The HamsterWheel: An In-Depth Exploration of a Novel Attack Vector on the Sui Blockchain

This analysis describes the "HamsterWheel" vulnerability in Sui's custom IDLeak verifier: a join-order inconsistency in the verifier's abstract-state merge lets an attacker craft bytecode that forces infinite reanalysis of verifier passes, consuming CPU and causing persistent validator hangs and potential network-wide denial-of-service. The report includes technical root cause, a concrete Move bytecode proof-of-concept, impact estimation (network halt, persistent damage), the disclosure timeline, and Sui's fix and operational mitigations (denylist and expanded metering).