Sui Move Smart Contract Tutorial: Deploy Secure NFT Contracts on Sui Blockchain 2026

#[test_only] Module: NFT Fixtures and High-Coverage Tests for Common Pitfalls

In smart contract development, rigorous testing is non-negotiable to prevent exploits like unauthorized minting due to missing signer checks or improper capability management. This #[test_only] module provides fixtures and comprehensive tests covering happy paths (e.g., admin minting and transfers), failures (e.g., invalid parameters, wrong signers), and pitfalls (e.g., cap misuse without signer verification). These tests are designed to achieve over 90% coverage—always verify with coverage tools before deployment.

```move
#[test_only]
module nft::nft_tests {
    use std::string::{Self, String};
    use sui::test_scenario;
    use sui::transfer;
    use sui::tx_context::{Self, TxContext};
    use nft::nft::{Self, NFT, AdminCap};

    const ADMIN_ADDR: address = @0xACE;
    const USER_ADDR: address = @0xBEEF;

    #[test]
    fun test_init_happy() {
        let scenario_val = test_scenario::begin(ADMIN_ADDR);
        let scenario = &mut scenario_val;

        {
            nft::init_for_testing(ADMIN_ADDR, scenario);
        };

        test_scenario::end(scenario_val);
    }

    #[test]
    fun test_mint_happy() {
        let scenario_val = test_scenario::begin(ADMIN_ADDR);
        let scenario = &mut scenario_val;

        // Setup: init module
        {
            nft::init_for_testing(ADMIN_ADDR, scenario);
        };

        test_scenario::next_tx(scenario, ADMIN_ADDR);
        {
            let cap = test_scenario::take_from_address(scenario, ADMIN_ADDR);
            let nft = nft::mint(&mut cap, string::utf8(b"Test NFT"), string::utf8(b"https://example.com/nft"), scenario);
            transfer::public_transfer(nft, ADMIN_ADDR);
            transfer::public_return(cap);
        };

        test_scenario::end(scenario_val);
    }

    #[test]
    #[expected_failure(abort_code = nft::E_NOT_ADMIN, location = nft)]
    fun test_mint_wrong_signer_missing_check() {
        // Demonstrates pitfall: mint function lacks signer verification, allowing unauthorized use if cap is shared
        let scenario_val = test_scenario::begin(ADMIN_ADDR);
        let scenario = &mut scenario_val;

        {
            nft::init_for_testing(ADMIN_ADDR, scenario);
        };

        test_scenario::next_tx(scenario, USER_ADDR);
        {
            let cap = test_scenario::take_shared(scenario, ADMIN_ADDR); // Assume erroneous public_share in production
            let nft = nft::mint(&mut cap, string::utf8(b"Test NFT"), string::utf8(b"https://example.com/nft"), scenario);
            transfer::public_transfer(nft, USER_ADDR);
            transfer::public_return(cap);
        };

        test_scenario::end(scenario_val);
    }

    #[test]
    #[expected_failure(abort_code = 0x1)] // Generic failure for invalid cap usage
    fun test_mint_invalid_cap() {
        let scenario_val = test_scenario::begin(ADMIN_ADDR);
        let scenario = &mut scenario_val;

        {
            nft::init_for_testing(ADMIN_ADDR, scenario);
        };

        test_scenario::next_tx(scenario, ADMIN_ADDR);
        {
            // Simulate invalid cap: no cap taken
            let nft = nft::mint(/* no cap */ string::utf8(b"Test NFT"), string::utf8(b"https://example.com/nft"), scenario);
            transfer::public_transfer(nft, ADMIN_ADDR);
        };

        test_scenario::end(scenario_val);
    }

    #[test]
    #[expected_failure(abort_code = nft::E_INVALID_NAME)]
    fun test_mint_invalid_params() {
        let scenario_val = test_scenario::begin(ADMIN_ADDR);
        let scenario = &mut scenario_val;

        {
            nft::init_for_testing(ADMIN_ADDR, scenario);
        };

        test_scenario::next_tx(scenario, ADMIN_ADDR);
        {
            let cap = test_scenario::take_from_address(scenario, ADMIN_ADDR);
            // Invalid name length or format
            let nft = nft::mint(&mut cap, string::utf8(b""), string::utf8(b"https://example.com/nft"), scenario);
            transfer::public_transfer(nft, ADMIN_ADDR);
            transfer::public_return(cap);
        };

        test_scenario::end(scenario_val);
    }

    #[test]
    fun test_transfer_happy() {
        let scenario_val = test_scenario::begin(ADMIN_ADDR);
        let scenario = &mut scenario_val;

        {
            nft::init_for_testing(ADMIN_ADDR, scenario);
        };

        test_scenario::next_tx(scenario, ADMIN_ADDR);
        {
            let cap = test_scenario::take_from_address(scenario, ADMIN_ADDR);
            let nft = nft::mint(&mut cap, string::utf8(b"Test NFT"), string::utf8(b"https://example.com/nft"), scenario);
            transfer::public_transfer(nft, USER_ADDR); // Transfer to user
            transfer::public_return(cap);
        };

        test_scenario::end(scenario_val);
    }

    // Additional tests for burn, etc., to boost coverage >90%
    #[test]
    fun test_burn_happy() {
        // Implementation similar to above: mint then burn
        abort 0 // Placeholder for full impl
    }
}
```

Deploy only after confirming all tests pass and coverage exceeds 90% via `sui move test --coverage`. Address any uncovered branches cautiously, as blockchain immutability amplifies the cost of errors. Regularly audit and expand tests for evolving threats.