> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sundialprotocol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Status and security

> The stage each Sundial component has reached, and the audits, reviews and formal verification behind it.

## Where each component stands

| Component | Stage |
| - | - |
| [Yield Marketplace](https://docs.sundialprotocol.com/products/yield-marketplace.md) | Testnet |
| [Dawn](https://docs.sundialprotocol.com/products/dawn.md) | Audited |
| [Solstice](https://docs.sundialprotocol.com/products/solstice.md) | In development |
| [Sunbeam](https://docs.sundialprotocol.com/products/sunbeam.md) | Testnet |
| [Alchemy](https://docs.sundialprotocol.com/products/alchemy.md) | In development |
| [Sundial L2](https://docs.sundialprotocol.com/l2/overview.md) | Testnet |

## Audits and reviews

| Review | By | What it covered | Result |
| - | - | - | - |
| [Code review and security analysis](https://hacken.io/audits/sundial/dapp-sundial-btc-locker-apr2026/), April 2026 | Hacken | Dawn core: the [`btc-locker`](https://github.com/sundial-protocol/btc-locker) library that builds Dawn's Bitcoin scripts and transactions | 11 findings, none critical or high. All fixed. |
| [Dual Defense bug bounty](https://hackenproof.com/audit-programs/sundial-web-and-dapp-dualdefense-audit) | HackenProof | Dawn core | 2 bugs found. Both fixed. The program is ongoing. |
| [Independent review](https://github.com/yHSJ/charms-independent-review/blob/main/REVIEW.md) | Josh Marchand | Sunbeam's validators on the settlement L1 | All findings resolved. |
| [Formal verification](https://github.com/sundial-protocol/sundial-monorepo/tree/main/technical-spec) | IOG (Martin Ceresa, Jean-Frédéric Etienne, James Chapman) | Sundial L2 protocol: Lean 4 models of the linked lists, operator directory, scheduler, state queue, settlement, user events, hub oracle and proof protocol | Properties proven. Specification defects found by the modeling were filed and fixed. |
| [System log assurance](https://github.com/sundial-protocol/internal-docs/blob/main/system-log-assurance-report.md), May to August 2026 | Sundial | Sundial L2 node: four months of node, load-campaign, load-balancer and CI security-scan logs, assessed against ISO/IEC/IEEE 29119-3, NIST SP 800-92 and OWASP ASVS | Stability and security confirmed. No crashes, panics or out-of-memory events. |
| [STRIDE threat model](https://github.com/sundial-protocol/internal-docs/blob/main/compliance/threat-model-stride.md) | Sundial | Sundial L2 node: every trust boundary from API ingress to the settlement L1 | Completed |
| [Scalability and stress testing](https://docs.sundialprotocol.com/l2/performance.md), May 2026 | Sundial | Sundial L2 node under sustained load | 800 and 1,000 TPS sustained for 30 minutes with zero commitment or merge failures |
| [Software bill of materials](https://github.com/sundial-protocol/internal-docs/blob/main/compliance/sbom-runtime-packages.md), August 2026 | Sundial | Sundial L2 node, SDK and codec runtime dependencies | Completed |

## The L2 security model

The Sundial L2's security rests on operator bonds, watcher rewards, a maturity period and open data availability. [Security model](https://docs.sundialprotocol.com/l2/security-model.md) states the guarantees and the threat model.

## Reporting a vulnerability

Report issues through the HackenProof program or the [Sundial GitHub organization](https://github.com/sundial-protocol).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.