Find Sui Coin Capabilities: Match Objects to a Coin Type
Locate the TreasuryCap, UpgradeCap, metadata and regulated-coin controls associated with one Sui coin type using SlingZero’s supported audit workflow.

Illustration and design · SlingZero
A Sui coin type and its administrative objects are different identifiers. To investigate who can issue, upgrade or restrict a coin, start with the full type and match each relevant object to it. Creating another coin is not part of this investigation.
Establish the coin’s identity first
Record the network and complete package::module::TYPE identifier. Similar names and symbols can belong to unrelated types. Keep the package identifier separate from the IDs of capability and metadata objects: copying one into a field for the other produces an unreliable investigation.
The official Sui Coin Standard documentation explains the roles of TreasuryCap, metadata and regulated-coin controls. Use those object types as a map of questions, rather than assuming a single owner controls everything.
Concept illustration — Match each object to the coin type and the specific power it represents.
Inspect the supported audit workflow
Open Sui token checks for the intended network and review the available inspection inputs. This guide does not demonstrate a completed audit or transfer.
For each object returned by the tool or an independent explorer, record its object ID, complete type, current owner representation and the checkpoint or time of your observation. If a lookup cannot establish a capability, mark it unresolved. Absence from one interface is not proof that the capability was destroyed.
Match each object to the right question
| Object | Investigation question | | --- | --- | | TreasuryCap for the coin type | Where is the capability used for issuance, and how can the package expose it? | | UpgradeCap for the relevant package | Who controls package upgrades, under the current policy? | | CoinMetadata | Which record describes this coin, and is it mutable? | | Supported deny capability | Which regulated controls exist for this exact type? |
An address-owned object, a shared object and a capability wrapped inside another object need different interpretations. Do not turn every owner field into a statement that one wallet can call every privileged function. Package code and the access path to the object matter.
Produce an object map, not a launch checklist
Save one row per object with the evidence supporting its relationship to the coin. Separate confirmed observations from inferences. The resulting map should let another reviewer reproduce the lookup without needing a private key.
For the earlier creation workflow, use the Sui coin creator guide. This article’s output is the object map that supports later administration decisions, not a second set of creation instructions.
