Security audit
Nethermind's independent review of Suno's smart contracts, its findings, and the final report.
Nethermind Security completed an independent review of Suno's smart contracts on September 14, 2026. The final report, NM-1010, covers protocol code at commit e1555fb.
Scope
The review covered 28 Solidity files, including the desk, uWatt, the Reserve, project contracts, staking, yield distribution, price oracles, the sUSDS adapter, and LayerZero cross-chain contracts.
The admission registry, disabled Axelar adapter, valuation engine, off-chain monitoring, custody practices, and legal agreements were outside its scope. The contract directory includes both audited and out-of-scope components.
Findings and follow-up
The review identified 12 findings: 1 High, 3 Medium, 5 Low, and 3 Informational. Eleven were fixed and one was mitigated.
The mitigated finding concerns the daily redemption limit. The fix prevents desk redemptions from reducing their own daily allowance, but privileged burns outside the desk still require operational coordination.
The audit assesses the specified code; it does not verify the underlying assets or guarantee against losses. Ongoing security also depends on accurate reporting, authorized operators, and external protocols. See Risks and protections.
Last updated
Was this helpful?