Security reviews of core network components #410 - Milestone 7: _(DAMLe) Daml Engine_

Milestone 7: _(DAMLe) Daml Engine_

• Scope: The Daml Engine serves as the execution environment for the Daml Language, integrated into each Canton Participant node to interpret Daml-LF bytecode based on Topology data and the Active Contract Set. The last third-party security audit was conducted in 2023 as part of a broader Daml Language evaluation. This milestone will focus on an internal audit, comprehensive documentation of its internal mechanics and boundaries to facilitate independent reviews, direct assistance to third-party auditors, and the remediation of any discovered vulnerabilities.
• Estimated Delivery: EOY 2026 / Q1 2027
• Estimated Effort: 15PW
• Selected Independent Auditor: RFQ

| Milestone | Description | Amount | Note | |---|---|---|---| | _(DAMLe) Daml Engine_ | Audit 7 | 810,000 CC | For DA upon completion of audit and remediation of all high-severity findings, and an approximate budget of up to 350,000 CC for the third-party auditor.This section can be repeated multiple times if additional audits are required. |

Total Funding Request: 6,420,000 CC for DA and a budget of up to 3,850,000 CC for the 11 third-party audits.

_Originally posted by @pedrodneves in https://github.com/canton-foundation/canton-dev-fund/issues/410#issuecomment-4907992026_