Threat Model
What we mitigate today. What is open.
Every protocol has an attack surface. Most projects either pretend theirs is closed or refuse to publish one. Sunima publishes its threat model so investors, auditors, and integrators can see the same map we use internally — including the items we have not closed yet. Reviewed 2026-06-02; the audited contract surface is the 2026-05-06 redeploy, and the open-item list below is current as of this review.
This is an operational threat model for Sunima as it exists today: the Solidity contract surface on Arbitrum Sepolia (Stages 1–3 closed, Stage 4 partial — the privacy-deposit layer is live, the MPC custody coordinator is not yet production) plus the sovereign L1 testnet (Stage 5 — chain-id sunima_8081-1, Cosmos-SDK + CometBFT, x/operators + x/courtorder + x/turnstile + x/twomode modules live in-binary). It does not cover hypothetical mainnet bridges that have not been selected, the in-development Halo2-KZG mainnet privacy layer, or regulatory regimes that have not been applied to any privacy protocol. Where a risk is forward-looking we mark it explicitly.
No single defense is sufficient. The model below stacks six independent defenses; an attacker has to bypass several at once for a real loss. Each item links to artefacts you can verify yourself.
Pre-deploy audit gate
Every contract passes two independent reviews before deploy: PRION (RAG-based pattern-matcher with tens of thousands of indexed historical exploits drawn from DefiHackLabs, pashov/audits, Sherlock reports, SWC registry, and Halborn public reports) and Cold-Eye (zero-context full-context single pass). If either gate returns one finding at MEDIUM severity or higher, deploy is blocked. The 2026-05-06 redeploy went through 4 audit iterations and 9 confirmed real-bug fixes before iteration 4 returned 0 findings ≥ MEDIUM. The forge regression suite passed clean after fixes. Every redeployed contract is source-verified; six links below.
SunimaGovernancev1.0.2 · 0x739379…E5161 · Sourcify matchPRIONInvariantsv1.0.2 · 0xA85a52…56C17 · Sourcify matchPRIONPatchGatewayv1.0.5 · 0x9Fd67D…46Fd9 · Sourcify matchSunimaDefWalletv1.0.2 · 0x45748A…E889 · Sourcify matchSunimaCollectionPoolv1.0.2 · 0xb45674…05A8 · Sourcify matchDefWalletAdapterv1.0.2 · 0x3BF340…4c67A · Sourcify match
Write-time discipline
When writing or modifying a Sunima Solidity function the author runs an 8-point checklist: adversarial test suite, state-coverage table, gas-DoS check on storage loops, pricing/sorting math proof, prior-art diff for pattern reuse, line-by-line code trace on third-party findings, property-based fuzz tests on core invariants, and ABI/storage backward-compat audit before redeploying. The write-time discipline is the “during” control; the pre-deploy audit gate is the “before-deploy” control.
Defense in depth — Matryoshka
Architecture is layered like nesting dolls. Compromising the OPS room (operational keys) does not give access to the CORE room (treasury / master ceremony). Vault adapters are thin (~50 lines each) and ride on a single audited Hub. Each separation reduces blast radius — one compromised layer is not catastrophic. See architecture.
Encrypted state by default
Even if an attacker reads the entire chain, they do not see balances. Stage 1 vault uses Paillier-2048 homomorphic encryption; Stage 2 vault uses EC-ElGamal on BN254. State observability is fundamentally lower than on a public chain — chain-analysis attacks that work elsewhere do not work the same way here.
Multi-sig on critical operations
Governance, patch gateway, and treasury operations are all 3-of-5 (or 4-of-5 for rotation) Sentinel multisig with 24h main / 1h embedded / 72h rotation timelocks. There are no single-key admin functions on the new (post-2026-05-06) governance contract. The remaining founder single-key risk is documented as the top open item below.
Active monitoring — PRION
PRION runs continuously, not just at deploy. It indexes new exploit reports daily (DefiHackLabs, Pashov, Sherlock, Halborn, SWC) and re-evaluates risk patterns against the live deploy. CURARE on every CPU node feeds runtime telemetry into the same monitor. Detection beats reaction.
No protocol has zero attack surface. The list below uses the same lens external reviewers apply to crypto projects, with Sunima-specific corrections where general security checklists miss our particulars. Numbers are post-2026-05-06 redeploy.
| Threat | What closes it | Status |
|---|---|---|
| #1 Founder single-key | Hardware-isolated key + runbook; migrating to a 2-of-3 Safe multisig | Open · top priority |
| #2 Bridge inheritance | No bridge wired; per-tx / per-bridge caps + vetting at selection | Forward-looking |
| #3 TFHE worker (single signer) | Key ≠ guardian + EIP-191 replay binding; FROST 2-of-3 is the next step | Partial |
| #4 PRION ensemble integrity | 5+ model ensemble + reputation + cross-validation; sybil gating next | Active priority |
| #5 Contract bug post-deploy | pre-deploy audit gate + write-time discipline + full forge suite; Code4rena / Trail-of-Bits pre-mainnet | Compressed · residual |
| #6 Note-commitment correlation | Epoch batching widens the anonymity set; ZK-Merkle membership a Stage 4+ candidate | Known trade-off |
| #7 Small validator set (testnet) | 25K bond + probation + ante denylist + stale-link prune; jurisdictional diversity pending | Active · mainnet gate |
| #8 Social engineering | Small core, no contractor surface; standard hygiene on DNS / channels | Reduced surface |
| #9 Regulatory / jurisdictional | Legal-bridged disclosure doctrine; Foundation jurisdiction chosen for stability | Best-effort |
| #10 Token-mechanic exploits | Immutable cliff + 90-day sale-cap + 20-day VWAP floor + governance multisig | Standard · no ≥MED |
| #11 Halo2-KZG shielded notes | Reuse of the Ethereum Powers-of-Tau SRS (no own ceremony) + external circuit audit gate before mainnet | Forward-looking · in dev |
Quick map. Each row expands into the detailed card below — threat, mitigation today, open gap, status.
What: Founder EOA 0x61DA…1D9f currently holds admin/owner/guardian roles on 8+ live contracts simultaneously (CoreToken, Vesting, Governance, PatchGateway, Stage 2 Vault, DefWallet, CollectionPool, TFHE Predicates guardian-of-record). One compromise of that key is one compromise of nearly the entire admin stack.
Mitigation today: Hardware-isolated key storage; key never leaves an air-gapped device for any signing other than deploy. A written runbook governs every administrative action, and an emergency rotation procedure is documented internally.
Open gap: Migration to a 2-of-3 Gnosis Safe multisig is committed but pending founder hardware-procurement and seed ceremony. Until that lands, this is the single highest-impact, highest-likelihood vector.
Progress: 4-phase migration plan documented internally — target Safe topology, role-rotation calldata sequencing for all 8+ admin slots, and post-migration verification checks are all specified. No change since: still awaiting the hardware ceremony.
Status: Plan documented internally; physical setup pending.
What: Cross-chain deposit and withdraw flows depend on third-party bridges. Historically the largest losses in crypto: Ronin $625M, Wormhole $325M, Nomad $190M, Multichain $1.5B. Sunima does not build bridges; it consumes them.
Mitigation today: No bridge is wired in production. When one is selected, the criteria favour bridges with the longest clean operational record and the deepest validator decentralisation, with per-tx and per-bridge caps during any ramp-up.
Open gap: No bridge selection has been committed. When a bridge is selected, its security model becomes part of Sunima's security model — by inheritance, not by choice.
Status: Forward-looking; not part of the current attack surface because no bridge is live.
What: The off-chain Rust worker producing TFHE attestations is a single ECDSA signer. If the worker key is compromised an attacker can sign false range-proof / compare / conditional attestations against the on-chain verifier.
Mitigation today: Worker key is constructor-required to differ from guardian key (constructor reverts on equality). EIP-191 envelope binds (consumer, ctHash, chainid, verifier, validUntil) for replay protection. Guardian can pause for at most 30 days, with a 30-day usable-gap before the next pause and 48 h timelock on guardian rotation (post-2026-05-06).
Open gap: Single worker remains a single point of failure for signing. The replacement is FROST 2-of-3 threshold signing across independent operator domains, demonstrated end-to-end on 2026-05-01 but not yet wired into production predicate verification.
Status: Acknowledged single signer; FROST migration is the documented next step.
What: PRION's rule weights derive from accumulated audit submissions across nodes. Biased training samples could degrade ensemble accuracy in either false-positive or false-negative direction; production decisions made on degraded ensemble output would inherit that error.
Mitigation today: 5+ model ensemble across heterogeneous architectures. Reputation scoring down-weights low-accuracy nodes. Cross-validator confirmation on every audit finding before any fix is committed. Submission sandbox isolation enforced.
Open gap: Sybil-resistant submission gating, stake-weighted admission, and automatic anomaly detection on coordinated submission patterns are committed as the next design unit. The full security model is built under the assumption of adversarial submitters.
Status: Top design priority post-2026-05; sybil-resistant gating + N-of-M validator confirmation on high-impact training samples is the next concrete design unit.
What: Standard Solidity vulnerability classes — reentrancy, access control, integer overflow, upgrade-path bugs, governance attacks via flash loans.
Mitigation today: the pre-deploy audit gate (PRION + Cold-Eye), write-time discipline, the full Foundry forge suite (passing). Every adversarial finding becomes a regression test.
Open gap: No audit catches everything. Pre-mainnet adds Code4rena competitive audit and Trail-of-Bits review, layered on top of the audit gate and write discipline.
Status: Compressed but never zero. Insurance reserve is sized accordingly.
What: SunimaDefWallet uses a Tornado-style commit-reveal scheme: commitDeposit(blindedHash) at deposit, claim(secret, nullifier, recipient, amount) at withdrawal. Anonymity rests on the size and timing diversity of the in-flight commitment set. There is no client-side ZK Merkle membership proof today.
Mitigation today: CollectionPool epoch batching (sweeps every 1 h) widens the anonymity set per epoch. Multi-deposit support per epoch widens it further. Encrypted balance state means correlating amounts requires more than just timing.
Open gap: A patient observer with full chain access can correlate commitDeposit and claim events when traffic is sparse — a known limitation of any non-ZK note-commitment scheme. ZK-Merkle membership proofs are a candidate Stage 4+ addition if traffic ever stays sparse enough to make this exploitable.
Status: Documented design trade-off. Not a bug; a known anonymity-set sizing concern.
What: Cosmos-SDK chains with small validator counts have been halted by 1/3 Byzantine compromise (coordinated downtime, jurisdictional pressure on a few operators). This shape applies to sunima_8081-1 today: the active validator cohort is still being grown, and a coordinated halt of more than 1/3 would stop block production.
Mitigation today: Operator-program x/operators module enforces a 25,000 SUNA bond for new entrants, a probation window with a 50/50 reward intercept (V4.2-2b distribution replay), an ante-decorator denylist that blocks probation validators from crucial governance votes (V4.2-3), and stale-link prune in BeginBlocker (V4.2-4) — all passed internal cold-eye review. The Arbitrum Sepolia contract surface (Stages 1–4) inherits Arbitrum's sequencer and fraud-proof window independently of this set.
Open gap: Jurisdictional diversity is the missing leg. Path A 5-month probation onboarding plus the permissionless 25K-SUNA entry queue are designed to spread the set; outcome depends on how operators actually deploy.
Status: Active on testnet. Tracked as a Stage 5 mainnet gate (validator decentralisation requirement).
What: Phishing of team-member dev wallets, Discord admin compromise, domain hijacking, social compromise of the founder identity.
Mitigation today: Core team — no contractor / advisor / intern attack surface. Anonymous identity reduces targeted-attack profile. No third-party translators. No extended off-chain ops staff.
Open gap: Domain registrar (sunima.uk) and DNS infrastructure are single-point-of-trust today. Communication channels (Twitter, Discord) inherit platform-level risks.
Status: Smaller surface than a typical 30-person team. Not zero; standard hygiene.
What: Direct OFAC designation, validator coercion by national governments, Foundation jurisdiction U-turn freezing entity assets.
Mitigation today: Legal-bridged privacy doctrine — court-orderable selective disclosure makes Sunima less of a categorical sanctions target than a mixer. Foundation jurisdiction selection (Cayman / MIDAO research-tier) optimised for stability and BO non-disclosure.
Open gap: No protocol can fully insulate against geopolitical regime change. Validator coercion in a single jurisdiction is mitigated by jurisdictional diversity, which in turn requires a meaningful validator cohort.
Status: Best-effort mitigations; worst-case scenarios cannot be eliminated by code.
What: Vesting bypass via constructor-time initialization bugs, buyback front-running, governance attacks once DAO-controlled supply matures.
Mitigation today: SunimaVesting uses an immutable cliff + 90-day sale-cap. Buyback mechanism uses 20-day VWAP floor. Governance multisig guards the buyback executor key.
Open gap: Standard token-economic risks apply once SUNA is liquid. Flash-loan governance attacks become possible if DAO voting weight is staked-only.
Status: Standard category. No flagged contract-level finding ≥ MEDIUM today.
What: The mainnet privacy layer is built on Halo2-KZG shielded notes, which introduces the risk class specific to a zero-knowledge note system. A circuit-soundness bug could let an attacker forge a valid proof and mint or double-spend shielded value with no backing. A nullifier-derivation flaw could let one note be spent twice. A verifying-key mismatch on-chain could make the verifier accept proofs from an unaudited circuit. KZG also carries a structured-reference-string (SRS) trust assumption.
Mitigation (design): The KZG setup reuses the existing Ethereum Powers-of-Tau ceremony (80+ participants) — Sunima runs no ceremony of its own, so it adds no new trusted-setup assumption beyond one already relied on across the ecosystem. The note design follows the Penumbra spend/output pattern (not a code fork). The verifying key is fixed at genesis and changes only through governance. An external circuit audit is a hard gate before any mainnet candidacy, layered on top of the internal audit process.
Open gap: The layer is in active development and not yet deployed; its concrete soundness rests on the final circuit and its audit. Until that audit clears, the design is unproven in production.
Status: Forward-looking. Not part of the current attack surface — the live surface is the Stage 1–4 proof-of-concept contracts and the sovereign testnet. Becomes load-bearing at mainnet.
From the eleven layers above, three are simultaneously high-impact, high-likelihood, and within our direct control. The rest are either inherited (bridges), structural (regulatory), or already mitigated to acceptable levels.
Founder Safe Multisig migration
Replace the founder EOA on 8+ admin slots with a 2-of-3 Gnosis Safe across hardware wallets. Plan committed; physical setup pending. Highest single-action security improvement available right now.
FROST predicate signer (TFHE worker replacement)
Move single-signer authority to a threshold committee. The TFHE attestation signer this entry was written for lives in the closed Stage 3 research on Arbitrum Sepolia and is not carried to the sovereign network; the same requirement now applies to court-order disclosure, which moves to a threshold ElGamal committee. End-to-end FROST PoC verified 2026-05-01.
PRION sybil-resistance shell
Add stake-weighted submission gating + 2-of-3 cross-validator confirmation on high-impact training samples + anomaly detection on coordinated submission patterns. Closes the three known ensemble-integrity gaps from layer #4.
No protocol can guarantee zero incidents. The honest probability ranges below are first-principles estimates based on historical base rates for crypto protocols of comparable complexity. They are rough and they get revised when external audits and incident base rates change.
| Event class | 5-year estimate | Reasoning |
|---|---|---|
| Bridge inheritance loss | 50%+ | Statistical base rate across all major chains using mainstream bridges 2021-2025. |
| Smart contract bug found post-deploy | 20-30% | Compressed by the audit gate + write discipline + Code4rena + Trail-of-Bits + Immunefi continuous bounty. Not zero. |
| PRION ensemble-integrity attempt observed | 20-40% | Permissionless surface guarantees attempts; sybil-resistance shell determines whether attempts succeed. |
| Founder single-key compromise | drops sharply after Safe Multisig migration | Pre-migration: meaningful given the surface. Post-migration: same as standard 2-of-3 multisig hardware-wallet setup. |
| Social-engineering compromise | 10-20% | Smaller surface (no contractor / advisor / intern footprint) reduces base rate by roughly an order of magnitude versus a typical 20-50 person org, but does not eliminate it. |
| Fundamental cryptographic flaw | below 10% | All primitives are established (Paillier, EC-ElGamal on BN254 (EIP-196/197), TFHE via tfhe-rs, FROST via frost-core (RFC 9591)). Composition is novel; primitives are not. |
| Regulatory event materially affecting protocol | 10-40% | Wide range because outcome depends on policy choices that no one in the industry can predict reliably. |
These numbers are estimates. They are not measurements. They will move as audits land and as incidents in the broader market shift base rates.
Surviving an incident matters more than avoiding all incidents. Sunima is built for response, not just for prevention.
Treasury insurance reserve
A portion of the SUNA tokenomics is reserved for post-incident user reimbursement. Size is published in tokenomics; the reserve sits in a multisig with timelock, separate from operational treasury.
Pause & freeze paths
All vaults expose a guardian-controlled pause with a maximum 30-day duration, a 30-day usable-gap before the next pause, and a 48 h timelock on guardian rotation. Pause limits the blast radius without giving any single role unilateral indefinite control.
PRION patch path
If a real-bug fix needs to ship under timelock, PRIONPatchGateway (4-of-5 always for rotation, 3-of-5 for non-rotation, with founder veto until the immutable on-chain expiry) routes the patch through the invariants check first. Emergency patches must additionally appear on the emergency-eligibility allowlist set by governance.
Public post-mortem
Every confirmed incident gets a published timeline, root cause, code diff, and reimbursement status. No silent patching; no buried disclosures. The only reason a discovered issue would not be public is an active responsible-disclosure window before patch.