DamlSec by Dedaub: looking for a champion under Dev Fund 2.0

Hi all,

Amanda Martin suggested I bring this to the list. Our proposal, DamlSec, is now filed under RFP 22 as PR #971. The original PR #194 was closed on October 22 during the Dev Fund 2.0 transition after sitting in "Needs Champion" since July 28. We would like to find a champion and move it forward under the new process.

What it is. DamlSec is a static analyzer for Daml. It runs on a compiled .dar, explores every feasible path through each choice, and reports authorization, conservation, arithmetic and rounding, divulgence, and key/maintainer violations with concrete counterexamples, before a package is deployed or vetted. It is written in Scala on the same Speedy compiler pass as the Daml runtime, so Canton contributors can maintain and extend it, and it will be open source.

RFP fit. Primary: Daml Security Standards and Secure Development (the "automated analysis, security-focused linting or static analysis" deliverable). Secondary: Automated Application Management, because it needs no source code, so a validator operator or hosted party can check a third-party package before vetting it.

Who benefits.

• Daml developers: a CLI and GitHub Actions template that gate deployment on finding-free output.
• Validator operators and parties vetting packages: an independent, reproducible check on code they did not write.
• Auditors: systematic path coverage that manual review cannot provide. We will use it in our own Daml audits and publish the integration as a reference.
• Institutions evaluating Canton: a public baseline check on the contracts that will hold their assets.

If you lead or sit in the SIG that covers Daml security tooling, we would be glad to walk you through scope and milestones on a short call.

Thanks,
Giorgio Bonuccelli
Dedaub