Audits
What has been reviewed, what was found and what is planned.
Status. Noderr's contracts are internally audited. An independent third-party audit is planned for Q1 2027, ahead of the planned Q3 2027 mainnet. No third-party audit has been completed. See Testnet Status.
Internal audit (testnet)
The Noderr team reviewed the testnet deployment on Base Sepolia in Q4 2026. The contracts are also tested on testnet, and 15 contracts are verified on Basescan (Base Sepolia).
Scope:
- ERC-7540 vault contracts
- Governance contracts
- Oracle integration
- Node client software
Findings
| Severity | Count | Status |
|---|---|---|
| Critical | 0 | N/A |
| High | 0 | N/A |
| Medium | 2 | Resolved |
| Low | 5 | Resolved |
| Informational | 8 | Acknowledged |
Medium findings, both resolved:
| ID | Finding | Location | Fix |
|---|---|---|---|
| M-01 | Missing input validation in deposit | ERC7540VaultBase.sol | Added minimum deposit check |
| M-02 | Potential reentrancy in claim | ERC7540VaultBase.sol | Added nonReentrant modifier |
Low findings, all resolved:
- L-01: Missing event emissions
- L-02: Inconsistent error messages
- L-03: Unused state variables
- L-04: Missing zero address checks
- L-05: Floating pragma
The 8 informational items were gas optimizations, naming and documentation suggestions and style notes. They were acknowledged. Individual details are omitted here.
Planned third-party audit
An independent third-party audit firm will be selected through an RFP. The report will be published once complete.
The planned scope is the full protocol:
- All smart contracts
- Node client software
- API security
- Infrastructure
Timeline:
- Q4 2026: testnet live on Base Sepolia (current phase), auditor selection and RFP.
- Q1 2027: audit execution and remediation.
- Q3 2027: mainnet launch.
Formal verification of critical functions is planned before mainnet.
Bug bounty
Planned. The program will launch with mainnet.
| Severity | Reward Range |
|---|---|
| Critical | $50,000 - $100,000 |
| High | $10,000 - $50,000 |
| Medium | $2,500 - $10,000 |
| Low | $500 - $2,500 |
In scope:
- Smart contracts on Base mainnet
- Node client software
- API endpoints
- Frontend security
Out of scope:
- Testnet contracts
- Third-party integrations
- Social engineering
- DoS attacks
Found something now? See Report a vulnerability or email security@noderr.xyz.