Security policy

The Nolus security policy sets out how to report a vulnerability, what the bug bounty covers, which audit reports are public and how security researchers can request access to the source code. Report security issues by email to [email protected].

Every contract address and balance on Nolus can be verified publicly on chain, and beyond the independent audits listed below, the team runs a bug bounty for community researchers.

Audits

Oak Security has published audit reports for Nolus Core and the Nolus Money Market, and Halborn has published one for the Nolus Money Market:

Scope

The bug bounty covers all Nolus components and focuses on the following impacts:

• Theft or freezing of principal funds
• Theft or freezing of unclaimed yields
• Disruptions to webapp uptime
• Unauthorized access to restricted pages
• Deletion or tampering with user data

Out of scope

The bug bounty does not cover the following:

• Social engineering of staff or users
• Physical attacks
• Volumetric denial-of-service against public infrastructure
• Vulnerabilities requiring privileged access you were never granted
• Findings in third-party dependencies without a working exploit against Nolus components

Report a vulnerability

Send every security report by email to [email protected], and do not open a public issue or pull request for security matters in any Nolus repository.

What to include in your report

Include the following in your report:

• A clear description of the vulnerability and its impact.
• A reproducible proof of concept, such as code, transaction hashes or a recorded video. Theoretical findings without a working reproducer will be closed.
• The affected versions, commits or deployed addresses.
• A suggested fix, if you have one.

AI-assisted reports

AI tools are welcome as part of your research, provided that a human verifies the finding before it is reported. Reports generated by LLMs or automated scanners without human verification will be closed without triage, so if you used AI, confirm in writing that a human has reproduced and understood the finding.

Reports that are paraphrased CVEs, raw scanner output or speculative code analysis without a concrete Nolus impact will also be closed, and submitting AI-generated spam reports may result in your account being blocked from the organization.

Response

Legitimate submissions are acknowledged and triaged within a reasonable timeframe. Nolus reserves the right to close, without response, any report that appears to be spam, fabricated, speculative, LLM-generated without human verification, or otherwise not a good-faith disclosure.

Request access to source code

The volume of AI-generated reports led Nolus to make most of its source repositories private. Legitimate security researchers can still review the code by requesting access:

1. Email [email protected] with a basic introduction of your work in the security field and a link to your public GitHub account with contributions.
2. Wait for the reply, which Nolus sends within 5 business days.
3. Approved researchers receive time-limited read access to the repositories.

Findings from that review go through the same reporting process as any other report.

Safe harbor

Good-faith research that follows this policy will not result in legal action.