Why do local proofs in Move not fully establish security properties that depend on transaction history?

Why local proofs in Move stop short of history-dependent security guarantees

Local proofs in Move reason about a function or module in isolation, so they establish that the checked code is internally consistent at one point in time. That is useful, but it does not prove properties that only emerge when state evolves across transactions, especially when later calls depend on earlier ones.

In practice, the gap appears whenever correctness depends on replay resistance, sequencing, cumulative balances, or a caller's prior actions. A proof can be locally sound and still leave the system open to a broken global state if the specification never models the persistent state transitions that make the property meaningful.

That is why history-sensitive claims must be written as stateful invariants, not as one-shot function properties. The proof has to describe how storage, caller behaviour, and allowed transitions interact over time, otherwise the verifier can confirm a narrow implementation detail while missing the security condition the protocol actually needs.

Where the proof model and the threat model diverge

The core limitation is not Move itself, but the boundary of the proof obligation. A local proof can show that a transaction respects its preconditions and postconditions, yet it cannot see whether repeated execution, reordered execution, or a prior failed attempt changes the meaning of the next call.

That matters for assets and authorisation flows that accumulate over time. If a transaction is safe only when it is the first one, or only after some previous state has been established, then the proof must include that history in the invariant. Otherwise, a sequence of individually valid actions can still violate the intended security property.

Classic security models are useful here because they separate local step checking from system-wide policy enforcement, which is the same conceptual gap that appears when a proof ignores history.

What a history-aware specification has to capture

A useful specification needs to say what remains true after every transaction, not just what is true inside one call. That usually means modelling persistent storage, permitted caller patterns, and the invariants that survive across repeated execution, rather than treating each transaction as independent.

This is especially important when the security condition depends on ordering, idempotence, or monotonic change. If a resource can be created, consumed, replayed, or transferred multiple times, the proof must track those transitions explicitly so that the verifier can reject states that become unsafe only after a sequence of actions.

Blockchain and Distributed Ledger Security Guide helps frame the broader trust problem, because ledger security depends on the validity of state transitions over time, not just isolated calls.

How to keep local correctness from hiding global failure

When a property depends on transaction history, the practical question is whether the proof language and the spec actually model the history that matters. If they do not, the safest interpretation is that the result is a partial guarantee, not a complete security argument.

That is why stateful invariants, transition rules, and caller assumptions need to be reviewed together. A locally valid proof should be treated as one input to assurance, while the system-level security claim still needs checks for replay, sequencing, and state accumulation across the full transaction lifecycle.

Mainframe and COBOL Application Security Guide is a useful analogy for transaction-sensitive assurance, because it shows why resource and transaction security must be reasoned about at the workflow level, not only at the statement level.

Practitioner Guidance

What to verify: Treat any proof of a history-dependent property as incomplete until the specification explicitly covers persistent state, repeated calls, and the caller sequences that can change the outcome. If the invariant cannot be stated across transactions, the proof scope is too narrow for the security claim.

Decision rule: If the property can be broken by replay, reordering, or cumulative state change, write the spec as a cross-transaction invariant first, then prove the local function against that invariant. If not, do not present the result as a full security guarantee.

Practitioner takeaway: The main failure mode is confusing a correct local proof with a correct system property; history-dependent security only holds when the proof language models the state transitions that create the risk.

Related resources from NHI Mgmt Group

• How should security teams evaluate whether access control should move to a cloud service model instead of staying fully on premises?
• Why does transaction-level security matter when industries move from paper-based to electronic processes?
• What happens when ransomware groups combine social engineering with remote services to establish persistence?
• Why do deepfake threats create a higher verification burden for security teams and critical infrastructure operators?