DocsSecurity
Security
How PayXTipping v2 protects funds in escrow, who can do what, and what to watch for.
Security model at a glance
Funds are held by the contract, not by XyloNet. There is deliberately no owner or admin path that can move user escrow. The only way funds leave escrow is a valid claim for that handle.
EIP-712 claims
Bound to chain 5042 and this contract.
2-of-3 Safe owner
No single key controls the contract.
Pausable
Guardian can freeze, never move funds.
Smart contract hardening (v2)
EIP-712 oracle claims
Claims are authorized by a typed signature Claim(string handle, address wallet, bytes32 nonce) under domain {name: "PayX", version: "2", chainId: 5042, verifyingContract}. A signature cannot be replayed on another chain or another deployment. Each nonce is single-use.
Pausable with a guardian
tip() and claimTips() can be halted by the guardian or the owner. The guardian role can only pause; it cannot unpause, change parameters, or touch funds. Unpausing requires the owner (the Safe).
Ownable2Step, owned by the Admin Safe (2-of-3)
Ownership is held by the XyloNet Admin Safe (0xFD3A…Ed96). Any admin action needs two of three signers, and ownership transfers must be explicitly accepted by the new owner.
Fees go to the Treasury Safe
The 1% platform fee accrues separately from escrow and can only be withdrawn to the fee recipient, the Treasury Safe (0x7EF8…9990), by the owner or the recipient itself.
Escrow accounting the owner cannot bypass
The contract tracks totalPending (sum of every handle's unclaimed balance). sweepExcessUSDC can only move USDC above totalPending + totalFeesCollected, and rescueToken refuses USDC entirely. There is no function that reduces a handle's pending balance except its own claim.
adminRelinkWallet recovery
If a creator loses the wallet they first claimed with, the owner (2-of-3) can relink the handle to a new wallet. This only redirects future claims and emits WalletRelinked; it never moves existing funds by itself.
Reentrancy guard, SafeERC20, 280-byte messages, input validation
OpenZeppelin ReentrancyGuard on tip/claim/withdraw, SafeERC20 for every transfer, handle normalization onchain, custom errors for every rejection.
Who can do what
| Role | Can | Cannot |
|---|---|---|
Owner Admin Safe 2-of-3 | Set oracle, guardian, fee (≤5%), min amount, fee recipient; pause/unpause; relink a handle's wallet; sweep excess; rescue non-USDC tokens; withdraw fees | Move or reduce any handle's pending balance; claim on a user's behalf; withdraw fees anywhere but the Treasury Safe |
| Guardian | Pause payments and claims | Unpause; change any setting; move any funds |
| Oracle signer | Sign claim authorizations for a handle-to-wallet pair after X OAuth | Move funds; sign for a wallet without a valid X session; replay a signature elsewhere |
| Anyone | Pay any handle; read every balance and event | Claim without an oracle signature |
Claim security
- X OAuth (PKCE)You sign in with X. We only request read access to your public profile. The verified username is stored in an encrypted, HttpOnly session cookie, never in the URL.
- Oracle EIP-712 signatureOur server signs Claim(handle, wallet, nonce) for the handle in your session and the wallet you connected. Signing is rate-limited and the key never leaves the server.
- Onchain verificationThe contract recovers the signer, checks it against oracleSigner(), burns the nonce, and pays the full pending balance to the wallet.
- Wallet bindingYour first claim links the wallet to your handle. Later claims must use the same wallet (WalletMismatch otherwise). Recovery is via adminRelinkWallet through the 2-of-3 Safe.
Dependencies
Circle USDC on Arc
The USDC instance escrows Arc's native USDC through its 6-decimal ERC-20 interface and holds no other asset. Any additional supported asset gets a separate deployment of the same code that escrows only that token. Each instance holds exactly one token.
Learn more about USDCOZ
OpenZeppelin Contracts
ReentrancyGuard, SafeERC20, Ownable2Step, Pausable, EIP712 and ECDSA: audited, widely deployed building blocks.
OpenZeppelin documentationRisk considerations
Smart contract risk
v2 was reviewed line by line and tested against a local fork, but no contract is risk-free. Send amounts you are comfortable with.
Oracle availability
Claims need a signature from our oracle. If the service is down, funds stay safely in escrow until it is back; they cannot be lost or redirected.
Handle ownership
Payments are indexed by the handle text. Whoever controls that X username at claim time can claim them. Double-check the handle before paying.
Best practices
- Verify the contract address on this site before interacting from a wallet or script.
- Approve only the exact payment amount (the web Pay page does this by default).
- Claim to a wallet you control long-term; it becomes your linked wallet.
- Review transaction details in your wallet before signing.
- Bookmark xylonet.xyz/pay; never sign PayX claims from another domain.
Report a vulnerability
If you discover a security issue, contact us privately first. Please do not disclose publicly before we have had a chance to respond.
0xFD3A6DEE167C9B519fE7f646F91e9D80ba51Ed96 is the Admin Safe referenced above.