EVMAuth Security Audit

[sscovil]

EVMAuth recently underwent a security audit, sponsored by Radius and conducted by Trail of Bits.

The audit began on July 30, 2025 (v0.2.1), and the report was finalized and published on October 3, 2025. During that time, several issues were identified and addressed. As a result, the current version of the EVMAuth contract (v0.3.1) is much more robust, reliable, and maintainable.

EVMAuth now has improved documentation and extensive test coverage:

╭---------------------------------+------------------+------------------+-----------------+------------------╮
| File                            | % Lines          | % Statements     | % Branches      | % Funcs          |
+============================================================================================================+
| src/EVMAuth1155.sol             | 100.00% (37/37)  | 100.00% (30/30)  | 100.00% (2/2)   | 100.00% (14/14)  |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/EVMAuth6909.sol             | 93.75% (30/32)   | 90.91% (20/22)   | 100.00% (2/2)   | 91.67% (11/12)   |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/base/AccountFreezable.sol   | 100.00% (30/30)  | 100.00% (30/30)  | 100.00% (3/3)   | 100.00% (8/8)    |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/base/EVMAuth.sol            | 97.96% (48/49)   | 97.37% (37/38)   | 100.00% (0/0)   | 100.00% (18/18)  |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/base/TokenAccessControl.sol | 100.00% (13/13)  | 100.00% (7/7)    | 100.00% (0/0)   | 100.00% (6/6)    |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/base/TokenEnumerable.sol    | 100.00% (26/26)  | 100.00% (27/27)  | 100.00% (2/2)   | 100.00% (8/8)    |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/base/TokenEphemeral.sol     | 94.26% (115/122) | 94.30% (149/158) | 88.89% (24/27)  | 92.86% (13/14)   |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/base/TokenPurchasable.sol   | 100.00% (99/99)  | 99.09% (109/110) | 100.00% (16/16) | 100.00% (20/20)  |
|---------------------------------+------------------+------------------+-----------------+------------------|
| src/base/TokenTransferable.sol  | 95.00% (19/20)   | 100.00% (25/25)  | 100.00% (3/3)   | 85.71% (6/7)     |
|---------------------------------+------------------+------------------+-----------------+------------------|
| Total                           | 97.43% (417/428) | 97.09% (434/447) | 94.55% (52/55)  | 97.20% (104/107) |
╰---------------------------------+------------------+------------------+-----------------+------------------╯

We also ran additional testing using slither-mutate, at the recommendation of the auditor:

slither-mutate ./src --test-cmd="forge test" &> >(tee mutation.results)
INFO:Slither-Mutate:Starting mutation campaign in ./src
INFO:Slither-Mutate:Preparing to mutate files:
- src/EVMAuth6909.sol
- src/EVMAuth1155.sol
- src/base/TokenEnumerable.sol
- src/base/EVMAuth.sol
- src/base/TokenEphemeral.sol
- src/base/TokenAccessControl.sol
- src/base/TokenTransferable.sol
- src/base/AccountFreezable.sol
- src/base/TokenPurchasable.sol
INFO:Slither-Mutate:Timing tests..
INFO:Slither-Mutate:Test suite passes in 17 seconds, commencing mutation campaign with a timeout of 34 seconds

INFO:Slither-Mutate:Mutating contract EVMAuth6909
INFO:Slither-Mutate:Done mutating EVMAuth6909.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 16 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 24 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 11 (0.0%)

INFO:Slither-Mutate:Mutating contract EVMAuth1155
INFO:Slither-Mutate:Done mutating EVMAuth1155.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 19 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 25 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 38 (0.0%)

INFO:Slither-Mutate:Mutating contract TokenEnumerable
INFO:Slither-Mutate:Done mutating TokenEnumerable.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 9 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 10 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 24 (0.0%)

INFO:Slither-Mutate:Mutating contract EVMAuth
INFO:Slither-Mutate:Done mutating EVMAuth.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 31 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 32 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 15 (0.0%)

INFO:Slither-Mutate:Mutating contract TokenEphemeral
INFO:Slither-Mutate:Done mutating TokenEphemeral.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 50 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 46 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 442 (0.0%)

INFO:Slither-Mutate:Mutating contract TokenAccessControl
INFO:Slither-Mutate:Done mutating TokenAccessControl.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 7 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 12 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 6 (0.0%)

INFO:Slither-Mutate:Mutating contract TokenTransferable
INFO:Slither-Mutate:Done mutating TokenTransferable.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 3 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 4 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 30 (0.0%)

INFO:Slither-Mutate:Mutating contract AccountFreezable
INFO:Slither-Mutate:Done mutating AccountFreezable.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 12 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 14 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 36 (0.0%)

INFO:Slither-Mutate:Mutating contract TokenPurchasable
ERROR:Slither-Mutate:LIR mutator failed in TokenPurchasable: bool does not have a min value
INFO:Slither-Mutate:Done mutating TokenPurchasable.
INFO:Slither-Mutate:Revert mutants: 0 uncaught of 40 (0.0%)
INFO:Slither-Mutate:Comment mutants: 0 uncaught of 47 (0.0%)
INFO:Slither-Mutate:Tweak mutants: 0 uncaught of 168 (0.0%)

INFO:Slither-Mutate:Finished mutation testing assessment of './src' in 2 hours

Slither is a static analysis framework for Solidity, and slither-mutate is a tool that systematically introduces bugs into a code base, then checks if the test suite catches them.

The results above indicate that no issues were found, and that the current EVMAuth test suite is very comprehensive.