herit hands your on-chain estate to named next-of-kin once you stop proving you are alive. estate heirs are ENS subnames carrying real permissions, not raw addresses. liveness is a World ID Selfie Check, not a timestamp any bot can ping.
⚠️heads up: the Selfie Check only works if World has given you access to the World ID Sandbox. request it from the World team first.how to get sandbox access · testing Selfie Check in sandboxestate
alice.herit.eth
next check-in
11d 04h
of a 30 days window
son.alice.herit.eth
son
kate.alice.herit.eth
spouse
crypto inheritance has an identity problem.
classic dead-man's switches refresh a lastActive field on any transaction. a bot on a cron, a delegated signer, or an attacker holding your stolen key can all keep that clock alive forever while you are not.
checking in requires a fresh World ID liveness and uniqueness proof scoped to your estate. a private key cannot look into a camera. whoever holds your key cannot pretend you are still here.
0x71c7…976f tells a grantor nothing, carries no verifiable link to a real person, and can be silently swapped. reviewing your own will becomes an exercise in trusting a hex string.
each heir gets son.alice.herit.eth inside a registry deployed for your estate, holding a relationship record, a share, and a claim role that ENSv2 itself enforces. readable, portable, and permissioned.
register alice.herit.eth in the grantor registry. herit deploys a dedicated ENSv2 registry for your estate in the same transaction, and holds only the root roles it needs to gate heirs later.
mint son.alice.herit.eth for each next-of-kin with a relationship record and a share in basis points. the claim role is deliberately withheld at registration.
pick a check-in interval and a grace period, then escrow exactly what you intend to will into an opt-in vault.
one Selfie Check per interval resets the clock. miss it and grace begins; miss grace and anyone may poke the registry, which grants the claim role to your heirs.
herit cannot unlock your estate on their own, and no one has to be online for it to unlock.
you checked in on time
the estate is sealed. heirs can see their subname and their share, and can do nothing with either. the claim role does not sit on their name at all.
heirs: read-only
a window closed with no check-in
the safety harness for travel, illness, or a bad network day. one valid Selfie Check here returns the estate to active with nothing lost. heirs are notified.
reversible by you
grace lapsed too
anyone may poke the registry. ROLE_HEIR_CLAIM lands on each heir subname. each heir then passes their own Selfie Check to claim their share.
heirs: claimable
The Graph indexes every estate herit opens, and each row is then filled in from the contracts as you look at it, where the clock stands, and which ENS subnames are waiting on it. open a row to see the heirs and their shares.
reading sepolia…
neither integration is a nice-to-have. remove either one and herit stops being safe to use.
ENS track
World track
ENSv2 lives on Sepolia and World ID's verifier lives on World Chain. herit bridges that gap with a narrow, single-purpose attestor rather than blocking the build on an oracle.
opens estates, registers heirs, grants the claim role. holds root roles on every estate registry and never holds funds.
the per-estate state machine and check-in clock. the only caller permitted to unlock an heir.
verifies the backend's EIP-712 attestation that a Selfie Check passed, replay-protected by action, nonce and expiry.
opt-in escrow for exactly the assets you intend to will. ETH and ERC-20 for the hackathon build.
the heir-facing entrypoint. checks unlock, attestation and subname control, then releases the share.
deployed once and left alone by a herit redeploy. every grantor name and every heir record in the app lives inside these three.
takes about four minutes
open an estate on Sepolia, name your heirs, and let the clock do the rest. demo timers run in minutes so you can watch the whole handover happen.