Security reviews of core network components #410 - Milestone 5: _(TOPO) Topology Protocol_

Milestone 5: _(TOPO) Topology Protocol_

• Scope: The Topology API provides the topology information to all protocols on all layers of Canton (orderer, transaction, auth, reassignment, commitment, etc.), but uses the other protocols in order to establish consensus on the topology state (participants, sequencers, mediators, parties, keys, packages, etc.) at any point in time. The topology protocol has been reviewed before, but recent and upcoming changes around scalability (caching, lazy-loading) and multi-synchronizer support require a renewal of the security audit. While some of the changes are still in-flight, the audit grant is being requested in anticipation of the successful completion of the given projects in Q3.
• Estimated Delivery: Q1 2027
• Estimated Effort: 21PW
• Selected Independent Auditor: RFQ

| Milestone | Description | Amount | Note | |---|---|---|---| | _(TOPO) Topology Protocol_ | Audit 5 | 1,130,000 CC | For DA upon completion of audit and remediation of all high-severity findings, and an approximate budget of up to 350,000 CC for the third-party auditor.This section can be repeated multiple times if additional audits are required. |

Total Funding Request: 6,420,000 CC for DA and a budget of up to 3,850,000 CC for the 11 third-party audits.

_Originally posted by @pedrodneves in https://github.com/canton-foundation/canton-dev-fund/issues/410#issuecomment-4907979799_