NOYA

NOYA audit details

• Total Prize Pool: $65,000 in USDC
  • HM awards: $49,920 in USDC
  • QA awards: $2080 in USDC
  • Judge awards: $7,500 in USDC
  • Lookout awards: $5,000 in USDC
  • Scout awards: $500 in USDC
• Join C4 Discord to register
• Submit findings using the C4 form
• Read our guidelines for more details
• Starts April 26, 2024 20:00 UTC
• Ends May 17, 2024 20:00 UTC

⭐️ Note: NOYA platform will allocate 5% of all stars from the campaign to wardens who find valid vulnerabilities. This allocation will be proportional to their USDC rewards earned in the Code4rena competition, incentivizing thorough and diligent reviews of NOYA’s codebase.

Automated Findings / Publicly Known Issues

The 4naly3er report can be found here.

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

Overview

Noya smart contracts tests

This repo contains noya smart contract

Contracts

• Accounting manager : This contract is responsible for managing the deposits and withdrawals of the users, holding users shares as an ERC20 token and calculating its value based on a base token.
• Connectors : these set of contracts are responsible for the connection between the vault manager and the external protocols, it handles the deposits and withdrawals from the external protocols. They hold the assets and report the value of the assets to the vault manager.
• Omnichain Handler : these smart contracts are responsible for the connection between the vault manager and the external protocols on other chains. It handles the bridging to other chains and communication with those chains through Layer Zero infrastructure.
• Noya Value Oracle : this contract is responsible for calculating the value of the other tokens/positions that the connectors hold. The result is used by accounting manager to calculate the value of the shares.
• Noya Bridge and Swap handler : this contract is responsible for handling the bridging and swaps. We are using LiFi for this purpose but this contract is designed to be able to support other bridges and swaps in the future. Other contracts will be explained in the docs in detail.

Links

• Previous audits: https://docs.noya.ai/audits-and-risk/audits
• Documentation: https://docs.noya.ai
• Website: https://noya.ai/
• X/Twitter: https://twitter.com/NetworkNoya
• Discord: https://discord.com/invite/BGS5qX6fPj

---

Scope

See scope.txt

Files in scope

Files out of scope

See out_of_scope.txt

Scoping Q & A

General questions

ERC20 token behaviors in scope

External integrations (e.g., Uniswap) behavior in scope

EIP compliance checklist

Additional context

Main invariants

https://docs.google.com/document/d/1TRYK3Vpr6VsI9B3QLEiGQR-E-NAmTd3tHfwj8eWHf64/edit

Attack ideas (where to focus for bugs)

Integrity of the connectors interactions with the protocols (can we deposit and withdraw correctly) Fee mechanisms of noya

All trusted roles in the protocol

Running tests

git clone --recurse https://github.com/code-423n4/2024-04-noya.git
cd 2024-04-noya
yarn install
forge build
forge test
# To compare gas usage
forge snapshot --diff .gas-snapshot-init
# To generate lcov file
sh coverage.sh
# See slither.txt
slither . --foundry-out-directory artifactsFoundry

• Coverage report:

Miscellaneous

Employees of NOYA and employees' family members are ineligible to participate in this audit.