Note SystemsDocumentation
HomepageEnter app
DocumentationRisk

Smart Contract Risk

2 min read
Documentation snapshot 18 October 2026. Deployment · Audit Status
On this page

Status

pending The external structured-note contract review is in progress. Its final report is not yet published on Audits. The web-surface report has a separate scope. Internal tests and reviews are not a completed independent contract audit. A defect can cause loss of all deposited assets.

Surface

fact Surface
ComponentNotes
NoteCore, NoteLegsEscrow and accounting for all series. A bug here can lose all escrowed USDG and Stock Tokens
OracleAdapter, MarketCalendarWrong price or wrong close acceptance
NOTE, sNOTE, Treasury, BondDepository, RevenueRouter, DeskToken engine; a bug can mint or misprice NOTE, misvalue reserves, or misroute fees
OpenZeppelin v5.1.0Battle-tested dependency for ERC-20, ERC-1155, ERC-4626, Votes, Pausable, ReentrancyGuard
Solidity 0.8.28, FoundryChecked arithmetic; custom FixedPointMath for WAD and bps operations

Design Choices That Reduce Risk

  • Immutable core, upgradeable periphery. NoteCore, NoteLegs, NOTE and sNOTE are immutable. Treasury, BondDepository, RevenueRouter and Desk use UUPS proxies under governance. Core replacement and periphery upgrades have different risks; see Upgradeability.
  • Pull payments only. No loops over holders, no pushes; each user pulls their own funds.
  • Reentrancy guards on every state-changing external function that transfers tokens.
  • Bounded parameters. Fees, haircut, discount, half-life, bump, fill cap and cooldown have compile-time maxima.
  • Governance can pause activity. A pause may delay strike or observation processing; unpaused exit functions still require an eligible recorded state. See Governance.

Design Choices That Add Risk

  • ERC-1155 transfer hook. NoteLegs calls back into NoteCore on every transfer. The hook is simple, but any contract calling into NoteCore from a token callback is a classic reentrancy surface; guards are in place and tested.
  • External token behaviour. Stock Tokens may have transfer restrictions, hooks or supply adjustments outside the protocol’s control. SafeERC20 is used throughout, but a token that reverts unexpectedly can block redemptions for that series.
  • Fixed-point exponential. ExpMath.halfLifeDecayWad is custom code; error bounds are tested but any error affects buyback pricing.
  • Governance actions with real teeth. Force-observe, cancel, calendar edits, treasury withdrawals. Bounded by delays and events, not eliminated.

Recommendations

  • Start with small positions and short-tenor series.
  • Verify the deployed bytecode against the published source and the addresses on the Addresses page before interacting.
  • Monitor Paused, StrikeDeferred, ObservationDeferred and governance proposal events.
A little more clarity?

Keep exploring, or revisit this topic from the navigation.