Security

Sail’s security model is “a small trusted core that contains an open periphery.” Read it in three parts:

• Guarantees — the six properties the deployed bytecode provides.
• Limitations — what the protocol does not protect against, stated plainly.
• Octane security review — the three AI source-code security analyses, and how to report a vulnerability.

To report a vulnerability: hello@sail.money.

Caution

The trusted core and shared templates are deployed on 12 chains (10 mainnets + 2 testnets). The trusted core and the templates as they stood at the review were reviewed by Octane, an AI source-code security scanner, across three analyses; the final analysis found no critical- or high-severity findings. The later WithdrawPermission v2 rewrite is not covered (see Octane security review). A security review is not a proof of correctness — do not use with funds you are not prepared to lose.