GRAVE: The First Onchain
Last Will Protocol

Abstract

Every year, an enormous amount of wealth is frozen, lost, or fought over because the systems that transfer it after death are slow, opaque, and built for paper.

GRAVE is a fully onchain last-will protocol. Instead of trusting a court, a lawyer, or a custodian to honor your wishes, you encode them directly into an immutable smart contract — a GRAVE Vault — deployed on Robinhood Chain. The vault holds your ETH and RWA Stock Tokens, tracks a proof-of-life schedule that only you control, and, once that schedule lapses beyond a grace period, allows your named beneficiaries to permissionlessly claim their exact, pre-defined shares.

There is no admin key, no upgrade path, and no pause switch. While you are active, only you can move funds or change the terms. After execution, the split is frozen by an onchain balance snapshot so shares never drift as beneficiaries claim one at a time. The result is inheritance that is cryptographically final, borderless, and self-executing.

01 The Problem

The transfer of wealth between generations still runs on infrastructure designed centuries ago. For digital and tokenized assets, that infrastructure is not just slow — it is structurally incompatible with how the assets themselves work.

Probate is slow and expensive

Traditional wills route wealth through probate courts. Settlement routinely takes months to years and consumes a meaningful share of the estate in executor, legal, and notary fees. The process assumes a central authority with the time and jurisdiction to adjudicate every claim.

Paper is disputable and forgeable

A physical will is a single point of failure. It can be lost, contested, altered, or ruled invalid on a technicality. The people it is meant to protect often have the least power to defend it.

Digital assets fall through the cracks

Self-custodied crypto and tokenized real-world assets have no built-in succession. If the owner dies without securely passing on their keys, the assets are frozen forever — invisible to any court and unreachable by any heir. Sharing keys in advance re-introduces exactly the custodial risk self-custody was meant to remove.

02 The GRAVE Solution

GRAVE replaces the trusted third party with a deterministic smart contract. The rules you set are the rules that execute — nothing more, nothing less.

A GRAVE will is created once, verified continuously, and executed automatically. You keep complete, non-custodial control for as long as you are active. The protocol only ever does one thing you cannot: it opens the vault to your beneficiaries after you have provably gone silent for longer than the window you defined.

03 Architecture

GRAVE is intentionally small. It is two Solidity contracts and a set of clear rules — the less code that guards generational wealth, the less that can go wrong.

3.1 · Vault lifecycle

A vault moves through three states. The transition into Executed is one-way and irreversible.

The deadline is a pure function of onchain state:

function deadline() public view returns (uint64) {
    return lastCheckIn + checkInInterval + gracePeriod;
}

// Execution unlocks the moment block.timestamp passes the deadline.
function isExpired() public view returns (bool) {
    return block.timestamp > deadline();
}

3.2 · Proof of life

The only thing keeping a vault closed is a fresh check-in. Calling checkIn() stamps lastCheckIn with the current block time and resets the countdown. The owner can always check in; any guardian can check in on their behalf.

Two owner-defined parameters shape the schedule:

• Check-in interval — how long you may go silent before the grace period even begins.
• Grace period — an additional buffer after the interval, during which the vault is technically expirable but you (or a guardian) can still cancel the whole thing with a single check-in.

3.3 · Execution & claims

When isExpired() becomes true, execute() is open to anyone — a beneficiary, a watcher bot, or a good samaritan. It flips the vault to executed and takes a one-time balance snapshot of ETH and every tracked token.

Beneficiaries then call claim() independently. Each receives snapshot × bps / 10,000 of ETH and of every token, exactly once. Because the snapshot is frozen at execution, it does not matter whether beneficiaries claim in the same block or years apart — the arithmetic is identical and no one can dilute anyone else.

// Shares are fixed at execution so they never drift between claims.
uint256 ethAmount = (ethSnapshot * share) / 10_000;
for (each tracked token) {
    amount = (tokenSnapshot[token] * share) / 10_000;
}

Every beneficiary's share is stored in basis points (bps), and the full set must sum to exactly 10,000 (100%) when it is set — the contract rejects any allocation that does not.

04 Guardian Network

Guardians are an optional social safety net. They are addresses you designate and trust — a family member, a partner, a second device of your own — who are permitted to do exactly one thing: submit a proof-of-life checkIn() on your behalf.

This protects against the failure mode that worries people most: a temporary inability to check in (travel, illness, a lost device) triggering an execution you did not intend. A guardian can reset the countdown for you. Crucially, guardians cannot withdraw funds, change beneficiaries, alter the schedule, or trigger execution — their power is strictly limited to keeping the vault alive.

05 RWA Stock Tokens

GRAVE is built for Robinhood Chain's core use case: tokenized real-world assets, and Stock Tokens in particular. From the vault's perspective, a Stock Token is a standard ERC-20, so no special integration is required — any ERC-20 can be deposited, curated shortcuts or not.

To remain compatible with the full spectrum of token implementations, transfers use a SafeTransfer library that tolerates both standard and non-standard (no boolean return) ERC-20s. The vault tracks each token it has seen so that, at execution, it can snapshot and later distribute every asset it holds.

06 Security Model

GRAVE's security comes from what it deliberately cannot do. The contract is the trust boundary, and it is designed so that no privileged party — including the protocol's own authors — can subvert an owner's intent.

• No admin key. There is no owner-of-owners, no multisig with special powers, and no role that can drain or freeze a vault.
• No upgrade path. Vaults are non-upgradable. The code that guards your assets on day one is the code that guards them forever.
• No pause switch. Nothing can halt a valid execution or block a legitimate claim.
• Reentrancy-guarded. ETH sends and token transfers in withdrawETH, execute, and claim are protected by a non-reentrancy lock and a checks-effects-interactions ordering.
• Snapshot isolation. Freezing balances at execution means one beneficiary's claim can never change another's share.
• Owner-only mutations. Deposits, withdrawals, and every configuration change require the owner and only work while the vault is active and un-executed.

07 Threat Analysis

A protocol that self-executes must reason carefully about the ways it could go wrong. The table below maps the principal risks to their mitigations.

08 Fees & Economics

GRAVE's smart contracts charge no protocol fee on deposits, withdrawals, or claims. The only cost to use the protocol is Robinhood Chain gas, paid in ETH.

Because Robinhood Chain is an Arbitrum-Orbit L2 optimized for real-world assets, transaction fees are low enough for global inheritance flows that would be economically impossible on a base layer. Creating a vault, checking in, depositing, executing, and claiming are all ordinary transactions.

09 Roadmap

GRAVE ships as a minimal, working core. Future work extends its safety and reach without ever compromising the non-custodial, admin-key-free foundation.

• Independent security audit of GraveVault and GraveFactory before any recommended mainnet use.
• Decentralized heartbeat notifications — redundant, multi-signal reminder infrastructure so owners never miss a check-in for lack of a nudge.
• Beneficiary social recovery — guardian-assisted recovery flows to reduce the risk of assets becoming inaccessible after execution.
• Richer allocation logic — optional time-locks, staged releases, and conditional beneficiaries.
• Broader RWA coverage — curated Stock Token lists and metadata as the Robinhood Chain asset universe grows.

10 Legal Notice

GRAVE is a technical execution layer, not a law firm and not a substitute for a legally valid will. It is designed to complement your estate planning, not replace it. Whether an onchain transfer is recognized, how it is taxed, and how it interacts with your local inheritance law varies by jurisdiction.

GRAVE is experimental software provided "as is," without warranties of any kind. It is not legal, financial, or tax advice. Always consult qualified professionals in your jurisdiction before relying on GRAVE for real assets. See the Terms of Use and Privacy Policy for the full terms governing use of the protocol and its interfaces.

Glossary