World-Class Operational Security

Smart contracts can be perfect while the organization around them leaks. How Noon secures the humans, machines, and processes that manage the protocol.

Prevent

Smart contract audits answer a critical question about code integrity, but they cannot evaluate human operations. How are signing keys stored? What prevents key compromise, phishing, or insider threats? How are transactions verified before execution?

For a protocol managing institutional reserves, operational security (OpSec) is a continuous discipline. Noon maintains a comprehensive Operational Security Policy, reviewed quarterly and updated after any material infrastructure change. This page details the signing mechanics, key management controls, transaction workflows, and SEAL Framework evaluations that protect Noon’s off-chain infrastructure.

1. Segregated Signing Systems

Noon runs two strictly isolated signing architectures. To eliminate single-system reliance, no single device or credential set can sign across both systems:

• Signing System 1 (Infrastructure & Technical Operations): Controls smart contract upgrades, protocol timelocks, emergency circuit breakers, whitelist parameters, mint/redemption caps, and oracle management.

• Signing System 2 (Treasury & Strategy Management): Controls fund movements, strategy rebalancing, yield harvesting, and treasury transfers across the Insurance, Operations, Community, and Ecosystem Funds.

Each system maintains separate access keys and distinct operational execution workflows.

2. Signer Quorum & Geographic Distribution

Vaults and administrative roles are organized into risk tiers, with high-criticality actions requiring strict multi-party supermajority quorums. Beyond raw threshold counts, signer sets are bound by strict organizational and physical distribution rules designed to neutralize supply-chain attacks, physical coercion, and regional internet outages:

• Organizational Independence: Signer sets are distributed across teams to prevent single-point-of-failure insider risk.

• Geographic Dispersion: Key signers are geographically distributed across multiple legal jurisdictions.

• Hardware & Device Diversity: Signing devices span multiple independent hardware vendors and architectures to prevent single-manufacturer supply-chain exploits.

• Air-Gapped Key Custody: Signing keys reside exclusively on dedicated, air-gapped hardware security modules (HSMs) and physical signers used for no other purpose. Physical backups are secured in geographically separated physical vaults under strict access controls.

Signer Onboarding & Rotation Lifecycle

• Controlled Onboarding: New signers undergo rigorous identity verification, live out-of-band authentication, and mandatory quarterly OpSec training.

• Periodic Rotation: Signing keys are rotated periodically across administrative roles.

• Offboarding Integrity: Departing signers are replaced prior to credential removal, ensuring quorum requirements remain continuously intact while old keys are immediately revoked.

3. Transaction Execution & Signing Protocol

Before any signer approves an administrative or treasury transaction, it must clear a mandatory three-step verification pipeline:

1. Out-of-Band Confirmation: The request must be authenticated over a dedicated, out-of-band communication channel isolated from primary team communication tools.

2. Independent Parameter Audit: Every signer independently inspects call data, target addresses, chain IDs, nonces, and transaction hashes.

3. Simulation Review: Transaction simulations are verified on-chain to ensure execution outcomes match communicated parameters exactly.

If a discrepancy occurs at any stage, execution halts immediately and the Signing System Owner initiates a formal review before any keys are applied.

4. Timelocks & Emergency Controls

• 48-Hour Public Upgrade Timelocks: All non-emergency contract updates are subjected to a public 48-hour timelock, allowing the community to inspect code changes prior to execution.

• Circuit Breakers & Emergency Pauses: Authorized security roles can pause minting, redemptions, staking vaults, or $USN transfers instantaneously. Emergency pauses cannot move or redirect funds; they function exclusively as a non-destructive containment measure.

• Address-Book Safeguards: Adding new strategy counterparties or venues to Noon's Treasury Signing System requires a multi-party supermajority approval and a mandatory low-value test transaction.

5. 24/7 Monitoring & Incident Response Integration

Noon maintains round-the-clock infrastructure monitoring integrated with automated PagerDuty escalation:

• Monitored Vectors: Contract events, reserve drift, oracle price deviation, bridge messaging delays, protocol TVL shifts, and venue risk alerts.

• Tiered Response Escalation: Critical alerts trigger immediate automated containment mechanisms and rapid multi-sig quorum assembly.

• Freeze-First Philosophy: Played out across defined playbooks (for key compromise, DNS hijacking, or venue insolvency), the operational directive is simple: pause first, investigate second. Because pause mechanisms are reversible and cannot move funds, fast containment carries zero capital risk.

6. SEAL Framework Evaluation & Scorecard

While smart contract audits verify code, operational security requires evaluating execution procedures. Noon assessed its Operational Security Policy against the Security Alliance (SEAL) Certification Framework —the Web3 benchmark for multisig security and incident response. Noon prioritised the Multisig Operations and Incident Response Frameworks for Operational Security, and will continue to progress through the remaining Certification Frameworks as we grow and scale.

After an internal audit against these 2 SEAL Certification Frameworks, Noon achieved an evidence-backed rating with zero critical gaps:

Note: The four partial ratings reflect planned infrastructure scale-outs as Noon grows (including expanded dark-web breach monitoring and secondary backup infrastructure scheduled against TVL growth milestones).

Document: NoonOperational Security Policy — Internal Audit v1

Framework: SEAL Certification Framework (Link)

Internal Audit Summary: Link