OPEN VAULT
NEXVAULT GUIDE
CONTRACT SECURITY

Security

NexVault smart contracts are open source, fully tested, and written with security as the first priority. Every critical property is enforced on-chain — not by trust.

174
PASSING TESTS
100%
NON-CUSTODIAL
OSS
OPEN SOURCE
0
ADMIN KEYS
SECURITY
174
TEST RESULTS · MARCH 2026
174 out of 174 unit tests passing across all four contracts. Tests cover deposits, withdrawals, yield calculations, lock periods, referral bonuses, genesis badges, compounding, and security edge cases.
174 / 174 PASSING · 0 FAILING
Test Coverage
Deployment
All 4 contracts deploy correctly
Non-owner deploy rejected on-chain
Owner constant verified across all contracts
Zero balances at deploy confirmed
Deposits
All 3 yield tiers accepted (1-Year, 3-Year, 5-Year)
Lock end timestamps verified per tier (365d, 1095d, 1825d)
Zero deposit reverts correctly
Emergency pause blocks deposits only
Genesis badge minted on first deposit
Withdrawals
LOCK_1YR, LOCK_3YR, LOCK_5YR enforced
Early withdrawal reverts before lock expires
Full principal returned on exit
Double-withdrawal rejected
Cross-user isolation confirmed
Yield & Compounding
Yield accrues correctly per tier APY
5YR > 3YR > 1YR ordering
No funds leave vault when compounding
Dev 10% cut calculated correctly
Unauthorized compound rejected
Referral Registry
Referral registered on first deposit
Self-referral silently blocked
Max 4 referrals cap enforced
+50 bps bonus per referral confirmed
Bonus reflected in yield earned
Security
Owner cannot touch user principal
Reentrancy guard verified
All admin functions owner-only
Withdrawals open while paused
Dev earnings capped by invariant
On-Chain Security Properties
🔒
Principal is mathematically protected
The owner can never withdraw user principal. The contract enforces that vault balance must always cover total deposits before any dev earnings can be claimed. This check cannot be bypassed.
Lock periods enforced by the blockchain
1-year, 3-year, and 5-year locks are enforced by on-chain timestamps. No one — including the owner — can unlock a deposit early.
🛡
Reentrancy protection on all state-changing functions
Every deposit, withdrawal, claim, and compound function uses OpenZeppelin's ReentrancyGuard. Follows the Checks-Effects-Interactions pattern throughout.
🔑
Hardcoded owner — no ownership transfer possible
The owner address is a compile-time constant. There is no transfer function, no proxy, and no upgradeable pattern. What is deployed is permanent.
🚨
Emergency pause only blocks deposits
If the owner activates emergency pause, new deposits stop. Withdrawals remain open at all times. Users can always retrieve their funds.
No flash loan surface, no price oracle
Yield is calculated on elapsed time only — no spot price, no oracle, no external dependency. Flash loans cannot manipulate yield calculations.
ZK-Verified Execution
Every transaction is ZK-proven by Nexus zkVM v3.0
NexVault deploys on NexusEVM — the EVM-compatible execution layer of Nexus blockchain. Every deposit, withdrawal, and yield calculation is automatically proven correct by the Nexus zkVM v3.0, a Stwo-backed zero-knowledge virtual machine running on every Nexus node. No additional code changes are required — ZK proofs are generated at the network layer automatically.
ZK proof pipeline — math enforces the rules
Solidity contracts execute on NexusEVM. Nexus zkVM generates a cryptographic proof of every execution. Proofs are aggregated into a Universal Proof across all nodes. Final on-chain state is ZK-verified. You do not need to trust execution — it is mathematically proven correct.
Stwo-backed prover — StarkWare-grade security
The Nexus zkVM is built on Stwo, StarkWare's next-generation STARK prover. This is production-grade zero-knowledge cryptography — the same technology stack powering the highest-security ZK systems in the industry.

Docs: docs.nexus.xyz/zkvm  ·  GitHub: nexus-xyz/nexus-zkvm

Open Source
NexVaultGH / nexvault-contracts
GITHUB · PUBLIC REPOSITORY · VIEW SOURCE CODE & TEST RESULTS

All contract source code, the full test suite, and raw test output are publicly available. Anyone can clone the repository, run the tests, and verify the results independently.

Audit Status
INDEPENDENT AUDIT — IN PROGRESS
NexVault will launch on Nexus mainnet before a formal third-party audit is complete. A professional security audit is actively being funded and will be published here publicly once complete.

The 174 passing tests above verify that the contracts behave as intended. An audit looks for unknown attack vectors beyond the test suite. We are transparent about this distinction.

Deposit only what you are comfortable with during this pre-audit period.