Architecture

Not part of Sunima core. L1 is the display surface — a smart contract that reflects protocol state to users (balances, DEX, staking, NFTs). Analogous to an HDMI cable between monitor and computer. If L1 is breached, nothing valuable is exposed.

First defensive cell. Rate limits, reentrancy locks, basic signature validation. Weak by design — if an attacker breaks through, L3–L7 escalate the difficulty. Embedded agent observes and reports anomalies upstream to PRION.

Moderate hardness. Lightweight graph embeddings detect Lazarus-group fingerprints, structuring behaviour, and mixer-hop patterns. Borderline transactions are flagged for L4 deeper inspection.

Middle strength. OFAC list checks, terror-financing filters, known-drainer blocklists. Sub-millisecond Bloom-filter primary check; Tier-2 model escalation for borderline cases. Handles ~99% of black-market attempts.

Medium-strong. Routing layer — every request that reaches L5 has passed L1–L4 gates. L5 dispatches to the correct op-code (deposit, withdraw, transfer, shield) and forwards to L6/L7 for final settlement.

Strong (second to L7). Honeypot detection, blacklist enforcement, signed-note pre-validation for the fortress slit. Learns attack patterns from PRION and adapts rules in-flight.

Final gate before fortress. Provably-malicious addresses get their subsequent transactions reverted, their state frozen, their gas burned. L7 is where Sunima bites back — a counter-attack activation surface, not just a filter.

DEX, lending, staking, NFTs, scanners, business logic — all engines live here. Zero funds held. If an attacker fully breaches ops, they obtain computation logic but no custody. Complete ops compromise = zero loss.

All user deposits live here. Only read/write/verify primitives. No business logic, no user-defined code. The core receives signed notes through the slit and executes them mechanically. Nothing else.

Single channel between ops and core. Ops → Core: "credit X to user Y", "debit Z from user W". Core → Ops: "OK, credited" / "NO, reason." Signatures cryptographically verified — notes cannot be forged, replayed, or tampered.

The core's signing authority is sharded across N operator nodes via FROST keygen — Flexible Round-Optimized Schnorr Threshold MPC. A k-of-N quorum produces partial signatures that aggregate into a final Schnorr signature; the master key never exists at any single host during signing. 2-of-3 PoC verified on-chain on Arbitrum Sepolia (a proven on-chain proof-of-concept); a separate 3-of-5 onboarding-pipeline run exercised the operator flow. Both are non-production tests. Final committee size and threshold (production k-of-N) are determined at Stage 4 production deployment from operator-cohort coverage measurements rather than fixed at design time.

Vector classes at activation will include:
· permissionless node runners worldwide (Bitcoin-style — anyone can operate one)
· cold infrastructure — multi-chain smart contracts on independent L1/L2s
· wallet-derived shares for large depositors via HKDF ("HMAC-based Key Derivation Function")
· Sunima Foundation operational vectors (online and offline storage)

By design, no single actor — no validator cohort, no jurisdiction, no operator — can reach the threshold alone. Final allocation across vectors is ratified by the validator committee and the DAO at activation time, based on the actual size and topology of the network.

Design evolution. Earlier drafts framed this as Shamir Secret Sharing being replaced by FROST. That framing was wrong — the two coexist and do different jobs. FROST k-of-N is the routine signing authority described above: partial signatures aggregate into a final signature and the master key never materialises during normal operation. Shamir high-threshold reconstruction is the break-glass path for the core only — never touched in normal operation, with shares held locally and off chain, collected on chain solely during a declared emergency. That reconstruction is the deliberate, last-resort cost of a recovery path that does not depend on any live signing committee remaining reachable. The two are complementary, not competing: routine authority that never exposes the key, alongside an independent emergency recovery that survives the signing committee going dark.

Rust + Bloom filters. OFAC checks, known drainer lists, amount thresholds, rate limits. Sub-millisecond, zero cost. Handles the overwhelming majority of traffic without invoking the deeper review pipeline.

Lightweight models run locally on Sunima infrastructure. Graph embeddings detect Lazarus Group fingerprints, structuring, mixer hops, and known exploit sequences. Borderline transactions escalate to Tier 3.

Multi-model verification with independent cold-context review. The same engine that audits Sunima's own source code — in benchmarking it identified multiple critical findings that single-pass self-review had missed.

Embedded agents in each layer report suspicious traffic → PRION scores severity → if severe, PRION drafts a patch and tests it in sandbox → the patch passes through the four-gate deployment pipeline (independent re-audit by a second PRION instance, 3-of-5 sentinel quorum, on-chain PRIONPatchGateway timelock) → on full approval the layer evolves. No patch deploys autonomously. Attacker nodes continuously generate adversarial patterns, giving PRION fresh training material — but the training environment is a replica fortress, never production state. The defensive organism never stops learning; deployment authority stays with humans and on-chain timelocks.

PRION is the internal continuous layer. External scrutiny runs in parallel through two additional channels before mainnet: Code4rena competitive audit — a public contest where independent security researchers adversarially review the full codebase for a fixed bounty pool, producing findings the internal team cannot produce for itself; and Immunefi bug bounty — an ongoing economic pressure channel where the protocol pays for confirmed vulnerabilities at severity-graded rates. The combination covers the three failure modes that any single audit approach misses: systemic design flaws (Code4rena adversarial contest), implementation bugs under economic incentive (Immunefi), and continuous runtime threat detection (PRION). Bug bounty alone is not a security strategy. It is one of three coordinated layers.

CPU only. Fly above the system like observation drones. No defense capability — pure observers. Detect cross-layer patterns that individual layers cannot see. Decentralized witness set. Small stipend from emissions.

Not nodes — code modules inside every layer contract. Under-cover monitors watching traffic inside their host layer. Detect serious attack attempts → invoke PRION. Handle minor anomalies autonomously (rate-limit, reject, log). Escalate breaches to PRION's gated review pipeline; agent reports never bypass the four-gate deployment sequence.

GPU-required. Run PRION's Tier-2 and Tier-3 pipelines. Provide active defense — real-time scoring, patch generation, threat response. Rewarded in tokens for confirmed findings and for patches that survive the full four-gate review and ship to production.

GPU-required. Continuously attack a sandboxed shadow copy of the core to generate adversarial training data. Bounty-rewarded for any novel exploit found. Their output feeds PRION's learning loop — the defense organism trains against its own red team.

User signs request with wallet key → signal enters L1 → layers L2–L7 verify signature in parallel (milliseconds) → ops-room processes → if funds involved, note → slit → core → response propagates outward through L7 → L2 → L1 → user.

Each layer (L2-L7) marks the wallet with its own stamp on the return path. Six stamps form a complete fingerprint — a cryptographic reputation vector visible to the protocol. Frequent successful traversals strengthen the fingerprint over time.

Fingerprints are split across three storage vectors: part client-side (wallet), part on-chain public, part on-chain encrypted. Observers can see fragments — beginning, middle, or end — but never the full reputation path. Privacy preserved, integrity enforced.

Each stamp is cryptographically signed by its issuing layer's key. Forging one stamp is possible in isolation; forging six consistent stamps that align with the wallet's known history requires compromising all six layer-keys simultaneously — architecturally excluded by the independent-signer-set design.

Stage 1 — LIVE. 2048-bit Paillier keys. Supports on-chain addition of encrypted balances: E(a) + E(b) = E(a+b). No decryption required to update balances. Contract 0xe5254A5E...f7f86 on Arbitrum Sepolia processing real testnet transactions today.

Stage 2 — LIVE (closed). EC-ElGamal on BN254 is the fast path for balance arithmetic — additively homomorphic, runs through the EVM-native ecAdd/ecMul precompiles. Vault contract 0x3a0d9A52416847D984a17D0dBe849cdF6492209E (v0.7.1) on Arbitrum Sepolia, source-verified, transacting end-to-end. Measured live: cold deposit 151,368 gas (vs Paillier 1.9–2.3M, 12–15× reduction), withdraw 88,789 gas (vs ~1.6M, ~18×), encrypted transfer 222,318 gas (vs ~3.4M, ~15×). A guardian role gates pause()/unpause() only — bounded to a 30-day pause maximum with a 7-day cooldown, no custody, no drain path. Organizer key rotation is secured by a 3-day timelock with propose/accept/cancel. Every withdrawal requires a valid range-proof attestation from the Stage 3 TFHE worker — the two stages compose end-to-end.

Stage 3 — LIVE (closed May 2026). ● STAGE 3 LIVE The on-chain TFHE attestation verifier SunimaTFHEPredicatesV3 is deployed and source-verified on Arbitrum Sepolia at 0x1840e8E2EF53e8AaA846941aa628d7bd70E27396. The off-chain Rust worker on Zama's tfhe-rs v1.6.0 (not a fork) produces range-proof, encrypted-compare, and encrypted-conditional attestations and signs them under an EIP-191 envelope; the contract verifies the signature and replay-protects each consumed attestation by (consumer, ctHash, chainid, verifier, validUntil), rejecting expiry against block.timestamp. Op enum {EQ, GT, GTE, LT, LTE} with four envelope families on disjoint domain bytes (0x01–0x04). Measured: verifyAndConsumeRangeProof ~33K gas median (27K min · 56K max) over 1,050 calls. A guardian role gates pause()/unpause() only — bounded to a 30-day pause maximum with a 7-day cooldown, no custody, no drain path. Worker and guardian are distinct fresh keys; the constructor reverts if they collide. Self-hosted coprocessor — no trusted third party. The live Stage 2 ElGamal vault v0.7.1 requires a valid range-proof attestation on every withdrawal — encrypted-withdraw is live end-to-end. A legacy v2 verifier 0x9e11c984…88d6 remains immutably bound to a deprecated v0.7.0 vault for archaeology.

Note-commitment shielded deposits — commit-reveal scheme: commitDeposit(blindedHash) → wait ≥ 1 block → deposit(noteHash, nonce) → claim(secret, nullifier, recipient, amount, params). The blinded hash binds commitment to sender, preventing front-running. Deposits are unlinkable: withdrawal originates from a fresh address using a secret and nullifier held only by the depositor. SunimaHub (0x87ac801b9dED4e1409cdf186E299200370bcC8A7) — central router and TVL aggregator; thin adapter per vault (~50 lines each); single audit entry point for the full vault surface. SunimaCollectionPool (0xb456742B22697b86136bF9410cF20a0b51cC05A8) — epoch-based batch depositor: sweep() pushes all epoch notes in one transaction, amortising gas across depositors and enlarging the anonymity set per epoch. All contracts source-verified on Sourcify, 0 confirmed findings ≥ MEDIUM across automated and manual review.

Stage 4 prep — PoC verified end-to-end (May 2026). A FROST 2-of-3 threshold-Schnorr signing PoC has been verified across two independent trust domains against a test ElGamal vault on Arbitrum Sepolia. The withdrawal transaction was accepted by the on-chain Schnorr verifier — the master organizer key did not materialise at any single host. Migration of the production vault from the single-organizer signer to a permissionless threshold cohort is the remaining Stage 4 work; final committee size, threshold, and validator selection are set when Stage 4 closes. Built on the FROST round-optimised Schnorr-threshold scheme over secp256k1; Sunima's own coordinator daemon and proactive secret-sharing (PSS) timer are the remaining pieces.

k-of-N threshold Schnorr signing scheme for the fortress core authority. Operator shares distributed across permissionless nodes, cold hardware, whale-bound HKDF derivatives, and physical steel-plate backups. Requires a quorum from ≥3 distribution vectors. Partial signatures aggregate into a final signature without the master key materialising at any single host. Earlier drafts described this as a Shamir 67-of-100 reconstruction lock; that model has been replaced — see the fortress section above for the design-evolution note. Shamir Secret Sharing remains the underlying distribution primitive used by FROST keygen.

On-chain intake live on testnet (x/courtorder); FROST aggregation gated on mainnet. A legitimate petition is submitted as a signed on-chain message. The Cosmos-native x/courtorder module already accepts MsgRegisterOrder + disclosure + revocation transactions on sunima_8081-1 (passed independent cold-eye review). On mainnet, validator quorum votes on jurisdiction validity, legal sufficiency, and proportionality. On approval, a FROST k-of-N threshold-signing ceremony across the operator cohort produces an aggregated signature authorising decryption of exactly the record named in the petition — nothing else. The master key is never reconstructed.

Testnet live (sunima_8081-1); sovereign-chain hardening underway, Halo2-KZG mainnet privacy in development. Cosmos-SDK + CometBFT consensus, validator set bonded post the 2026-05-20 re-genesis. The x/operators, x/courtorder, x/turnstile, and x/twomode modules ship in-binary today. Mainnet privacy layer: Halo2-KZG shielded notes — protocol-level, not EVM ("Ethereum Virtual Machine") contracts, and with no TFHE in the path. The Stage 1–4 Solidity contracts on Arbitrum Sepolia proved the primitives and remain as reference. $SUNA gas token. Court Order Gateway logic already live at genesis through the Cosmos-native module.

Sunima does not invent new cryptography. Every primitive in this section is peer-reviewed and battle-tested as an individual primitive: Paillier (1999), Shamir Secret Sharing (1979), Zama tfhe-rs, FROST ("Flexible Round-Optimized Schnorr Threshold") signatures, EC-ElGamal on BN254, Penumbra-style MASP shielded pools. The composition of these primitives is original work and has not yet run in production. Original work is confined to the composition layer — the Matryoshka observability fabric, the Court Order Gateway protocol, the slashing model. Cryptography from scratch is a self-inflicted attack surface; composition is the discipline.

Stage 4 — planned, on top of FROST threshold MPC. Operators continuously partial-sign every court-order request they observe, locally, using their FROST signing share. A per-epoch VRF ("Verifiable Random Function") seeded by block_hash + epoch_number deterministically selects which partial signatures enter the final aggregation; the others are dropped at the protocol level. An operator cannot tell whether their share was used in any given disclosure — they simply always sign. Targeted-coercion attacks lose their target: there is no identifiable "the committee" to pressure, only post-hoc math selecting from a continuous stream. Committee membership rotates on a 24-hour base interval with a per-operator random offset of 1–23 hours.

Extends §8.2 of the Whitepaper. Every petition flows through two sequential 24-hour windows. Window 1 — review (24 h): automated checks (formal documentation, jurisdiction signature, scope boundaries) plus the FROST threshold vote on validity and proportionality. Window 2 — challenge (24 h): any party may file an on-chain dispute, contesting either the petition's legitimacy or its targeting. A dispute escalates to a stricter cross-vote that confirms or reverses the original outcome. Worst-case latency from petition arrival to disclosure is 48 hours. Scope is hard-bound by protocol: one order = one wallet, one period.

Every accepted or rejected petition is recorded on-chain: request, jurisdiction, case ID, per-validator threshold votes, final result. Publication timing follows the anti-correlation rules in Whitepaper §8.2 (randomised delay, batch posting, synthetic traffic) so investigations are not exposed in real time — but the audit trail is permanent, third-party-verifiable, and impossible to redact after the fact. Investigators know in advance that every petition leaves a public footprint, which acts as a built-in filter against fishing expeditions and abuse.