Status and security - Sundial Protocol

Where each component stands

Component	Stage
Yield Marketplace	Testnet
Dawn	Audited
Solstice	In development
Sunbeam	Testnet
Alchemy	In development
Sundial L2	Testnet

Audits and reviews

Review	By	What it covered	Result
Code review and security analysis, April 2026	Hacken	Dawn core: the `btc-locker` library that builds Dawn’s Bitcoin scripts and transactions	11 findings, none critical or high. All fixed.
Dual Defense bug bounty	HackenProof	Dawn core	2 bugs found. Both fixed. The program is ongoing.
Independent review	Josh Marchand	Sunbeam’s validators on the settlement L1	All findings resolved.
Formal verification	IOG (Martin Ceresa, Jean-Frédéric Etienne, James Chapman)	Sundial L2 protocol: Lean 4 models of the linked lists, operator directory, scheduler, state queue, settlement, user events, hub oracle and proof protocol	Properties proven. Specification defects found by the modeling were filed and fixed.
System log assurance, May to August 2026	Sundial	Sundial L2 node: four months of node, load-campaign, load-balancer and CI security-scan logs, assessed against ISO/IEC/IEEE 29119-3, NIST SP 800-92 and OWASP ASVS	Stability and security confirmed. No crashes, panics or out-of-memory events.
STRIDE threat model	Sundial	Sundial L2 node: every trust boundary from API ingress to the settlement L1	Completed
Scalability and stress testing, May 2026	Sundial	Sundial L2 node under sustained load	800 and 1,000 TPS sustained for 30 minutes with zero commitment or merge failures
Software bill of materials, August 2026	Sundial	Sundial L2 node, SDK and codec runtime dependencies	Completed

The L2 security model

The Sundial L2’s security rests on operator bonds, watcher rewards, a maturity period and open data availability. Security model states the guarantees and the threat model.

Reporting a vulnerability

Report issues through the HackenProof program or the Sundial GitHub organization.