Sundae Labs Audit

Overview

Sundae Labs has reviewed smart contracts, programs that hold and move funds on a blockchain, written by other teams and published its findings as public audit reports. Those reports record the code Sundae Labs reviewed, the flaws they found, and whether each issue was resolved^1,2.

Sundae Labs is the Cardano software studio behind SundaeSwap, a token exchange, and its careers page lists security audits for other ecosystem projects as part of the team's work³. Its published client reports review contracts written in Aiken, a programming language for Cardano smart contracts^1,2.

Key Features

• Reports anyone can download. Sundae Labs publishes its client reports as PDFs, and the Crashr report, for example, names Pi Lanningham as its auditor¹.
• Clear goals before the code review. The Crashr report includes a high level mission statement developed with the client, then an informal and a detailed description of how the protocol works¹.
• Problems ranked by seriousness. Each issue in a Sundae Labs report gets an ID, such as CRASHR-001, a severity from Critical to Info, and a status showing whether the client resolved it¹.
• A record of exactly which code was checked. Sundae Labs reports pin the reviewed code to a commit hash, a unique fingerprint for one snapshot of the code, and list a hash for each reviewed file^1,2.
• Notes on what turned out safe. "Witness" findings record unusual edge cases the auditors considered and found to be safe, so readers see ruled-out risks alongside the bugs¹.

What to Expect

For people using a Cardano app. Sundae Labs' published reports let users of client apps see what the auditors checked and what the developers fixed. Published reports cover a fiat-backed stablecoin, a token meant to hold the value of a traditional currency, from Mehen⁴, and a token sale by Butane⁵. They also cover NFT listing and offer contracts for Jam On Bread⁶ and NFT lending contracts for JPG Store⁷. Other reports cover an order book, which matches buy and sell offers, for Crashr¹, and index portfolios holding a target distribution of tokens that rebalance as prices move, for Metera². Client documentation also credits the team: Crashr's docs state its smart contracts were audited by Sundae Labs⁸, and Indigo Protocol lists an informal Sundae Labs review of its V2.1 release⁹.

For project teams. The Sundae Labs contact form does not list audits as a topic; enquiries about new work go through its general form under "New project" or "Partnership"¹⁰. The PALM Economy whitepaper describes the process a client went through: manual code review, automated testing, fixes agreed with the developers, and a follow-up audit¹¹.

For developers. Sundae Labs reports include a specification of how the protocol should behave, and most list the core rules it must never break. Sundae Labs also keeps its report template and the source of one client report in a public GitHub repository, which developers can study¹².