Norekt protectaurus

01 Product

Secure the path users actually trust.

Smart contracts get the audit budget. Attackers still hit the frontend: packages, keys in git, unlimited approvals, live JS that no longer matches review, and blind signing when UI ≠ payload. Norekt is frontend & supply-chain security for web3 — not a Solidity auditor.

02 Layers

One stack. Clear status on each layer.

We ship L1 first. L2 and L3 are real code with dogfood/pilot labels — not vapor.

L1 · PR Check

Deps, secrets, SRI, web3 patterns. App or Action. Source is data.

Shipped

L2 · Pre-sign

Decode what is about to be signed. Danger shapes + optional UI intent. Partner SDK.

Dogfood

L3 · Deploy

CDN asset hashes + DNS vs trusted baseline. Server-owned poller.

Pilot

L4 · Policy

Multisig / Safe risk, simulation gates. Enterprise later.

Roadmap

03 Story

When Norekt shows up for the team

Before merge

L1 on the PR

Check + Files annotations. Shadow by default. Policy from the default branch only.

Before the wallet

L2 sign sheet

Partner ships our SDK in their dApp. Pre-sign sheet on danger / UI≠payload — not a GitHub write.

After deploy

L3 watch

Enrolled asset URLs and DNS drift vs a reviewed baseline. Incomplete coverage is not green.

04 Layer 1

What the PR Check runs today

Area Codes Detects
Secrets W3-SEC-* Private keys, CI tokens — type / path / line only, never the value
Dependencies W3-DEP-* Lockfiles, OSV when enabled, unpinned protected packages
SRI / scripts W3-SRI-001 External scripts without integrity
Web3 patterns W3-W3-* Unlimited approve (incl. viem object form), eth_sign, localStorage → tx

Delivery: hosted App or your Action (same analyzer). Taxonomy: ATTACK_TAXONOMY.md.

05 Layer 2

Pre-sign intent — dogfood

Blind signing is when the user (or multisig) approves bytes that don’t match what the UI claimed. L2 decodes the signing request, checks danger shapes and optional declared intent. We do not claim to understand every contract on Ethereum.

01
Confirm in dApp User hits the trusted button
02
SDK intercepts Wallet request → verify()
03
Pre-sign sheet allow · warn · block · unknown
04
Wallet Only if they continue

What we flag (no full DeFi allowlist)

  • Danger Unlimited ERC-20 approve, legacy personal_sign / eth_sign
  • Mismatch Declared intent vs payload (to, amount, spender) — ATK-SIGN-001
  • Safe Known execTransaction with operation = delegatecall
  • Honest Incomplete coverage never pretends to be “safe”

Partner installs @norekt/sdk — not injected from GitHub, App still never gets contents: write. L2 alone does not stop Bybit; pair with L3 (+ often L4).

Docs: L2_INTENT.md · intent-verify, sdk, l2-demo

Norekt sign check warn

Review carefully. UI says send to Alice. Calldata recipient is Bob — UI ≠ payload.

UI claims
Send 50 USDC to Alice
Payload to
0x1111…1111 (Bob)
Decoded
transfer · 0xa9059cbb
W3-RT-001 · ATK-SIGN-001
UI≠payload: transfer recipient mismatch
Cancel Sign anyway

06 Layer 3

Deploy integrity (pilot)

Live HTTPS asset hash poll and DNS A/AAAA/NS vs an operator-owned baseline. Baselines are never auto-promoted from “current.” Fail closed when coverage is incomplete.

Docs: L3_MONITOR.md

Status

Protectaurus pilot

Scheduled poller on Fly. Design-partner domains only. Not a full production SOC claim.

Pilot

07 Scope

What Norekt is not

  • Out Solidity / smart-contract audit replacement
  • Out Full wallet simulation competitor as v1 (Blockaid-class)
  • Out Enrolling every DeFi address on Earth as the default model
  • Out “Stops Bybit” with L1 or L2 alone — layered defense only
  • Out Marketplace GA claims before precision gates

Start with the layer that ships today.

Install L1 on a frontend repo. Design partners can dogfood L2 SDK and L3 baselines next.

Install GitHub App Install guide Security model