Testnet: Monad Testnet, test USDC only, unaudited
Open app
Menu
On this page What the design guarantees
All guide pages

Security and limitations

Explanation

FairPay is a testnet prototype. The contracts, the SDK and the app are unaudited. Here's what the privacy covers and what it doesn't.

Careful: do not hold meaningful funds in the pool. Everything in this project runs on Monad Testnet with a test token anyone can mint.

What the design guaranteesLink to this section

Each of these is enforced in code and covered by a test or review.

  • A note is spent once. The pool records a one-time nullifier per note.
  • A payment cannot be redirected. The proof is bound to the merchant and the order reference. Someone who copies a proof still pays the same merchant for the same order.
  • Proofs don't work on another chain or pool. The proof scope includes the chain id, pool address and note size.
  • The owner cannot take pooled funds. There is no withdraw function.
  • The merchant trusts only the chain. Verification checks the receipt, contract, chain, reference, merchant, amount, payer and that the block is canonical.
  • One payment settles one share. The server stores each payment under a unique key and settles one share at a time.
  • The browser's view of the pool is checked. A rebuilt tree must match a root the pool has recorded.

Who you trust, and for whatLink to this section

  • The contract owner can pause the contracts, change the deposit cap and the merchant list, and give up ownership. Because there is no withdraw path, pausing can freeze deposits. The owner cannot move funds.
  • The relayer can refuse to send your payment. It cannot steal or redirect it.
  • FairPay's server runs the relayer and the deposit list, and decides when a share is paid. It cannot spend your notes, but it sees connection metadata.
  • The RPC provider is trusted to be available, not honest. It sees your IP address and every request.
  • Semaphore v4.14.5 circuits and verifier (audited upstream), with one Monad-specific change to how gas is forwarded to precompiles. Proof files are fetched from snark-artifacts.pse.dev at runtime; a production setup should self-host and pin them.

Known limitationsLink to this section

  • Small crowd. A private payment hides you only among the deposits in the tree your proof used. On a demo pool that can be a handful of people.
  • The server can shrink the crowd further by serving different browsers different-length deposit lists and watching which tree a payment uses.
  • Timing and amount. Topping up right before paying, or paying a 15 USDC share with three notes back to back, can link them.
  • Network metadata. FairPay's server sees your IP on every request, including faucet and relay requests; the RPC provider sees it on deposits.
  • Notes live in browser storage. Clearing site data without a backup loses them. Extensions or scripts on the page could read them.
  • The built-in test wallet keeps its key in browser storage. Testnet only.
  • Fixed 5 USDC notes, no change.
  • No exit path. Notes can only pay allowlisted merchants, and deposits can be frozen by the owner.
  • Few confirmations. The FairPay app waits for 2 by default (PAYMENT_CONFIRMATIONS). Raise it for anything of value.
  • One server process. Rate limits and locks are in memory.

Back to top

Before anything like mainnetLink to this section

An independent audit; owner keys in a Safe; self-hosted, hash-pinned proving files; a monitored, rate-limited relayer; no demo wallet or faucet; a confirmation depth that matches Monad's finality; legal review of running a privacy pool where you operate.

About the demo on this siteLink to this section

The demo at /app/ simulates the original FairEats server and the chain in your browser. It is not the FairPay app. It holds no keys and builds no proofs, and the site's Content-Security-Policy only allows it to load files from this site. Simulated receipts are labelled "simulated". The only explorer links they show go to a real example transaction, and those links are labelled as such.

ReportingLink to this section

Report vulnerabilities privately to the maintainers, not in a public issue.