Audit Reports
This page tracks all security reviews and audits conducted on the Noderr Protocol.
Note: The current-phase ("Testnet") findings below are from an internal review by the Noderr team, not a completed third-party audit. The first independent third-party audit is scheduled for Q1 2027 (Pre-Mainnet).
Audit Status
| Phase | Status | Auditor | Date |
|---|---|---|---|
| Testnet (Base Sepolia, live) | Internal Review | Noderr Team | Q4 2026 |
| Pre-Mainnet | Scheduled (third-party) | TBD | Q1 2027 |
| Post-Launch | Planned (third-party) | TBD | Post Q3 2027 |
Testnet Internal Review (Current)
Scope
- ERC-7540 Vault Contracts
- Governance Contracts
- Oracle Integration
- Node Client Software
Findings Summary
| Severity | Count | Status |
|---|---|---|
| Critical | 0 | N/A |
| High | 0 | N/A |
| Medium | 2 | Resolved |
| Low | 5 | Resolved |
| Informational | 8 | Acknowledged |
Key Findings
Medium Severity:
M-01: Missing Input Validation in Deposit
- Location:
ERC7540VaultBase.sol - Status: ✅ Resolved
- Fix: Added minimum deposit check
- Location:
M-02: Potential Reentrancy in Claim
- Location:
ERC7540VaultBase.sol - Status: ✅ Resolved
- Fix: Added
nonReentrantmodifier
- Location:
Low Severity:
- L-01: Missing Event Emissions - ✅ Resolved
- L-02: Inconsistent Error Messages - ✅ Resolved
- L-03: Unused State Variables - ✅ Resolved
- L-04: Missing Zero Address Checks - ✅ Resolved
- L-05: Floating Pragma - ✅ Resolved
Informational: The 8 informational items (gas optimizations, naming and documentation suggestions, and style notes) were acknowledged; individual details are omitted here.
Pre-Mainnet Audit (Planned)
Scope
Full protocol audit including:
- All smart contracts
- Node client software
- API security
- Infrastructure
Timeline
- Q4 2026: Testnet live on Base Sepolia (current phase); auditor selection and RFP
- Q1 2027: Audit execution and remediation
- Q3 2027: Mainnet launch
Candidate Auditors
- Trail of Bits
- OpenZeppelin
- Consensys Diligence
- Spearbit
Bug Bounty Program
Launching with Mainnet
| Severity | Reward Range |
|---|---|
| Critical | $50,000 - $100,000 |
| High | $10,000 - $50,000 |
| Medium | $2,500 - $10,000 |
| Low | $500 - $2,500 |
Scope
- Smart contracts on Base mainnet
- Node client software
- API endpoints
- Frontend security
Out of Scope
- Testnet contracts
- Third-party integrations
- Social engineering
- DoS attacks
Reporting Security Issues
Email: security@noderr.xyz
PGP Key: Available on request
Please include:
- Detailed description
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
Last Updated: June 2026