Moonlight

Moonlight engaged Runtime Verification Inc. to conduct a 2-week review of the Moonlight core contracts, followed by 1 week of remediation support. The audit began on June 29th, 2026, with the objective of evaluating the correctness and security of the protocol, reviewing existing quality assurance measures, identifying potential vulnerabilities, and providing recommendations for improvements in terms of code, testing, and documentation.

The audit's primary focus is the UTXO-based privacy-channel contract, which implements a shielded deposit / private-transfer / withdrawal lifecycle secured by P256 UTXO-owner signatures and Ed25519 provider co-signatures, with a secondary focus on the channel-auth (Quorum Auth) contract that gates this activity via a 1-of-N provider signature threshold and owner-governed provider registry. Each actor (Admin/Owner, Pending Admin, Privacy Provider, UTXO owner, Depositor, Withdrawal recipient, Transaction submitter) has a specific, bounded set of capabilities, and verifying these bounds, including that a provider cannot redirect, reduce, or drop a signer's intended outputs, is central to the protocol's security. The review will also cover TTL maintenance across both in-scope contracts.

Runtime Verification's audit process began with a design review, where we familiarized ourselves with the protocol's role structure and contract architecture by reviewing documentation and the existing codebase, with the objective of identifying gaps in the role and permission model and providing recommendations on how to address them. Using the understanding developed during the design review, we conducted a manual code review of the contract implementation, comparing the implemented role capabilities and bounds against the intended design and security best practices. This was followed by a one-week period of remediation support, during which Runtime Verification worked with the Moonlight team to address identified issues and verify proposed fixes.