Incident Response Plan

This document outlines the procedures for responding to security incidents in the Noderr Protocol.

Severity Levels

Level	Description	Response Time	Examples
P0 - Critical	Active exploit, funds at risk	Immediate	Smart contract vulnerability being exploited
P1 - High	Potential exploit, no active attack	< 1 hour	Vulnerability discovered, not yet exploited
P2 - Medium	Security issue, limited impact	< 24 hours	Access control misconfiguration
P3 - Low	Minor issue, no immediate risk	< 1 week	Documentation gap, minor bug

Response Procedures

P0 - Critical Incident

Immediate Actions (0-15 minutes):

Pause Protocol

Any Guardian node can execute emergency pause

Alert Team
- Page on-call engineer
- Notify all core team members
- Open incident channel
Assess Damage
- Identify affected contracts
- Estimate funds at risk
- Document attack vector

Containment (15-60 minutes):

Isolate Affected Systems
- Disable affected vault operations
- Block malicious addresses if identified
- Preserve evidence
Communicate
- Post status update on Discord
- Update status page
- Prepare user communication

Recovery (1-24 hours):

Develop Fix
- Create and test patch
- Security review of fix
- Deploy to testnet
Deploy Fix
- Multi-sig approval for upgrade
- Deploy to mainnet
- Verify fix effectiveness
Post-Incident
- Full incident report
- User compensation plan if needed
- Process improvements

P1 - High Severity

Assess vulnerability scope
Prepare mitigation plan
Deploy fix within 24 hours
Monitor for exploitation attempts

P2/P3 - Medium/Low Severity

Document issue
Schedule fix in next release
Update documentation if needed

Emergency Contacts

Core Team

Role	Contact	Availability
Lead Developer	[email protected]	24/7
Security Lead	[email protected]	24/7
Operations	[email protected]	Business hours

External

Service	Contact	Purpose
Chainlink	[email protected]	Oracle issues
Base	[email protected]	Network issues
Audit Firm	TBD	Security consultation

Communication Templates

Initial Alert (Discord/Twitter)

⚠️ SECURITY ALERT
We are investigating a potential security issue with [COMPONENT].
As a precaution, [ACTIONS TAKEN].
Your funds are [SAFE/AT RISK]. We will provide updates every [TIME].
DO NOT interact with [CONTRACTS] until further notice.

Status Update

📢 UPDATE - [INCIDENT NAME]
Status: [INVESTIGATING/CONTAINED/RESOLVED]
Impact: [DESCRIPTION]
Next Update: [TIME]
Actions taken:
- [ACTION 1]
- [ACTION 2]

Resolution Notice

✅ RESOLVED - [INCIDENT NAME]
The security issue has been resolved.
Summary:
- Root cause: [DESCRIPTION]
- Impact: [AFFECTED USERS/FUNDS]
- Resolution: [FIX DEPLOYED]
Full incident report: [LINK]

Runbooks

Pause Protocol

# Any Guardian can pause
cast send $VAULT_ADDRESS"pause()" --private-key $GUARDIAN_KEY# Verify pause
cast call $VAULT_ADDRESS"paused()"

Block Malicious Address

# Add to blocklist (requires ADMIN_ROLE)
cast send $REGISTRY_ADDRESS"blockAddress(address)"$MALICIOUS_ADDRESS --private-key $ADMIN_KEY

Emergency Withdrawal

# Admin can withdraw to safe address in emergency
cast send $VAULT_ADDRESS"emergencyWithdraw(address)"$SAFE_ADDRESS --private-key $ADMIN_KEY

Post-Incident Review

After every P0/P1 incident:

Timeline: Document exact sequence of events
Root Cause: Identify underlying vulnerability
Impact Assessment: Calculate affected users/funds
Response Evaluation: What worked, what didn't
Improvements: Process/code changes to prevent recurrence

Incident Response