Redemption cannot be blocked
The withdraw path takes no admin check, no allowlist and no pause flag. A protocol pause stops new deposits and nothing else. This is structural, not a policy.
Security
Pre-audit, and saying so.
The contracts have not been audited. That sentence belongs at the top of this page rather than four paragraphs down, because a security page that implies more assurance than it has is worse than no security page.
Guarantees
What holds regardless of audit status.
These are properties of the contract structure, not promises about behaviour. They hold whether or not anyone at Nodal is acting in good faith.
Every change is visible first
Parameter changes are queued through a 48-hour timelock and emit on queue, not on execution — so the window to react opens when the intent is formed.
No upgrade proxy on the vault
Resonators are immutable once deployed. New strategies ship as new Resonators that depositors opt into, rather than as an upgrade underneath the ones they chose.
Exact allowances
Every approval the interface requests is for the amount of that action. There is no infinite-approval flow, and no delegate that can move funds later.
Status
Where the review actually stands.
Internal review
Full pass over Hook accounting and the share-price identity.
Invariant test suite
Fee accrual never subtracts, supply is conserved, redemption stays solvent — under fuzzing.
External audit
Scoped and scheduled. Report publishes in full, including anything it finds.
Public testnet
Open Resonators on Base Sepolia with faucet assets.
Bug bounty
Opens with the audit report. A bounty on unaudited code buys reports of what the audit was going to find anyway.
Mainnet deployment
Gated on the two above.
Disclosure
If you find something
Mail security@nodal.markets with enough detail to reproduce. You will get a human reply within 48 hours, an assessment within five working days, and credit in the disclosure log unless you would rather not have it.
Do not test against balances that are not yours. Nothing is deployed yet, so today that means reading the source rather than executing against it. When the testnet Resonators open, a proof of concept belongs there and not on anyone's real capital.
What is in scope
Anything that lets an attacker withdraw assets they do not own, mint Overtones without depositing, block or delay a redemption, or extract value from a batch by influencing its clearing price.
What is not
Gas inefficiency, missing events, and the centralisation the protocol page already names in full — including anything requiring a majority of the solver set. Those are real risks; they are just not undisclosed ones.
Bounty
Scale at launch.
What a confirmed report will pay once the programme opens. It is not open today.
Critical
$250k
Direct loss of deposited funds
High
$50k
Redemption blocked or delayed
Medium
$10k
Batch price manipulation
Low
$2k
Accounting drift, no direct loss
These figures are not live
The bounty opens with the audit report. Publishing a scale beforehand is a statement of intent, not a programme you can submit to today.
Verify it rather than trust it.
Source, tests and the audit report all publish in full — including whatever the audit finds.