Phase 1 — Mainnet Deployment

Prerequisites#

Three conditions must all be satisfied before AeternumVault is deployed to Ethereum mainnet. None are negotiable.

External security audit — complete and findings addressed. The internal assessment (Revision 3, 7th July 2026) identified zero High and zero Medium severity findings — the one Medium finding present in the prior revision was resolved as a direct consequence of the migration to the current permissionless keeper architecture. An independent external audit by a professional security firm is required before any real ETH is placed under the contract's protection. The audit operates on the exact bytecode that will be deployed — not a branch, not a pre-audit candidate. Any findings from the audit are triaged, addressed, and re-reviewed before deployment proceeds.

Incentivized testnet — complete. The incentivized testnet phase validates the protocol under realistic multi-user load on Sepolia: keeper bot behaviour at scale (database scan volume, on-chain validation batching, and Multicall3 execution), Ponder indexer performance under concurrent event streams, and edge-case recovery paths. Any issues surfaced during that phase are resolved before the audit engagement begins, ensuring the audited contract matches what was tested at scale.

Operational infrastructure — verified. The Aeternum Labs keeper bot's signing wallet must be funded with mainnet ETH to pay for triggerRecovery gas, the keeper bot and Ponder indexer must both be pointed at the mainnet contract, and the indexer must be confirmed synced before launch.

---

What Changes at Mainnet#

The contract code is identical to the version that ran through the incentivized testnet and external audit. Nothing in the Solidity changes. What changes are the constructor parameters — the immutable values set at deployment time that are tuned for the real-world Ethereum environment rather than the testing environment.

Constructor Parameters — Mainnet vs Sepolia#

The 180-day minimum inactivity period is the most consequential change for users. The 5-minute Sepolia minimum exists solely to make the full recovery cycle observable in a single session. At mainnet gas prices, maintaining a 5-minute timer would require continuous on-chain transactions — an impossible condition for any real user.

The keeper bot's own configuration — KEEPER_POLL_INTERVAL_MS and KEEPER_BATCH_SIZE — is separate from these constructor parameters entirely. It lives in the keeper bot's own environment, not the contract, and doesn't need to change between Sepolia and mainnet by default, though Aeternum Labs may tune it based on real registry size once mainnet volume exists. See Keeper Network for the full configuration reference.

---

Deployment Sequence#

The deployment is executed as a single, scripted sequence. Manual steps are minimised to reduce the window during which the contract is live but not fully configured.

---

What Users Need to Know Before Depositing Real ETH#

The Sepolia experience is designed to be low-stakes and fast. Mainnet is neither. Every property that made Sepolia a good test environment — 5-minute timers, free test ETH, disposable wallets — becomes a liability if applied to real funds.

Choose your inactivity period carefully. The minimum on mainnet is 180 days. This exists for a reason: a shorter period creates a meaningful risk of accidental recovery during an extended trip, an unexpectedly busy or disruptive stretch of life, or any period of reduced crypto activity. Read Register Your Vault and the inactivity period guidance before setting your timer.

Test your backup address before registering. Send a small amount of real ETH to your backup address from a separate wallet and confirm receipt before you use that address in a registration. If your backup is a multisig or any smart contract, confirm it is configured to accept plain ETH transfers. A contract that reverts on receive() will cause recovery to fail, exhaust the three-attempt limit, and result in vault abandonment. See Automatic Recovery for the failure lifecycle.

Your backup address is your beneficiary. Give this decision the same weight as naming an heir in a will. It may be a family member, a trusted heir, or a separate wallet you control. It cannot be your own registered address. Think through what happens if recovery fires because your inactivity period elapses while you're still alive and in full control of your wallet — you simply went longer than expected without a transaction. Can you coordinate with your backup address to retrieve the funds in that case? Weigh that before committing to a backup address with real ETH involved.

Gas costs are real. Every on-chain interaction — register, deposit, send, ping, updateBackupAddress — costs real Ethereum gas. The gas estimates documented in Vault Actions give unit costs; the USD equivalent depends on current gas prices and ETH price at the time of the transaction.

---

Post-Deployment Operations#

Keeper Bot Maintenance#

The Aeternum Labs keeper bot's signing wallet requires a funded ETH balance to operate. If the balance runs low, the bot's database scan and on-chain validation continue to run normally — these cost nothing to the keeper, since one is a database query and the other a batched view call — but it will not be able to submit triggerRecovery transactions, and recovery executions will be delayed until the wallet is topped up. Because triggerRecovery is permissionless, this delay is not a single point of failure; any other party could still call triggerRecovery directly during that window. In practice, Aeternum Labs monitors the keeper wallet balance and tops it up proactively as part of running the protocol.

Source Availability and Licensing#

AeternumVault has been source-available under BUSL-1.1 since the repository was published — the license has been in effect throughout the open testnet and incentivized testnet phases. Mainnet deployment starts the Change Date countdown: the deployed contract address, constructor parameters, and deployment timestamp are recorded in the aeternum-core repository, and the calculated Change Date — four years from that timestamp or January 1, 2031, whichever is earlier — is committed to LICENSE.md in the same deployment commit.

Immutability#

The deployed mainnet contract cannot be modified, paused, or upgraded by anyone, including Aeternum Labs. Future versions of the protocol — including the Phase 2 Hybrid Wallet — are deployed as entirely new contracts. Users on the Phase 1 mainnet contract remain on that contract indefinitely unless they choose to migrate. Their recovery configuration, inactivity timer, and vault balance are governed by the rules that were fixed at deployment and will not change.

---

What Comes Next#

Phase 1 mainnet establishes the foundational recovery primitive. ETH is protected. The contract is live and immutable. The keeper network is monitoring.

The next phase — Phase 2: Hybrid Wallet — removes the escrow model entirely. Assets stay in the user's own EOA. Multi-asset recovery expands protection to ERC-20 tokens. And passive activity detection eliminates the need for manual pings by treating any app interaction as a liveness signal. Phase 2 design work continues in parallel with the mainnet launch.