The PayX oracle key is a dedicated server-side key with no other permissions; it can only authorize claims for a handle that has just authenticated with X.
Provider RPC credentials live in server environment variables and are never shipped to the browser.
Third-party components
Circle CCTP v2: Circle-operated contracts and attestation service. Security posture documented by Circle.
LI.FI: routing API and Diamond contract; venue risk depends on the DEXs and bridges in each route, which are shown in the quote.
Wallets: RainbowKit / WalletConnect. Always confirm the chain and the contract you are approving inside the wallet.
Staying safe
Only use xylonet.xyz. We will never DM you first or ask for your seed phrase.
Check that approvals target the LI.FI Diamond or PayX addresses listed on the contracts page.
Revoke token approvals you no longer need from your wallet.
Verify the chain ID is 5042 before signing.
Report a vulnerability
Email forgelabs@xylonet.xyz with details and reproduction steps. Please give us time to fix before public disclosure.