Security
Every contract reviewed before it ships.
Sunima uses a three-layer security model: continuous internal review on every commit, a competitive public audit before mainnet, and a live bug bounty running indefinitely. Each deployed contract is source-verified on-chain and has passed our internal multi-pass review pipeline before touching funds. External independent audit is scheduled before mainnet — see the timeline below.
No single audit catches everything. Our model uses three independent layers with complementary coverage: one that runs on every commit, one that runs before mainnet, and one that runs forever.
Internal review pipeline
An automated audit pipeline runs on every contract before it is deployed or modified. It combines a retrieval-augmented pattern-matcher built on a corpus of 58K+ historical attack patterns with a separate zero-context cold-eye pass — the two passes see the contract without sharing context, so they can't reinforce each other's blind spots. This is an internal automated pipeline, not a substitute for external audit. Both passes must return zero findings at MEDIUM severity or above before a contract is approved for deployment.
- Pattern-matching against a corpus of 58K+ historical attack patterns (Immunefi / Code4rena reports)
- Separate cold-eye pass — zero shared context between passes
- All findings at MEDIUM+ are auto-required fixes, not optional
- Gate is binary — zero qualifying findings required to proceed
Code4rena competitive audit
Before mainnet deployment, the full contract suite will go through a Code4rena competitive audit: 20–50 independent security researchers competing to find issues over a 2–4 week window. This is the industry standard for DeFi security gating — it provides a named, public record of who looked, what they found, and what was fixed.
- 20–50 independent researchers in competition
- Public record of all findings and remediations
- Covers design-level issues that pattern matchers miss
- Required investor gating for a strategic raise / institutional participation
Immunefi live bounty
An Immunefi bug bounty runs continuously. It exposes the contracts to a global pool of 10,000+ security researchers on an ongoing basis — not for a fixed window, but indefinitely. Bounty tiers are calibrated to severity: critical vulnerabilities earn significantly more than theoretical issues, so researchers are incentivised to hunt the real risks.
- 10,000+ researchers, always on
- Calibrated severity-based payout tiers
- PoC required for payouts — prevents theoretical claims
- Bounty pool funded before mainnet launch
The internal gate and the external competitive audit are not substitutes for each other. The internal pipeline is our own automated review: it catches pattern-match class vulnerabilities within minutes of a commit, and blocks deployment on any confirmed MEDIUM+ finding. The external Code4rena audit — scheduled before mainnet, not yet run — covers design-level, cross-contract, and economic-attack surface that pattern-matching cannot reach. Both are required gates on the path to mainnet — not alternatives.
Every contract currently deployed on Arbitrum Sepolia passed the internal review pipeline before deployment. All are source-verified on Arbiscan or Sourcify — the bytecode you interact with matches the reviewed source.
| Contract | Internal pipeline | Blind review | Code4rena | Immunefi |
|---|---|---|---|---|
| SunimaVaultElGamal v0.7.1 | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| SunimaTFHEPredicates v3 (canonical) | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| SunimaTFHEPredicates v2 (legacy) | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| SunimaDefWallet | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| SunimaHub | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| SunimaCollectionPool | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| DefWalletAdapter | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| ElGamalVaultAdapter v2 | ✓ reviewed on deploy | ✓ reviewed on deploy | pre-mainnet | at launch |
| SunimaVaultPaillier | ✓ reviewed on deploy | — | pre-mainnet | at launch |
| Stage 4 — threshold-MPC custody contracts | in progress | in progress | pre-mainnet | at launch |
Stage 5 — x/operators (V4.2 family) |
✓ Shipped on testnet binary (current) | ✓ Independent multi-model LLM cold-eye jury | pre-mainnet | at launch |
Stage 5 — x/courtorder |
✓ Shipped on testnet binary (current) | ✓ Independent multi-model LLM cold-eye jury | pre-mainnet | at launch |
Stage 5 — x/turnstile · x/twomode |
✓ Internal pipeline + tests | in progress | pre-mainnet | at launch |
| Stage 5 — Halo2-KZG privacy layer | not yet written | not yet written | pre-mainnet | at launch |
| Milestone | Security gate | Status |
|---|---|---|
| Stage 1 — Paillier vault live | Internal pipeline | ✓ Complete |
| Stage 2 — EC-ElGamal + TFHE live | Internal pipeline + blind review on both contracts | ✓ Complete |
| Stage 4 — DefWallet + Hub + CollectionPool + Adapter live | Internal pipeline + blind review on all four contracts | ✓ Complete |
| Stage 4 — Threshold-MPC custody contracts | Internal pipeline + blind review on every deploy | In progress |
Stage 5 — Cosmos modules (x/operators, x/courtorder) |
Internal pipeline + independent multi-model LLM cold-eye jury consensus filter | ✓ Passed internal cold-eye review |
| Immunefi bug bounty (testnet) | Live bounty pool, researcher access to Arb Sepolia deployments | Pending activation |
| Code4rena competitive audit | Full contract suite, 20–50 researchers, public findings | Pre-mainnet |
| Mainnet launch | Zero open Critical/High findings across all three layers | Post-audit |
On choosing competitive audits over firm audits
The major audit firms — certification-focused shops with named reports and E&O insurance — have a structural problem: they assign a fixed team and a fixed time window, then issue a certificate. The certificate is valuable for regulatory optics. It is less valuable for finding bugs. Competitive venues like Code4rena pay researchers per finding, which means 20–50 independent minds are motivated to find things the others missed. That competition structure catches more.
Sunima's position: we want the bugs found, not the certificate. The Code4rena report becomes the investor-facing record. The Immunefi bounty becomes the post-launch continuous pressure. The internal pipeline becomes the fast CI gate that keeps obvious issues out of the expensive review queue.
This does not mean traditional firms are never appropriate. As Sunima moves past its pre-seed round toward mainnet, a reputable firm with a verifiable track record and published original security research may be added to the stack post-raise. That is a different product from a certification stamp — and no such engagement is contracted yet.
On source verification
Every contract deployed by Sunima is source-verified on Arbiscan or Sourcify immediately after deployment. If a contract is not source-verified, it is not considered shipped. This is a hard internal rule, not a best-effort. Source verification means the code you can read in the audit report is the code running on-chain — the bytecode matches.
This matters for audits: there is no point auditing source code that may differ from what is deployed. Sourcify and Arbiscan's verification mechanisms provide a cryptographic anchor between the reviewed Solidity and the deployed bytecode.
On the internal pipeline as a public claim
We mention the internal pipeline publicly because it is part of the security story — but with important caveats. An internal automated pipeline is not a substitute for external review. It is a CI gate that blocks deployment on known-bad patterns before expensive review bandwidth is spent on avoidable issues. Every deployment has a human review of the pipeline output before the deploy transaction is signed. The pipeline raises flags; humans decide.
The pipeline was trained on the same corpus the security community has published — Immunefi and Code4rena historical reports. It is good at finding past-pattern bugs. It is not good at finding novel design-level issues in new protocol designs. That is exactly what Code4rena is for.
The internal cold-eye gate — parallel multi-model jury. Every contract or module reaching the internal review gate is reviewed by an independent multi-model LLM cold-eye jury running in parallel, with a consensus filter: a finding raised by multiple jurors carries its maximum severity; a finding raised by only one juror is downgraded one severity step (likely false positive). The pattern-matching internal pipeline (trained on the Immunefi / Code4rena historical corpus) acts as a Solidity-pattern coverage check; on Cosmos-SDK Go modules the LLM jury is the primary signal. Solo auditing is no longer sufficient — the precedent that forced the jury rule was a 2026-05-08 review of CourtOrderGateway where a secondary juror caught two UX defects the primary missed. Any finding at MEDIUM consensus or above must be fixed and re-reviewed until the gate returns to clean before deployment.
Security researchers who discover issues in Sunima's contracts or off-chain components should report via Immunefi once the bounty program is live. Until then, send responsible disclosure to [email protected].
We respond within 48 hours. We do not pursue legal action against good-faith researchers who report issues before exploiting them. We credit researchers who find confirmed issues unless they prefer anonymity.
Whitepaper and architecture. The full technical description of Sunima's cryptographic design — EC-ElGamal balance arithmetic, TFHE predicate verification, threshold-MPC key management, and the matryoshka custody model — is available in the whitepaper and architecture overview. Auditors and researchers are encouraged to read both before reviewing the contracts.