Thorough Incident Response Framework
What happens when an anomaly occurs? A pre-defined, battle-tested operational framework designed for rapid containment, zero-loss mitigation, and direct communication.
Protect
Safety is not just about building strong defenses. It is about being fully prepared for the unexpected. When security incidents, oracle anomalies, or venue exploits occur in Web3, delays caused by ad-hoc decision-making lead to compounding capital loss.
Noon operates on a pre-scripted Incident Response Framework. Every emergency playbook, role assignment, and circuit breaker is defined, assigned, and rehearsed before an incident ever occurs.
1. Preparedness & Role Allocation
Emergency response relies on unambiguous organizational structure. During an active threat or security alert, protocol governance transitions immediately to a dedicated Incident Command Team with clear operational domains:
Incident Owner: Holds primary decision-making authority, coordinates response execution across teams, and interfaces with legal counsel.
Protocol Engineering & Treasury Ops: Executes technical circuit breakers, analyzes call data, isolates compromised vectors, and manages strategy rebalancing.
Incident Scribe: Documents a real-time, timestamped audit log of all communications, system events, transaction hashes, and execution steps for post-mortem analysis.
Communications Lead: Authorizes direct, verified updates to the community across official protocol channels.
24/7 Automated Threat Monitoring
Noon maintains continuous, automated threat monitoring across all deployed networks, oracles, bridge endpoints, and custodial venues. Critical alerts trigger automated PagerDuty escalations to on-call engineering staff with rapid response SLAs.
2. The "Freeze First" Execution Protocol
The governing principle across all Noon security playbooks is absolute: Freeze first, investigate second.
Automated Detection: Real-time on-chain and off-chain monitoring systems continuously track contract events, oracle feeds, bridge routes, and custodial venue balances. Any anomalous transaction, price deviation, or unauthorized credential event automatically triggers an immediate, high-priority PagerDuty alert to the Incident Command Team.
Non-Capital Circuit Pause: Upon receiving a high-severity alert, authorized security roles trigger emergency circuit breakers to pause minting, redemptions, staking vaults, or token transfers. Crucially, emergency pauses cannot transfer, withdraw, or redirect user funds; they function purely as a non-destructive, zero-risk containment measure.
Threat Investigation: With protocol operations safely paused and user capital locked in place, the Incident Engineering team isolates the root cause, analyzes contract call data, verifies signer key integrity, and coordinates with external security auditors or custodial partners to assess the vector.
Recovery or Safe Resume: Once the threat is remediated—whether by executing a timelocked contract patch, rotating compromised credentials, or adjusting strategy parameters—the Incident Owner coordinates a structured, step-by-step unpausing of protocol functions to safely restore normal operations.
3. Transparent Communication & Security Reporting
Direct, Speculation-Free User Alerts
In an emergency, silence creates panic and misinformation. If an incident affects protocol operations or user interfaces, official disclosures are published directly by the team across verified channels:
Official Announcements: Updates are issued directly on the official Noon App, governance forum, and primary social channels.
Full Post-Mortems: Following any critical incident or near-miss, Noon publishes a complete, public post-mortem detailing root causes, financial impacts, remediation steps, and operational policy upgrades.
Responsible Vulnerability Disclosure & Bug Bounty
Security researchers and whitehats who discover potential bugs or vulnerabilities in Noon’s smart contracts, oracle integrations, or off-chain infrastructure are encouraged to report them responsibly.
How to Submit a Vulnerability Report
Email Contact: Submit security findings directly to
info@noon.capital.Report Payload: Include a detailed description of the potential vulnerability, affected contract addresses or endpoints, and reproducible Proof-of-Concept (PoC) scripts.
Disclosure Policy: Please refrain from public disclosure until the protocol team has evaluated, patched, and verified the issue on-chain.
Noon maintains an active bug bounty program, rewarding whitehat researchers for eligible, high-severity vulnerability disclosures submitted through official channels.
Security & Emergency Resources
🛡️ Security Incident Reporting:
info@noon.capital📑 Canonical Smart Contract Index: Contract Addresses & Oracles
Last updated
Was this helpful?