Skip to content
Security · Audit · Formal proofs

Five layers before your keys. Zero trust in us.

Vault contracts are open, tested, and reviewed as production DeFi code. We're non-custodial by design, so HeirVault cannot sign asset movements from your vault even if the hosted app disappears.

Security

Five layers before your keys. Zero trust in us.

Vault contracts are open, tested, and reviewed as production DeFi code. Because HeirVault is non-custodial, the company cannot sign asset movements from your vault even if the hosted app disappears tomorrow.

Security review

OpenZeppelin libraries · public reports

Contracts use OpenZeppelin libraries where appropriate, with project review reports covering InheritanceVault, Factory, PremiumManager, MultiSig, CCIP relay, and documented CRIT-02 remediation tests.

Review reports in /docs/reviews

Formal verification

Halmos — 51 symbolic proofs

Mathematical proofs across 4 test files: invariants on heir shares, guardian caps, claim state machine, and pull-based withdrawal accounting.

halmos.toml · reproducible in 60 s

Static analysis

Slither · Aderyn · Mythril

Static-analysis output is part of release review alongside Foundry, fuzz, invariant, and Halmos checks. Findings are triaged in the repo instead of presented as a blanket clean-audit claim.

Analyzer output · human triage

Open source

MIT · GitHub · Verifiable bytecode

Every contract address links to Etherscan-verified source. You can fork the vault, audit it yourself, or run it from your own factory.

github.com/heirvault

Fuzz + invariant

10 000 runs · depth 64

Echidna-style invariant tests run 512 times at depth 64 before every mainnet deploy. Fuzz tests run 10 000 iterations per function.

forge test -vvv on every commit

Contract guarantees

Commit-reveal · pull-only · auto-unpause

EVM claim execution uses a 20-minute contract delay, and the app guides heirs through a 21-minute operational wait. Pull-based withdrawals reduce payout risk. EVM/TRON pauses auto-expire after 7 days; Solana pause is global and manual.

See InheritanceVault.sol

0

Funds custodied by HeirVault

100%

Non-custodial

51

Formal proofs passing

9

Live vault networks

Audit log

Not a one-time audit. A continuous one.

  1. 2026-Q1

    Security review

    Complete

    OpenZeppelin libraries + project review reports

    InheritanceVault, Factory, PremiumManager, MultiSig, and CCIPRelay use OpenZeppelin libraries where appropriate. Project review reports cover the CRIT-02 guardian-collusion remediation and the commit-reveal anti-frontrun window.

  2. Continuous

    Formal verification

    Halmos — 51 symbolic proofs passing

    Invariants on heir shares (Σ = 10_000 bps), guardian budget caps, claim state machine, pull-based withdrawal accounting. Reproducible in under 60s on any commit via `halmos`.

  3. Every PR

    Static analysis

    Slither + Aderyn + Mythril — reviewed output

    Static-analysis output is reviewed with Foundry, fuzz, invariant, and Halmos checks. Reports can contain triaged findings, so this is a release review process rather than a blanket clean-audit guarantee.

  4. Every release

    Fuzz + invariant

    10 000 fuzz runs · 512 invariant runs @ depth 64

    forge test -vvv runs both suites before tagging a mainnet release. Any regression blocks deploy. Test harness mirrors the real factory deployment path end-to-end.

Contract guarantees

Written once. Enforced forever.

  • Pull-based withdrawals

    Heirs pull their own share after execution. Claim execution snapshots assets before withdrawals, and state-changing paths with external calls are guarded rather than described as call-free.

  • Commit-reveal buffer

    Every EVM claim has a two-step execution: commit, wait through the 20-minute contract delay, then execute. The app and recovery docs use a 21-minute operational buffer to avoid boundary failures.

  • Auto-unpause after 7 days

    EVM and TRON vault pauses auto-expire after 7 days. Solana program pause is global and manual, so chain-specific recovery instructions matter.

  • Guardian caps (90d / 180d)

    Guardians can extend your deadline by 90 days per check-in cycle and 180 days across the vault's entire lifetime. Permanent, on-chain.

  • Immutable clones (V1 / V2)

    Your V1 / V2 vault is a deployed clone of the reviewed implementation. Nothing to upgrade, nobody can push changes to it.

  • Upgradeable with timelock (V3)

    V3 beacon proxy announces every upgrade 7 days in advance. You have a full week to review and exit to an immutable clone if you disagree.

Non-custody

Zero keys. Zero override. Zero exit risk.

HeirVault the company has no custody key and cannot sign transfers from your vault. Emergency pause and upgrade paths are bounded by contract rules: EVM/TRON pauses auto-expire, V3 upgrades use a 7-day timelock, and VaultMultiSig proposals wait 3 days before execution. If the hosted app disappears, direct contract recovery remains the reference path for supported chains.

0

Funds held by HeirVault

Not now. Not in fiat. Not as custodian.

100 %

Protocol controls bounded

Pause and upgrade paths have explicit limits.

9

Live vault networks

Each deployment path is reviewed separately.

Don't trust us. Read the proofs.

Source, audits, formal-verification outputs, and the recovery playbook are all public. Fork it, run it, replace us.