Security Audit Report

EPITAPH PROTOCOL v0.1.0 · PREPARED FOR PUBLIC DISCLOSURE

Overview

Field	Detail
Protocol	Epitaph Protocol
Version	v0.1.0
Audit Firm	Pending — Cantina / Code4rena
Audit Status	SCHEDULED Q3 2026
Primary Network	Base (Mainnet)
Language	Solidity ^0.8.24
Framework	Hardhat + OpenZeppelin v5
Lines of Code	~420 (EpitaphCore.sol)

Audit Scope

The following contracts are in scope for the formal audit:

Contract	Description	Priority
EpitaphCore.sol	Main will protocol — deploy, execute, revoke	CRITICAL
EpitaphVault.sol	Asset custody during execution window	HIGH
EpitaphRegistry.sol	Will indexing and lookup	MEDIUM

Internal Review

Our internal security review identified and addressed the following before public deployment:

Critical

High

Medium

Low

Informational

Total

Findings

EP-01

Reentrancy in ETH distribution loop

MEDIUM FIXED

Description: The _distributeETH() function made external calls inside a loop without following checks-effects-interactions pattern.

Resolution: Added ReentrancyGuard modifier to executeWill(). State updated to EXECUTED before any external calls.

EP-02

Guardian confirmation bitmask overflow edge case

MEDIUM FIXED

Description: The 3-bit bitmask used for guardian confirmations had an edge case when all three bits were set simultaneously.

Resolution: Added explicit bounds check. AlreadyConfirmed error now correctly prevents double-confirmation at bit level.

EP-03

Missing zero-address validation for fee recipient

LOW FIXED

Resolution: ZeroAddress custom error added. Validated in constructor and setFeeRecipient().

EP-04

No maximum cap on beneficiary share BPS rounding

LOW FIXED

Resolution: Strict equality check (totalShares == 10000) enforced. Dust accumulates in contract, swept by owner.

EP-05

Large message string allows gas DoS on deployment

LOW FIXED

Resolution: MAX_MESSAGE_LENGTH = 1024 bytes enforced. Larger messages should use IPFS with hash stored on-chain.

Security Properties

Non-custodial — contract never holds user assets during ACTIVE state
Reentrancy protection on all state-changing external calls
Access control — only owner can modify before execution
Integer overflow protection (Solidity ^0.8 built-in)
Custom errors for gas-efficient reverts
Pausable emergency stop mechanism
Formal third-party audit — scheduled Q3 2026
Invariant fuzz testing — in progress
Bug bounty program — planned post-audit
ZK proof integration for beneficiary identity

Responsible Disclosure

To report a security vulnerability, email security@epitaph-agent.xyz. Do not open a public GitHub issue for security vulnerabilities. We aim to respond within 48 hours and patch within 7 days.

EPITAPH PROTOCOL v0.1.0 · epitaph-agent.xyz · GitHub