Five layers before your keys.
Zero trust in us.
Vault contracts are open, tested, and reviewed as production DeFi code. We're non-custodial by design, so HeirVault cannot sign asset movements from your vault even if the hosted app disappears.
Security
Five layers before your keys. Zero trust in us.
Vault contracts are open, tested, and reviewed as production DeFi code. Because HeirVault is non-custodial, the company cannot sign asset movements from your vault even if the hosted app disappears tomorrow.
Security review
OpenZeppelin libraries · public reports
Contracts use OpenZeppelin libraries where appropriate, with project review reports covering InheritanceVault, Factory, PremiumManager, MultiSig, CCIP relay, and documented CRIT-02 remediation tests.
Review reports in /docs/reviews
Formal verification
Halmos — 51 symbolic proofs
Mathematical proofs across 4 test files: invariants on heir shares, guardian caps, claim state machine, and pull-based withdrawal accounting.
halmos.toml · reproducible in 60 s
Static analysis
Slither · Aderyn · Mythril
Static-analysis output is part of release review alongside Foundry, fuzz, invariant, and Halmos checks. Findings are triaged in the repo instead of presented as a blanket clean-audit claim.
Analyzer output · human triage
Open source
MIT · GitHub · Verifiable bytecode
Every contract address links to Etherscan-verified source. You can fork the vault, audit it yourself, or run it from your own factory.
github.com/heirvault
Fuzz + invariant
10 000 runs · depth 64
Echidna-style invariant tests run 512 times at depth 64 before every mainnet deploy. Fuzz tests run 10 000 iterations per function.
forge test -vvv on every commit
Contract guarantees
Commit-reveal · pull-only · auto-unpause
EVM claim execution uses a 20-minute contract delay, and the app guides heirs through a 21-minute operational wait. Pull-based withdrawals reduce payout risk. EVM/TRON pauses auto-expire after 7 days; Solana pause is global and manual.
See InheritanceVault.sol
0
Funds custodied by HeirVault
100%
Non-custodial
51
Formal proofs passing
9
Live vault networks
Audit log
Not a one-time audit. A continuous one.
- 2026-Q1
Security review
CompleteOpenZeppelin libraries + project review reports
InheritanceVault, Factory, PremiumManager, MultiSig, and CCIPRelay use OpenZeppelin libraries where appropriate. Project review reports cover the CRIT-02 guardian-collusion remediation and the commit-reveal anti-frontrun window.
- Continuous
Formal verification
Halmos — 51 symbolic proofs passing
Invariants on heir shares (Σ = 10_000 bps), guardian budget caps, claim state machine, pull-based withdrawal accounting. Reproducible in under 60s on any commit via `halmos`.
- Every PR
Static analysis
Slither + Aderyn + Mythril — reviewed output
Static-analysis output is reviewed with Foundry, fuzz, invariant, and Halmos checks. Reports can contain triaged findings, so this is a release review process rather than a blanket clean-audit guarantee.
- Every release
Fuzz + invariant
10 000 fuzz runs · 512 invariant runs @ depth 64
forge test -vvv runs both suites before tagging a mainnet release. Any regression blocks deploy. Test harness mirrors the real factory deployment path end-to-end.
Contract guarantees
Written once. Enforced forever.
Pull-based withdrawals
Heirs pull their own share after execution. Claim execution snapshots assets before withdrawals, and state-changing paths with external calls are guarded rather than described as call-free.
Commit-reveal buffer
Every EVM claim has a two-step execution: commit, wait through the 20-minute contract delay, then execute. The app and recovery docs use a 21-minute operational buffer to avoid boundary failures.
Auto-unpause after 7 days
EVM and TRON vault pauses auto-expire after 7 days. Solana program pause is global and manual, so chain-specific recovery instructions matter.
Guardian caps (90d / 180d)
Guardians can extend your deadline by 90 days per check-in cycle and 180 days across the vault's entire lifetime. Permanent, on-chain.
Immutable clones (V1 / V2)
Your V1 / V2 vault is a deployed clone of the reviewed implementation. Nothing to upgrade, nobody can push changes to it.
Upgradeable with timelock (V3)
V3 beacon proxy announces every upgrade 7 days in advance. You have a full week to review and exit to an immutable clone if you disagree.
Non-custody
Zero keys. Zero override. Zero exit risk.
HeirVault the company has no custody key and cannot sign transfers from your vault. Emergency pause and upgrade paths are bounded by contract rules: EVM/TRON pauses auto-expire, V3 upgrades use a 7-day timelock, and VaultMultiSig proposals wait 3 days before execution. If the hosted app disappears, direct contract recovery remains the reference path for supported chains.
0
Funds held by HeirVault
Not now. Not in fiat. Not as custodian.
100 %
Protocol controls bounded
Pause and upgrade paths have explicit limits.
9
Live vault networks
Each deployment path is reviewed separately.
Don't trust us. Read the proofs.
Source, audits, formal-verification outputs, and the recovery playbook are all public. Fork it, run it, replace us.