Audit Preparation Checklist
This document outlines the preparation required for the pre-mainnet security audit.
Documentation Requirements
Smart Contracts
- [x] Contract architecture diagram
- [x] Function-level documentation (NatSpec)
- [x] Access control matrix
- [x] Upgrade procedures
- [x] Emergency procedures
Protocol Design
- [x] ERC-7540 implementation specification
- [x] Validator selection mechanism
- [x] TrustFingerprint algorithm
- [x] Fee structure documentation
Deployment
- [x] Deployment scripts
- [x] Contract addresses (testnet)
- [ ] Contract addresses (mainnet) - TBD
- [x] Verification procedures
Code Quality
Testing
- [x] Unit tests (24/24 passing)
- [x] Integration tests
- [ ] Fuzzing tests (in progress)
- [ ] Formal verification (planned)
Coverage
| Contract | Line Coverage | Branch Coverage |
|---|---|---|
| ERC7540VaultBase | 95% | 90% |
| ValidatorFulfillmentManager | 85% | 80% |
| GovernorNoderr | 90% | 85% |
Static Analysis
- [x] Slither analysis
- [x] Mythril scan
- [ ] Certora prover (planned)
Known Issues
Document all known issues and accepted risks:
| Issue | Severity | Status | Rationale |
|---|---|---|---|
| Single admin key (testnet) | Medium | Accepted | Multi-sig for mainnet |
| No formal verification | Low | Planned | Scheduled for H2 2026 (pre-mainnet) |
Scope Definition
In Scope
contracts/
├── contracts/
│ ├── core/
│ │ ├── ValidatorFulfillmentManager.sol
│ │ └── GuardianWorkloadManagerV2.sol
│ ├── governance/
│ │ ├── GovernorNoderr.sol
│ │ └── TimelockController.sol
│ ├── tokens/
│ │ └── NODRToken.sol
│ └── vaults/
│ ├── base/
│ │ └── ERC7540VaultBase.sol
│ ├── ConservativeVault7540.sol
│ ├── ModerateVault7540.sol
│ ├── AggressiveVault7540.sol
│ ├── InverseVault7540.sol
│ ├── HedgedVault7540.sol
│ └── ConfigurableVault7540.sol
Out of Scope
- Node client software (separate audit)
- Frontend code
- Third-party dependencies (audited separately)
- Test contracts
Auditor Requirements
Expertise Required
- ERC-4626/ERC-7540 tokenized vaults
- OpenZeppelin upgradeable contracts
- Chainlink VRF integration
- DeFi protocol security
Deliverables Expected
- Full audit report
- Severity classifications
- Remediation recommendations
- Re-audit of fixes
- Final sign-off
Timeline
| Phase | Duration | Description |
|---|---|---|
| Preparation | 2 weeks | Documentation, code freeze |
| Initial Audit | 4 weeks | Full code review |
| Remediation | 2 weeks | Fix identified issues |
| Re-audit | 1 week | Verify fixes |
| Final Report | 1 week | Documentation |
Budget Estimate
| Item | Estimate |
|---|---|
| Initial Audit | $80,000 - $150,000 |
| Re-audit | $15,000 - $30,000 |
| Formal Verification | $50,000 - $100,000 |
| Total | $145,000 - $280,000 |
Contact Information
Technical Lead: dev@noderr.xyz Security Lead: security@noderr.xyz
Last Updated: December 2025