualified Move struct names (e.g. '@suins/core::config::Config') to their canonical type tag using the type's defining-package address. No generics: for parameterized types include them as '<...>' and the registry will reject the request. Bulk-friendly.

Reverse-lookup MVR names from one or more package addresses. Useful for enriching raw addresses (e.g. from get_package or transaction decoders) with their canonical '@org/app' name. Returns null for addresses with no registered name.

Browse or search the Move Registry for packages. Searches name and description; returns one page (default 20 results) with a cursor for pagination. Pass `is_linked: true` to limit results to packages actually published on the current network.

Return what has happened to watched addresses since the last poll, and nothing else. Cheap to call repeatedly: an empty result is a few dozen tokens. Each hit names a digest and why it fired; read the ones that matter with get_transaction.

Query decoded events by type, sender, emitting module, affected object or time/checkpoint range. With affected_object (an object ID such as a pool, or up to 20), scans transactions touching it, failed ones included, and lists every event with its digest, checkpoint, timestamp and names_object (true when a decoded field within eight levels names a listed ID); names_object_at gives the matching field path. names_object: true lists only those, including a router's echo of a pool's swap, so count trades by the venue's own event_type. Empty filtered slices report how many events names_object droppe…

Query raw transactions by sender, affected address or object, Move function, or time/checkpoint range. Pass ISO 8601 times directly in after_checkpoint and before_checkpoint, e.g. "2026-08-07T00:00:00Z"; checkpoint numbers are optional. Only one of affected_address, affected_object and function is allowed. Prefer get_transaction_history for readable wallet activity. Pages default to newest first and report order, timestamp bounds and resolved window; pass next_cursor as cursor with the same order and filters. Short service pages are filled to limit within a read budget; scan reports exhaustion…

(Incident investigation) Resolve bridge transfers from a Sui digest using cross-chain message identities rather than guesses from amounts and timing. Covers Wormhole, native Sui Bridge, CCTP, LayerZero V2, Axelar ITS, Allbridge Core and Celer cBridge; beneficiary decoding also covers Wormhole Token Bridge and Relayer, NTT, Mayan MCTP/Swift and LayerZero OFT. Beneficiaries are distinct from redemption contracts and destination OApps. It reports inbound native claims and Wormhole Token Bridge/NTT redemptions with origin identity; also any package's fulfilment quoting a consumed CCTP domain and n…

Resolve a SuiNS name (.sui domain) to an address, or reverse-lookup an address to its SuiNS name. Provide 'name' or 'address'. An unregistered, expired or unset name returns a null address with `name_note`; a malformed name is an error. IDENTITY WARNING: Anyone can buy a SuiNS name. A name matching an exchange, project or person may belong to an unrelated party, including one that wants to mislead an investigator. Treat it as a holder-chosen label, not verified identity; corroborate independently before matching it to identities on other platforms.

(Incident investigation) Find which package IDs of a protocol are actually emitting events right now, so a query targets something live. Start here before aggregate_events or query_events when you know a protocol by name or hold a package ID of unknown vintage. The bundled protocol registry maps IDs to names for DECODING and is full of historical versions on purpose, so using one as a query target silently returns zero events and looks like the protocol is dead. Note the answer is usually plural: an event carries the ID of the package version that defined it, so a protocol upgraded piecemeal e…

(Incident investigation) Sample addresses that used the same protocol over the same window as a cohort, to measure how often a signal such as shared funding, common ancestry or timing overlap occurs by chance. Select the population by module or event_type, exclude the cohort, and pass a seed for a reproducible draw. Sampling is random rather than ranked by activity.

(Incident investigation) Save a conclusion under a named case with evidence tier, addresses, digests and supporting evidence; findings persist across sessions. Save each finding when it is established. Use export_case to render the recorded findings as a report. Requires SUI_STORE_PATH.

(Incident investigation) Screen direct and indirect exposure to labelled malicious, sanctioned, exchange, bridge and mixer accounts, by default two hops in both directions. Exposures include paths, per-leg digests and amounts, and label provenance. Screens chain-derived bridge beneficiaries against labels and OFAC's SDN list for CCTP, Sui Bridge, Wormhole, Mayan, LayerZero OFT, Axelar, Allbridge and Celer. Each exit counts once under its carrying protocol, with settlement bridges and other exits listed separately. Coverage names label sources and history read, and notes that OFAC lists no Sui …

Find a Sui coin type by name or symbol. Verified types rank first. Mainnet searches DexScreener for the ticker and ticker + SUI; GeckoTerminal is used when results are missing, capped or unavailable. Up to 25 pool-backed candidates are confirmed by exact coin type on chain and searches are cached for 10 minutes unless a provider or confirmation failed. Symbols are not unique; partial result caps, provider outages and failed on-chain confirmations are reported separately. Without confirmed live matches or off mainnet, a bounded CoinMetadata scan is used; pass a full coin type to inspect a coin …

Simulate a Sui transaction without signing or submitting it. Takes Base64 BCS transaction bytes (build_transfer and build_staking produce them) and returns simulated status, gas cost, events, balance changes and object changes. Use it to check whether a transaction succeeds, what it costs and what an unfamiliar payload does before signing. The server holds no signing keys and cannot submit a transaction.

(Incident investigation) Summarize an address's coin and object inflows, outflows, counterparties, gas sponsorship and bridge exits over a window. Coin USD uses hourly historical quotes; check usd_basis for coarsening and coverage. Scans newest first: check coverage.complete and follow coverage.continue_with when capped. address_poisoning and cross_chain_leads cover only scanned activity, not clearance.

(Incident investigation) Total an attacker's take across exploit digests or a sender's window, grouped by drained pool or vault. Reports attacker net per coin and pool reserve changes, with USD. Reserves use decoded events or, if none yields amounts, drained-object Balance<T> holdings at input/output versions. Address-only onward coin transfers are transfers_out, not take. Unpriced legs make USD totals partial, not a lower bound. Summary keeps the largest rows fitting about 40k characters. Oversized full views page groups through omitted.next_call, without requiring a store; stored-result page…

(Incident investigation) Trace every branch of value forward or backward from a transaction or time-bounded address. Priced coin movements and objects changing custody receive proportional shares; object edges name their id, type, checkpoint USD value and valuation tier. The walk follows an object by id through later transfers or redemption into coins. Unvalued objects are listed separately and receive no share. Coins continue through swaps and self-credits. The walk stops at sinks, hubs, protocols, bridge exits with decoded beneficiaries, and transactions signed by someone other than the send…

(Incident investigation) Follow a fund-flow path from a transaction. Forward traces a recipient's next move of the tracked coin; backward traces its payer's most recent earlier inflow. It follows value through swaps, self-crediting exploits or withdrawals, and objects. Stops at labelled exchanges, bridges, mixers or burns (manage_labels), bridge exits and high-fanout hubs; forward hub stops require 100+ distinct incoming senders, so smaller pass-through funders are followed. Malicious labels do not stop the trace. stop_reason always explains the end. Returns decoded actions, a readable summary…

(Incident investigation) Trace an object's versions, producing transactions, times and ownership transitions, including transfers, sharing, freezing and party transfers. Use this for a pool, vault or capability's creator and past holders. Deleted or wrapped objects have current:null and an end transaction. Party ownership names its single owner; kiosk ownership and kiosk_cap_holder describe today's custody only, never a historical controller. Beyond the shown page, owner_change_count is always a lower bound: checkpoint search can miss an ownership round trip within a probed span. owner_change_…

Add, remove or list addresses watched for new activity during an investigation. A watch records where it last looked, so poll_watch returns only what is new. Requires SUI_STORE_PATH.