Audit Reports

This page tracks all security audits conducted on the Noderr Protocol.

Audit Status

Testnet Audit (Current)

Scope

• ERC-7540 Vault Contracts
• Governance Contracts
• Oracle Integration
• Node Client Software

Findings Summary

Key Findings

Medium Severity:

1. M-01: Missing Input Validation in Deposit

   • Location: ERC7540VaultBase.sol
   • Status: ✅ Resolved
   • Fix: Added minimum deposit check

2. M-02: Potential Reentrancy in Claim

   • Location: ERC7540VaultBase.sol
   • Status: ✅ Resolved
   • Fix: Added nonReentrant modifier

Low Severity:

1. L-01: Missing Event Emissions - ✅ Resolved
2. L-02: Inconsistent Error Messages - ✅ Resolved
3. L-03: Unused State Variables - ✅ Resolved
4. L-04: Missing Zero Address Checks - ✅ Resolved
5. L-05: Floating Pragma - ✅ Resolved

Pre-Mainnet Audit (Planned)

Scope

Full protocol audit including:

• All smart contracts
• Node client software
• API security
• Infrastructure

Timeline

• H1 2026: Auditor selection and RFP
• H2 2026: Audit execution and remediation
• Q1–Q2 2027: Mainnet launch

Candidate Auditors

• Trail of Bits
• OpenZeppelin
• Consensys Diligence
• Spearbit

Bug Bounty Program

Launching with Mainnet

Scope

• Smart contracts on Base mainnet
• Node client software
• API endpoints
• Frontend security

Out of Scope

• Testnet contracts
• Third-party integrations
• Social engineering
• DoS attacks

Reporting Security Issues

Email: security@noderr.xyz

PGP Key: Available on request

Please include:

• Detailed description
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

Last Updated: December 2025