# Audits

What has been reviewed, what was found and what is planned.

> **Status.** Noderr's contracts are internally audited. An independent third-party audit is planned for Q1 2027, ahead of the planned Q3 2027 mainnet. No third-party audit has been completed. See [Testnet Status](../../introduction/testnet-status.md).

## Internal audit (testnet)

The Noderr team reviewed the testnet deployment on Base Sepolia in Q4 2026. The contracts are also tested on testnet, and 15 contracts are verified on Basescan (Base Sepolia).

Scope:

- ERC-7540 vault contracts
- Governance contracts
- Oracle integration
- Node client software

### Findings

| Severity | Count | Status |
|----------|-------|--------|
| Critical | 0 | N/A |
| High | 0 | N/A |
| Medium | 2 | Resolved |
| Low | 5 | Resolved |
| Informational | 8 | Acknowledged |

Medium findings, both resolved:

| ID | Finding | Location | Fix |
| :--- | :--- | :--- | :--- |
| M-01 | Missing input validation in deposit | `ERC7540VaultBase.sol` | Added minimum deposit check |
| M-02 | Potential reentrancy in claim | `ERC7540VaultBase.sol` | Added `nonReentrant` modifier |

Low findings, all resolved:

- L-01: Missing event emissions
- L-02: Inconsistent error messages
- L-03: Unused state variables
- L-04: Missing zero address checks
- L-05: Floating pragma

The 8 informational items were gas optimizations, naming and documentation suggestions and style notes. They were acknowledged. Individual details are omitted here.

## Planned third-party audit

An independent third-party audit firm will be selected through an RFP. The report will be published once complete.

The planned scope is the full protocol:

- All smart contracts
- Node client software
- API security
- Infrastructure

Timeline:

- **Q4 2026:** testnet live on Base Sepolia (current phase), auditor selection and RFP.
- **Q1 2027:** audit execution and remediation.
- **Q3 2027:** mainnet launch.

Formal verification of critical functions is planned before mainnet.

## Bug bounty

Planned. The program will launch with mainnet.

| Severity | Reward Range |
|----------|--------------|
| Critical | $50,000 - $100,000 |
| High | $10,000 - $50,000 |
| Medium | $2,500 - $10,000 |
| Low | $500 - $2,500 |

In scope:

- Smart contracts on Base mainnet
- Node client software
- API endpoints
- Frontend security

Out of scope:

- Testnet contracts
- Third-party integrations
- Social engineering
- DoS attacks

Found something now? See [Report a vulnerability](./README.md#report-a-vulnerability) or email security@noderr.xyz.

## Next

- [Security model](./README.md)
- [Incident response](./incident-response.md)
- [Contract addresses](../smart-contracts/contract-addresses.md)