- Sui experienced three mainnet outages on May 28 and 29 linked to its v1.72 release.
- Two downtimes occurred due to a gas charging error uncovered by the new title credits feature.
- The third downtime came after a random latent error that was triggered while restarting the validator.
Sui Foundation published Its full review of the three major network outages that took the network offline on May 28 and 29, 2026. The company claimed the disruptions were caused by two distinct bugs in software version v1.72.
An autopsy confirmed that the first two downtimes shared the same root cause, while the third downtime was triggered by an inherent randomization error detected during a rerun of the validator.
The first outage began at approximately 7 AM PT on Thursday, May 28, and ended at approximately 1:30 PM PT that same day. the Second stop It ran from approximately 5 a.m. PT to 8:30 a.m. PT on Friday, May 29.
The third outage began at approximately 1:30 PM PT on Friday and ended at approximately 7:20 PM PT. The institution said that no user funds were at risk during the three events, and the network did not return any committed transactions when they resumed.
butthe network’s native token, is trading at $0.8776, down 2.6% over the day, 15.7% over the past week, and 73.0% over the past year.
A gas charging fault caused Sui’s first two outages
Version v1.72 added a feature called Address Credits, which gives users a new way to store money and pay for fuel without using coins.
Sui transactions can now pay for gas using address credit alone, coin objects, or a combination of both, which the team calls hybrid gas.
For transactions paid with coins or hybrid gas, the runtime smashes the gas before collecting the transaction fee. The process combines all coins entered into one coin which is then debited for gas. The step runs for successfully executed transactions and for canceled transactions.
The root cause of the first two outages was located in an edge condition within the gas hybrid path. If a booking attempts to overdraft the address balance during budget verification, the attempt is blocked and the transaction is canceled with an InoughFundsForWithdraw error.
The corporation said that the accident did not occur during the gas crash itself. Using an address balance in a transaction issues a balance delta that is settled by a system settlement transaction.
The crash came from a negative delta resulting from canceled but still smashed gas that was applied to a zero balance during settlement.
This situation can only occur when two transactions arrive at the scheduler at the same time and compete to spend money from the address balance that cannot cover both.
The scheduler cancels one of them using InoughFundsForWithdraw to prevent an overdraft, but the canceled transaction still deducts funds through gas smashing.
The temporary fix came with a known risk that led to a second stoppage
A fix proposed by the core team Thursday afternoon stopped the system from crashing gas when a transaction was canceled using InoughFundsForWithdraw.
A sufficient number of validators adopted the patch to restore the network at approximately 1:30 PM PT, with the team accepting known risks associated with the temporary approach.
The organization said that the changes in gas logic are a delicate matter. Address balances interact with coins in complex ways. Changes must either maintain all previous behavior or implement release gateway, where nodes can fork while replaying old transactions under the new logic.
Sui’s gas charging also includes save checks that prevent any transaction from creating or destroying a SUI. Skipping the step that adds any charged funds to the appropriate place may result in a crash. Charging expensive transaction fees is also an essential part of denial of service protection.
The temporary fix had a flaw that the team pointed out when it shipped. A transaction can have multiple reasons for cancellation, and one reason can override the others.
A transaction using address credits may be canceled because there are too many higher priority transactions in the queue to touch the same hot shared object, and then also canceled due to InoughFundsForWithdraw when another transaction spends the same address credit.
In this scenario, the InoughFundsForWithdraw error is masked by the other error, causing the patch to bypass and trigger the same underflow.
This exact scenario hit the network on Friday morning, leading to the second outage. The team was close to completing a more permanent fix at the time and finished in time to propose the new patch to auditors by approximately 8 AM PT. Enough validators approved it to bring Sui back by 9:40 AM PT.
A random status error caused the third Sui to stop
The network operated normally from 9:40 AM PT until approximately 1:30 PM PT on Friday, when the scheduled era change failed to complete, and the network went down for a third time.
The corporation said that the third stop was due to a latent error, the conditions of which were determined by the previous restart cycle.
At the beginning of each epoch, Sui validators run the Distributed Key Generation Protocol, or DKG, which powers the random beacon used in randomness-based on-chain transactions.
DKG requires a higher participation threshold than normal consensus. If you shorten the engagement, the randomness disables itself for the rest of the era as planned.
When the validation tools were restarted to install the fix on Friday morning, participation in DKG for the next epoch was not high enough, and the protocol itself was broken. A latent error means that the failure judgment was never written to disk.
As the reboots repeated again, each auditor returned unaware of DKG’s failure. Transactions based on randomness are expected to be executed or cancelled. Since auditors no longer keep a record of DKG failures, neither can happen.
The paused queue grew, leaving the end-of-era logic, which must exhaust this queue before closing, waiting for a DKG that would never arrive.
The repair has two parts. The first piece corrected the error and added logic to preserve DKG state across reboots.
The second piece added a mechanism that allows validators to close a stuck epoch at a coordinate point. The team used the new mechanism once to shut down the affected era. Then the network transitioned to the new era naturally, and randomness was restored.
What Sui’s team took away from the three outages
The organization has identified four takeaways from the week. Flexibility at the end of the era was a first, as the team noted that the current fallback safe mode for time shifts could be too tight.
The ecosystem needs to extend graceful degradation patterns across the rest of the reconfiguration path and convert the force shutdown mechanism into a permanent operational capability, the organization said.
The second idea covers the logic of charging the gas itself. The malfunctions in parts one and two were caused by errors in the gas charger, the execution corner that interacts with the title balance settlement system, save checks, and the scheduler.
The logic is now complex enough that it is difficult to rule out advanced cases by screening alone, the team said. After the incident, the organization said that charging Gas was worth the same code quality bar as the Move VM or Mysticeti consensus engine.
The third takeaway looked at AI tools. AI agents with access to production status are able to interactively query validator logs, examine batch status, collect on-demand metrics, and physically accelerate diagnostics during the week’s events.
The fourth takeaway dealt with containing failure. The first two outages were caused by specific inputs that the auditors could not safely process. The organization said that the system lacks an in-depth defense layer that would limit the blast range of such a collision.
