Smart Contract Security Review
This is an internal security review of the MyAi Escrow contract, supported by automated static analysis (Slither, Aderyn). It is not a third-party audit. Four items were identified — 2 High, 2 Medium — and addressed in the Escrow V2 source. An independent, tier-1 third-party audit is scheduled prior to the public token launch; this page will be updated with that report when complete.
Contract References
Findings & Resolutions
Single-step ownership transfer enables irrecoverable loss of control
transferOwnership() immediately replaced the owner in one step. A typo or wrong address would permanently brick all admin functions — release(), refund(), setFeeBps(), and setTreasury() would become uncallable.
Replaced with two-step pattern: transferOwnership() sets pendingOwner; acceptOwnership() must be called by the new address to complete the transfer. Zero-address guard added to both paths.
refund() accepted caller-supplied depositor address
The original refund(jobId, depositor) signature let the owner pass any address as the refund recipient, enabling funds to be misdirected to an arbitrary wallet rather than the actual payer.
depositor is now stored in the Job struct at deposit() time. refund() signature reduced to refund(jobId) — the stored address is used unconditionally, making misdirection impossible.
Fee parameters retroactively affected existing escrow positions
FEE_BPS and BURN_BPS were global variables read at release time. A governance change after deposit could silently increase fees on already-locked funds, breaking depositor expectations.
feeBps and burnBps are now snapshotted into the Job struct at deposit() time. Release uses the job-level values, not the current globals. previewJobSplit() exposes these per-job.
No depositor escape hatch if owner becomes inactive
If the owner key was lost or the coordinator went offline, funds could be locked indefinitely — depositors had no recourse to reclaim their tokens without owner cooperation.
selfRefund(jobId) added: callable only by the original depositor after REFUND_TIMEOUT (7 days) has elapsed since deposit. No fee is charged. CEI pattern followed.
About the Review Scope
This internal review covered Escrow.sol — the MyAi protocol escrow that holds MYAI tokens per-job on Base mainnet. The contract accepts deposits from payers, holds them until the coordinator confirms job completion (Proof-of-Compute), then releases funds to the agent wallet after applying a configurable protocol fee split between the treasury and the burn address.
The contract is intentionally self-contained with no external dependencies, a minimal ERC-20 interface, and no upgradeability — reducing attack surface and making the audit scope well-bounded.
Found a vulnerability? Email [email protected] with a detailed report. We respond within 48 hours. See our Security Policy for scope and bounty details.