Europeum

We express our gratitude to the Europeum team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

The Timestamp service is an EVM-based smart contract system designed to provide proof-of-existence by storing cryptographic hash values on-chain. Deployed as part of the European Blockchain Services Infrastructure (EBSI), the contract enables subjects to timestamp hashes, organize them into versioned records, and manage record ownership through time-bound validity windows.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

• Functional requirements are partially covered in external EBSI documentation.

• Discrepancies exist between documented behavior and actual implementation (e.g., stored data fields, access control model).

• Technical description of internal architecture and library interactions is not provided.

• NatSpec comments are present but incomplete for complex internal functions.

Code quality

• The code follows a modular library pattern for separation of concerns.

• Standard upgradeability patterns from OpenZeppelin are utilized.

• Storage gap is implemented for upgrade safety.

• Loop patterns are now conditionally executed, reducing unnecessary iterations.

Test coverage

Code coverage of the project is 97.67% (line coverage).

• Branch coverage measurement is not configured in the project's test infrastructure.

• Deployment and basic user interactions are covered with tests.

• Some negative cases and edge conditions are not thoroughly covered.

• Multi-user interaction scenarios with complex ownership transfers lack comprehensive testing.

The system is built around an upgradeable proxy architecture using OpenZeppelin's Initializable pattern. The main Timestamp contract serves as the entry point and delegates business logic to three specialized libraries: HashAlgoLib for hash algorithm registry management, TimestampLib for standalone timestamp operations, and RecordLib for versioned record and ownership management. All administrative functions are gated through an external IPolicyRegistry contract that performs attribute-based access control checks.

The contract supports two primary workflows. First, standalone timestamping allows any caller to record up to three hash values per transaction, storing the hash, algorithm identifier, block number, and optional metadata. Second, record-based timestamping organizes timestamps into versioned records with multi-owner management. Each record maintains a version history where timestamps can be added, appended, or detached. Ownership is enforced through validity windows (notBefore/notAfter timestamps) with support for revocation.

Data retrieval is implemented with pagination utilities from the @ebsiint-sc/bootstrap package, supporting paginated queries across hash algorithms, timestamps, records, and versions. The contract maintains multiple index mappings to enable efficient lookups by owner, timestamp, or first-version hash.

• Timestamp.sol — The main upgradeable implementation contract that exposes all external functions for hash algorithm management, timestamping, record creation, version management, and ownership operations. Business logic is delegated to the three libraries, and policy-based access control is enforced via policyRegistryContract.

• libraries/HashAlgoLib.sol — A library responsible for managing the registry of supported hash algorithms. Functions insertHashAlgorithm and updateHashAlgorithm are provided for registration and modification, IANA name uniqueness is enforced, and paginated retrieval of algorithm IDs is exposed.

• libraries/RecordLib.sol — A library that manages records, versions, and ownership. Record creation is handled via timestampRecordHashes, version creation via timestampVersionHashes and timestampRecordVersionHashes, hash appending to existing versions, timestamp detachment, and owner insertion/revocation with time-bound validity checks.

• libraries/TimestampLib.sol — A library responsible for creating and retrieving timestamps. Hash algorithm status is validated, timestamp IDs are computed as SHA256 of hash values, timestamp metadata (sender, block number, optional data) is stored, and duplicate timestamps with mismatched algorithms are prevented.

Privileged roles

Timestamp.sol

• TS:insertHashAlgorithm policy holder: Accounts authorized by the external IPolicyRegistry for the TS:insertHashAlgorithm attribute.

• • Can call insertHashAlgorithm to register new hash algorithms with specified output length, IANA name, OID, status, and multihash representation.

• TS:updateHashAlgorithm policy holder: Accounts authorized by the external IPolicyRegistry for the TS:updateHashAlgorithm attribute.

• • Can call updateHashAlgorithm to modify existing hash algorithm metadata including status changes.

• Record Owner: Any address registered as an active owner of a specific record, within its validity window (notBefore \<= block.timestamp \<= notAfter) and not revoked.

• • Can call timestampVersionHashes to add a new version with timestamps to a record identified by version hash.

  • Can call timestampRecordVersionHashes to add a new version with timestamps to a record identified by record ID.

  • Can call appendRecordVersionHashes to append timestamps to an existing version.

  • Can call insertRecordVersionInfo to add metadata to an existing version.

  • Can call detachRecordVersionHash to remove a timestamp from a version.

  • Can call insertRecordOwner to add new owners with specified validity windows.

  • Can call revokeRecordOwner to revoke existing owners (including self-revocation).

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope