Sui's Cut Package — How Sui Freezes Its Execution Layer

Sui upgrades its Move VM without breaking the chain. The secret? A small Rust CLI tool called cut that snapshots execution crates so old and new logic can live side by side.

✍ 0xTheBlackPanther 📅 March 28, 2026 ⏱ 4 min read 🏷 Sui, Execution Layer, Internals

The Problem: Upgrading a Live Blockchain

Imagine Sui wants to change how the Move VM works — fix a bug, optimize gas metering, or ship a whole new VM like Bella Ciao. But here's the catch:

Every validator on the network must produce identical results for every transaction — past and present. If you replay a transaction from 6 months ago, it must produce the exact same output it did originally. Otherwise validators disagree, and that's a consensus fork.

So you can't just update the code and move on. You need to keep the old code around, frozen exactly as it was.

The Solution: Versioned Snapshots

Sui solves this by keeping multiple frozen copies of its execution layer side by side:

sui-execution/ ├── v0/ ← frozen: protocol versions < 18 ├── v1/ ← frozen: protocol versions 18–30 ├── v2/ ← frozen: protocol versions 31–37 ├── v3/ ← frozen: protocol versions 38–117 ├── latest/ ← living code: protocol versions 118+ └── cut/ ← the tool that creates these snapshots

When a transaction comes in, Sui checks which protocol version it belongs to, then routes it to the correct frozen version. Old transactions use old code. New transactions use new code. Everyone agrees.

What Is the Cut Package?

The cut package (sui-execution/cut/) is a small Rust CLI tool — not a smart contract, not a framework. It's a developer utility that automates creating those frozen snapshots.

In plain English: it copies crates, renames them, and rewires their dependencies so the old and new versions don't clash.

Think of it like this: You have a Google Doc (latest/) that you keep editing. Before a big release, you make a "Version 3" copy that nobody can edit anymore. The cut tool automates making that copy — and makes sure all the internal links in the copy still work.

The Four Files

The entire tool is just 4 Rust files. No framework, no blockchain logic — pure file manipulation:

FileWhat It Does
main.rsEntry point. Parse args → build plan → print or execute. 7 lines of logic.
args.rsDefines CLI flags: --feature v3, --dir src:dst, --package name, --dry-run
path.rsFile system helpers: normalize paths, compute relative paths, deep-copy directories
plan.rsThe brain: discovers crates, plans the copy, executes it, fixes Cargo.toml files, rolls back on failure

How It Works: Step by Step

When the Sui team is ready to freeze a new execution version, they run something like:

./target/debug/cut --feature v3 \ -d sui-execution/latest:sui-execution/v3:-latest \ -d external-crates/move:external-crates/move/move-execution/v3 \ -p sui-adapter-latest \ -p sui-move-natives-latest \ -p move-vm-runtime \ ...

Here's what happens under the hood:

1. Discover — Walks the source directories, finds crates matching the --package names
2. Plan — For each crate, computes the new name (sui-adapter-latestsui-adapter-v3) and new path (latest/v3/). Checks for conflicts.
3. Copy — Deep-copies all source files to the destination (skipping target/ build dirs)
4. Rewire — Edits every Cargo.toml in the copied crates: renames the package, fixes dependency paths so v3 crates point to each other (not back to latest)
5. Register — Adds the new crates to the workspace members or exclude in the root Cargo.toml

If anything goes wrong at any step, the tool rolls back — deletes the newly created directories and leaves the repo clean.

The Wrapper Script

In practice, devs don't call the cut binary directly. There's a Python script (scripts/execution_layer.py) that wraps it and handles extra housekeeping:

CommandWhat It Does
cut v3Snapshot latest → v3, generate the v3 module, rewire the version router
generate-libRegenerate the version router (the big switch statement in lib.rs)
merge v2 v3Backport a fix from v3 into v2 (rewrite the git diff's paths and apply)
patch v3Show what changed in v3 since it was cut
rebase v3Delete v3, re-cut from current latest, re-apply v3-specific patches

Why This Matters

Without this system, Sui would face an impossible choice on every upgrade:

Option A: Update the VM and break replay of historical transactions → consensus fork.

Option B: Never update the VM → no improvements, no bug fixes, no new features.

The cut tool gives them Option C: freeze the old version, ship the new one, and let them run side by side. This is how Sui went from v0 all the way to the Bella Ciao VM rewrite without a single consensus-breaking moment.

TL;DR: The cut package is a copy-paste-and-rewire tool. It snapshots Sui's execution crates into frozen versions so the chain can upgrade its VM without breaking consensus. Four Rust files, zero blockchain logic, maximum impact.
Related: Want to understand what the new VM (Bella Ciao) actually looks like inside? Read Sui Bella Ciao — Inside the New Move VM.

If anything here is inaccurate, reach out on X @thepantherplus and I'll fix it.
Tool Location: sui-execution/cut/
Language: Rust (no framework, just clap + toml_edit)
Wrapper Script: scripts/execution_layer.py
Key Files: main.rs, args.rs, path.rs, plan.rs
Follow: @thepantherplus