Notional Finance
DAMASCUSFixed Rate Lending · Ethereum + Arbitrum · $200M+ TVL · 10 contracts
Confidence 65%Z-Factor 0.79Updated 2026-05-17Public Score
Public risk assessment — scores are produced with the same methodology as monitored protocols
771
BRI Score
3004756508251000
Security Profile
Access Control
75
75
Economic Soundness
70
70
Oracle Integrity
78
78
Compositional Risk
68
68
Governance
60
60
Maturity
72
72
Resilience
50
50
Supply Chain
80
80
Op Security
46
46
Cascade Exposure
100
100
Access Ctrl
75
75
Economic
70
70
Oracle
78
78
Compos.
68
68
Govern.
60
60
Maturity
72
72
Resilience
50
50
Supply Ch.
80
80
OpSec
46
46
Cascade
100
100
Min
46
Avg
70
Max
100
Audit History
Certora (Formal)
2022-06
Sherlock Competition
2023-01
Code4rena
2022-01
Bug Bounty Program
$250,000
Max payout on Immunefi
Assessment
Specialized fixed-rate lending with unique fCash instrument. V1 issues led to proper V2 redesign (shows learning). Moderate maturity for current version. Novel economics (D2=70) and complexity are the main drags.
Dimension Breakdown
How scores work →Access Control
Weight 18%72% conf
75
arrow_forwardGood
+19Lending market with admin-controlled parameters
+19fCash (fixed-rate) positions managed through protocol
+19Liquidation permissionless and well-defined
+19V2 had global settlement capability (emergency admin)
receipt_longView provenance chainarrow_forward
Economic Soundness
Weight 13%68% conf
70
arrow_forwardGood
+18Fixed-rate lending via fCash instrument is novel
+18Interest rate curve and settlement mechanics are complex
+18V1 had economic design issues (migrated to V2 redesign)
+18Prime lending (V3) adds variable-rate with different model
receipt_longView provenance chainarrow_forward
Oracle Integrity
Weight 13%75% conf
78
arrow_forwardGood
+20Chainlink oracle dependency for collateral pricing
+20fCash valuation uses internal interest rate model
+20Time-dependent valuation adds oracle timing sensitivity
+20Settlement price is critical trust point
receipt_longView provenance chainarrow_forward
Battle-Tested Maturity
Weight 12%72% conf
72
arrow_forwardGood
+14V1 live 2021, V2 2022, V3 (Prime) 2023
+14V1 had issues leading to redesign (good: learned and fixed)
+14~36 months for V2+, continuous evolution
+14Audited by multiple firms (Sherlock contest, Code4rena)
receipt_longView provenance chainarrow_forward
Governance & Upgradeability
Weight 10%68% conf
60
arrow_forwardModerate
+15NOTE token governance with active proposals
+15Governance controls market parameters and listings
+15Timelock on governance actions
+15Moderate participation rate
receipt_longView provenance chainarrow_forward
Adversarial Resiliencelock
Weight 10%30% conf
50
Concerning
- No validated adversarial findings — score set to neutral baseline
Operational Security
Weight 10%50% conf
46
arrow_forwardConcerning
-8No branch protection detected
-8No CI/CD pipeline detected
-8Minimal development activity (0 commits/month)
-8Incident response time not available (using commit frequency proxy)
receipt_longView provenance chainarrow_forward
Compositional Risk
Weight 5%70% conf
68
arrow_forwardModerate
+17fCash tokens composed in DeFi (limited adoption)
+17Leveraged vault strategy composes external protocols
+17Cross-currency lending creates composition surface
+17More bounded than general lending protocols
receipt_longView provenance chainarrow_forward
Cascade Exposure
Weight 5%50% conf
100
arrow_forwardExcellent
+50Member of 2 dependency cluster(s)
0No cross-protocol cascade exposure detected
0Score: 100/100 (higher = more isolated from systemic risk)
+50Source: cross_protocol_composition.json dependency analysis
receipt_longView provenance chainarrow_forward
Supply Chain
Weight 4%78% conf
80
arrow_forwardStrong
+20OpenZeppelin dependencies
+20Standard Solidity stack
+20Verified on Etherscan
+20Moderate dependency complexity
receipt_longView provenance chainarrow_forward
Risk Drivers
Primary risk factors driving this score, ordered by severity.
Operational Security46
Adversarial Resilience50
Governance & Upgradeability60
Adversarial Risk Signals
Observable security posture indicators. These signals reflect publicly verifiable information and responsible disclosure outcomes. No specific vulnerability details are exposed.
Disclosure HistoryNot Assessed
Remediation VelocityNot Assessed
Bug Bounty ProgramNot Assessed
Audit CoverageNot Assessed
Incident HistoryNot Assessed
Score History & Verification
Score provenance tracking begins with the next reassessment.
On-Chain Data
- Protocol Slug
- "notional"
- Oracle
- BRORegistry (Base)
- Evidence
- IPFS (pinned)
- Staleness Threshold
- 24 hours
Read Score
registry.getScore("notional")Reduce exploitable risk
BlackHart Monitoring provides continuous adversarial analysis, vulnerability detection, remediation support, and verified reassessment when your risk posture improves.