Security
The protocol's security model: audits, contract isolation, governance constraints.
Nolus Protocol prioritises security and is transparent about it: every contract address and balance is publicly verifiable on chain, the codebases are open-source, and the money-market and chain core have been audited by Oak Security and Halborn (reports below). On top of the audits the team runs a bug bounty for community researchers.
Audits
| Repository | Auditor | Report |
|---|---|---|
| Nolus Core | Oak Security | Audit report |
| Nolus Money Market | Oak Security | Audit report |
| Nolus Money Market | Halborn | Audit report |
Reporting a vulnerability
Email [email protected]. Do not open a public issue or PR for security matters - that's true for every Nolus repository.
The canonical policy lives at
nolus-protocol/.github/SECURITY.md;
the same text is mirrored below for convenience.
Scope
The bug bounty covers the Nolus blockchain, the smart contracts, and the webapp. It focuses on:
- Theft or freezing of principal funds
- Theft or freezing of unclaimed yields
- Disruptions to webapp uptime
- Unauthorized access to restricted pages
- Deletion or tampering with user data
Program details: hub.nolus.io article.
What to include in your report
- A clear description of the vulnerability and its impact.
- A reproducible proof-of-concept - code, transaction hashes, or a recorded video. Theoretical findings without a working reproducer will be closed.
- Affected versions, commits, or deployed addresses.
- A suggested fix, if you have one.
Response
Legitimate submissions get acknowledged and triaged within a reasonable timeframe. We reserve the right to close, without response, any report that appears to be spam, fabricated, speculative, LLM-generated without human verification, or otherwise not a good-faith disclosure.
Out of scope
- Social engineering of staff or users
- Physical attacks
- Volumetric denial-of-service against public infrastructure
- Vulnerabilities requiring privileged access you were never granted
- Findings in third-party dependencies without a working exploit against Nolus components
AI-assisted reports
AI tools are welcome as part of your research, but:
- Reports generated by LLMs or automated scanners without human verification will be closed without triage. If you used AI, confirm in writing that a human has reproduced and understood the finding.
- Reports that are paraphrased CVEs, raw scanner output, or speculative code analysis without a concrete Nolus impact will be closed.
- Submitting AI-generated spam reports may result in your account being blocked from the organization.
Safe harbour
Good-faith research that follows this policy will not result in legal action.
Contributing
Most Nolus-Protocol repositories are limited to organization members and explicit collaborators; external pull requests and issues on those repos are blocked at the platform level. Drive-by typo PRs, documentation tweaks, and trivial formatting changes are not accepted - they're typically airdrop-farming attempts. LLM-generated PRs or issues without human review are closed without triage.
If you want to contribute regularly, reach the team on
Discord. The full policy
lives at nolus-protocol/.github/CONTRIBUTING.md.