EverValue Coin

We express our gratitude to the EverValue Coin team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

The in-scope EVA subsystem on Arbitrum is a time-locked staking vault with an ERC-721 secondary market and a WBTC revenue router. EVA is locked into weighted, time-bounded positions that accrue WBTC yield; transferable positions may be sold for WBTC; and allowlisted callers split protocol WBTC across the core burn vault, the active SLS vault, and the locker reward pool.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

• Project overview is provided (README.md and API.md) with architecture diagrams and subsystem write-ups.

• Roles, use cases, and features are covered for the core path and in depth for the locker and SLS subsystems.

• NatSpec on EVALocker, PositionMarket, and RevenueRouter usefully supplements the functional docs.

Code quality

• Run instructions and a Hardhat environment are present (npm install, test, coverage); Ignition and deploy scripts exist.

• Local Hardhat setup works without external keys; Solidity 0.8.20 is appropriate on production contracts.

• OpenZeppelin v5 patterns are used (SafeERC20, ReentrancyGuard, Ownable variants).

Test coverage

Code coverage of the project is 89.83% (branch coverage).

• Deployment and basic user interactions are covered with tests.

EVALocker, PositionMarket, and RevenueRouter form the lock-and-revenue slice of the EVA protocol. Users lock out-of-scope EverValueCoin into EVALocker, which custodially holds that ERC-20 and mints an ERC-721 position NFT. Live positions earn WBTC from a weighted single-pool accumulator funded when RevenueRouter, as the locker's distributor, calls distribute. Transferable NFTs may be sold for WBTC on PositionMarket without escrow; the seller keeps the NFT and continues to accrue until buy pays the seller and moves the token, at which point the locker's transfer hook settles rewards to the seller. Out-of-scope EVABurnVault, SLSburnVaultFactory, and SLSburnVault sit on the burn and SLS legs of the same revenue path.

EVALocker inherits ERC-721, ERC-721Enumerable, Ownable, and ReentrancyGuard. lock opens a position in an enabled deployment-time tier; shares equal net principal times the immutable tier weight. Tiers cannot be added or reweighted after deployment; only defaultCurve and enabled are owner-settable. Accrued WBTC is taken via claim, claimMany, or claimAll. Matured positions return full principal through withdraw. earlyExit returns a curve-determined liquid EVA fraction and force-burns the remainder against EVABurnVault via backingWithdraw, forwarding received WBTC to the position owner. Lock fees use the same vault call, send received WBTC to the distributor, and are waived when the pre-quoted payout is zero sats, the distributor is the zero address, or EVA supply is zero. distribute is restricted to the configured distributor and banks the payment into undistributed when totalShares is zero. Owner-proposed renewals escrow EVA and WBTC prizes; acceptRenewal compounds EVA into the position, pays WBTC immediately, restarts the early-exit clock, and may reactivate a matured position. ERC-721 transfers settle accrued rewards to the seller and refund any open renewal offer; the curve clock is not reset. Non-transferable tiers reject the transfer. renounceOwnership is overridden to revert.

PositionMarket is an approval-based, non-escrow, fixed-price marketplace that settles locker NFTs in WBTC. list requires ownership, a transferable tier, and locked EVA of at least minListAmount. The seller may updatePrice or cancel. buy pulls WBTC from the buyer to the seller and the NFT from the seller to the buyer, subject to a buyer-supplied maxPrice. isFulfillable requires an active listing, continued seller ownership, market approval, and an unchanged startSnapshot versus the position startTime, so a post-list renewal invalidates the ask. Unfulfillable entries are removed permissionlessly via pruneStale. RevenueRouter is Ownable and holds the project's WBTC float. Allowlisted callers invoke pay with per-call basis-point splits that must sum to 10,000. The core share is transferred as ERC-20 WBTC to EVABurnVault. The SLS share is resolved through SLSburnVaultFactory activeVault: WBTC is transferred or deposited via increaseBacking, or folded into the core share when no vault is active or the vault backing token is not WBTC. The locker share is delivered by approving EVALocker and calling distribute. Construction requires that both the core vault wbtcAddress and the locker wbtc equal the router's backingToken. The owner may rescue any ERC-20.

Files in Scope

• EVALocker.sol — Time-locked EVA staking that mints ERC-721 positions and pays WBTC through a weighted single-pool accumulator. Principal flows are lock, claim / claimMany / claimAll, withdraw, earlyExit, distributor-only distribute (banked into undistributed when totalShares is zero), and owner-proposed renewals accepted via acceptRenewal; lock fees and early-exit burns call core-vault backingWithdraw unless the fee or burn quote is waived.

• PositionMarket.sol — Approval-based fixed-price WBTC marketplace for locker position NFTs, with no escrow. Sellers use list, updatePrice, and cancel; buyers call buy with a maxPrice; unfulfillable listings are removed via pruneStale; isFulfillable checks ownership, approval, and startSnapshot against renewal.

• RevenueRouter.sol — Ownable WBTC splitter with allowlisted pay. Each payment is split across a core-vault transfer, an active SLS transfer or increaseBacking (folded to core if no vault or token mismatch), and EVALocker distribute via approve-and-call; construction requires locker wbtc and core wbtcAddress to match backingToken; the owner may rescue any ERC-20.

Privileged roles

EVALockersol

• owner (inherited from Ownable): Configures lock parameters, manages renewal offers, and sweeps surplus tokens.

• • Can call proposeRenewal to propose new terms for a position and escrow EVA and/or WBTC prizes.

  • Can call cancelRenewal to cancel a pending renewal offer and reclaim escrowed prizes.

  • Can call setTierCurve to set the early-exit curve assigned to future locks in a tier.

  • Can call setTierEnabled to enable or disable opening of new locks in a tier.

  • Can call setDistributor to set the address authorized to call distribute.

  • Can call setLocksPaused to pause or unpause opening of new locks.

  • Can call setLockFee to set the lock fee in basis points (capped at MAX_LOCK_FEE_BPS).

  • Can call setMinLockAmount to set the minimum EVA required to open a position.

  • Can call setBaseURI to set the ERC-721 metadata base URI.

  • Can call sweepWbtc to transfer surplus WBTC above unclaimed rewards and escrow to a recipient.

  • Can call sweepEva to transfer surplus EVA above locked and escrowed amounts to a recipient.

  • Can call transferOwnership to transfer contract ownership.

  • Can call renounceOwnership to renounce contract ownership.

• distributor: Sole address authorized to credit WBTC rewards into the locker pool.

• • Can call distribute to pull WBTC from the caller and credit it across live position shares.

PositionMarketsol

• owner (inherited from Ownable): Configures listing size requirements and contract ownership.

• • Can call setMinListAmount to set the minimum locked-EVA size required to list a position.

  • Can call transferOwnership to transfer contract ownership.

  • Can call renounceOwnership to renounce contract ownership.

RevenueRoutersol

• owner (inherited from Ownable): Manages payment callers and token recovery.

• • Can call setCaller to grant or revoke authorization to call pay.

  • Can call rescue to transfer any ERC-20 tokens held by the router to a recipient.

  • Can call transferOwnership to transfer contract ownership.

  • Can call renounceOwnership to renounce contract ownership.

• allowedCaller: Authorized to execute revenue splits from the router's WBTC balance.

• • Can call pay to split held WBTC across the core vault, active SLS vault, and EVALocker per supplied basis-point shares.

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope