Free · F1
License of every repo needed to run the product
Does every repository needed to run the product carry an OSI-approved license?
Why it matters
Visible code without a license is not legally forkable. Source-available licenses (BUSL, SSPL, ELv2, Commons Clause) keep the vendor's permission in the loop for exactly the scenario where you need to run without them.
Scoring anchors
| OSI-approved license on every repo in repos. | |
| OSI-approved on contracts and SDK; one non-critical repo missing a license or source-available. | |
| Source-available (BUSL, SSPL, ELv2, Commons Clause, custom) on a critical repo. | |
| No license, or terms requiring provider permission to run a fork. | |
| No admissible evidence submitted yet. Counts as 0 in the pillar. |
Admissible evidence
- LICENSE file at a pinned commit, per repo verified
Common failures
- README says "open source" with no LICENSE file. That is a claim.
Current ratings
| Provider | Score | Finding |
|---|---|---|
| Aleo (credits.aleo private transfers) | Every listed repository, including all required ones (node, VM and settlement program), carries an OSI-approved licence. Closed components (hosted API, proving and scanning services, consumer wallets) are optional. | |
| AnomaPay | The transaction and proving service and the indexer are required and closed, so F1 is 0. The resource-logic repo needed to prove AnomaPay transfers also has no licence. | |
| Avalanche Card | All required components are closed and proprietary, so F1 is 0. | |
| Avici Card | Required components are closed, so F1 is 0. | |
| Aztec (Alpha mainnet private token transfers) | Everything needed to run the protocol is Apache-2.0. The network-config repo the node reads by default has no licence; the same mainnet values are compiled into the CLI (chain_l2_config.ts), so it is not critical. Scored 2: one non-critical repo unlicensed. | |
| Bitget Wallet Card | Required components (authorizer, backend, card processing, issuer) are closed, so F1 is 0. The verified contracts carry MIT SPDX headers, but they are not in any public repo. | |
| Blanksquare (Shielder) | Every listed repo, and every required component, carries an OSI licence (Apache-2.0, MIT, GPL-3.0 with an added Classpath permission). The closed web and mobile apps are not required to settle. | |
| COCA Card | Required components are closed and proprietary, so F1 is 0. | |
| Coinbase Commerce (Onchain Payment Protocol) | Three required components are closed: the Charge API, the operator signer and the merchant backend. A closed component cannot be forked, so the cell is 0. The public contracts also carry mixed signals: the repo license is Apache-2.0, but every source file is tagged UNLICENSED. OnchainKit and the client libraries are MIT. | |
| Curvy | The public repositories carry OSI licences. The exception is ICurvyVerifiers.sol, an interface file under BUSL-1.1. The API, the Portal Broadcaster and the circuit-key host are required and closed. Scored 0. | |
| Daimo Pay | Every public repo needed for the product carries an OSI-approved license: the SDK is BSD-2-Clause and the contracts are GPL-3.0-or-later. The product also needs four closed components that carry no license a third party can use: the Daimo API, the relayer service, the price signer, and the indexer (see `components`). Under the updated rule a closed required component counts as unlicensed, because it cannot be forked, so F1 is 0. The public repos alone would score 3. Two housekeeping issues remain: the root LICENSE file is a symlink to packages/connectkit/LICENSE, a path that does not exist at any commit, and the root BSD text does not mention the GPL headers on the contracts, so GitHub reports the license as NOASSERTION. Neither restricts forking the public code. | |
| Deblock Card | All required components (app, ledger, issuing) are closed and proprietary. Nothing can be forked. | |
| Ethena Pay | Explorer-verified facets carry SPDX MIT headers, but required components (factory implementation, executor co-signer, relayer, backend, Rain, issuer) are closed and there are no repos. 0. | |
| ether.fi Cash | The only public repo has no LICENSE file. Per-file SPDX headers are MIT, except six vendored BUSL-1.1 files. Required components (app, card backend, Turnkey, issuer, Visa, KYC) are closed, so F1 is 0 regardless. | |
| Exa Card | The backend and app repo has no license. The market contracts are source-available (BUSL-1.1). The issuer, network and Rain are closed. Closed required components alone set F1 to 0. | |
| Fluidkey | The required app and backend are closed, so F1 is 0 by rule. | |
| Fuse Card | The public repos carry OSI licences. The Fuse app, backend and Bridge integration are required and closed, so 0. | |
| Gnosis Pay | Contracts, SDK and frontend all carry OSI licences (Apache-2.0, MIT, LGPL-3.0). Two non-critical repos, docs and pse-react-native, have none. F1 is now scored against the component inventory, not only the listed repos. A card payment cannot complete without closed, proprietary components: the Gnosis Pay API and authorisation backend, the spend delegate signer, the relayer, Monavate, Visa and Sumsub. A closed required component cannot be forked, so F1 is 0. On the public repos alone this would have been 2. | |
| HesabPay | The product is proprietary. No public repository exists, and the only license offered is a limited, non-transferable use license, so a third party cannot fork or run it. | |
| Hinkal | The settlement contracts and circuits are BUSL-1.1, with no LICENSE file stating its terms. The proving keys are a required component that is closed. The Go and iOS SDKs and the enclave source have no licence. Scored 0: a required component is closed, and the critical contracts are source-available. | |
| Holyheld Card | The only public repo is source-available (BUSL-1.1), and the contracts, backend, app, issuer and network are closed. A closed required component cannot be forked, so 0. | |
| Houdini Swap | The components needed to run a Houdini swap (API, routing engine, exchange partners) are closed, so nothing that runs the rail can be forked. Of the two public client repos, one is MIT and one is unlicensed. | |
| Hyperbeat Card | All required components are closed. 0. | |
| Jupiter Card | Required components are closed, so 0. | |
| M-Pesa | Two of the seven listed SDK repos (Java, C#) carry no license at all, so they cannot legally be forked. Two more (listener, PHP) declare ISC/MIT only in a package manifest, with no license text; they are recorded as "none" in repos. The platform needed to run the rail has no public code at all. Judgment call: scored on the listed SDK repos because no repo can run the product. | |
| MetaMask Card | Nothing in the payment path is under an OSI license. The client is inspect-only, the settlement contract is UNLICENSED, and the backend, operator keys, issuer and network are closed. Closed required components alone set F1 to 0. | |
| Opera MiniPay | The app and backend needed to run MiniPay are proprietary and closed. A third party cannot fork them. | |
| Monero | Every repository needed to run the rail (node, wallet library, CLI and GUI) is BSD-3-Clause. The meta repository (process documents) has no licence file, but nothing needs it to run. It is not listed under repos because nothing runs from it. | |
| Nullmask | Required components are closed, so F1 is 0. | |
| Oobit Card | Required components are closed, so 0. | |
| Payy Card | The repo needed to run the rollup has no license, and the settlement contract is marked UNLICENSED. The wallet app and backend are closed. 0. | |
| Phantom Cash | Required components are closed, so 0. | |
| Plasma One | Required components are closed (Plasma One backend, Rain signers, the unverified beacon), and no repo carries any licence. 0. | |
| Privacy Pools (0xbow) | The contracts, circuits, SDK and relayer are Apache-2.0. The ASP service, which a private withdrawal requires, is closed, so F1 is 0 by rule. The website is non-commercial CC BY-NC 4.0, which is not an OSI licence; it is not required. | |
| Railgun | The SDK repos are MIT and Railway is AGPL-3.0, but the settlement contracts and circuits, both required, carry no licence and explicitly grant none. Scored 0. | |
| Request Network | Every repo needed for the open path carries an OSI-approved licence (MIT): the contracts, the SDK, the Request Node, both subgraphs, and the Helm chart. Two non-critical repos have no LICENSE file. The first is web-components, the optional invoice widgets; their npm packages declare MIT. The second is docker-images; the IPFS swarm image can be rebuilt from Kubo and the swarm key. The closed components (API, Secure Payment page, Request Finance) are not required. Judgment call: anchor 2 allows one unlicensed non-critical repo and we found two. We still score 2, because neither repo is needed to run a payment. | |
| Rizon Card | The required components (Rain, Privy, the issuer, the Rizon app) are closed, so nothing needed to run the product can be forked. | |
| SafePal Card | Required components (authorizer, backend, card processing, issuer) are closed, so F1 is 0. The verified contracts carry MIT SPDX headers, but they are not in any public repo. | |
| Solayer Card (Emerald Card / Solayer Pay) | Required components are closed, so 0. | |
| Tongo (confidential ERC-20 on Starknet) | Both repositories needed to run the protocol carry Apache-2.0. The cairo-abi-codec GitHub repo has no LICENSE file, but its npm package declares ISC; we did not list it as a repo. The docs repo is unlicensed but not needed to run. | |
| Tornado Cash (Classic pools) | Every required component carries an OSI licence: GPL-3.0 for the pools, circuits and proof client, and MIT for the classic UI. The circomlib fork used in proof generation states GPL-3.0 only in package.json, with no LICENSE file; its upstream is GPL-3.0. The optional tornado-cli, relayer and subgraph repos have no LICENSE file. Judgment call: we count the package.json declaration on circomlib as a licence, and we take 2 rather than 3 because of the unlicensed optional repos. | |
| Tria | All required components are closed. 0. | |
| Tuyo Card | The account contracts are MIT, but the required app, backend and card services are closed. 0. | |
| Umbra Cash | Every required component is MIT. The optional subgraph repo has no licence. Scored 2. | |
| Wirex One | The contracts are published as UNLICENSED, and the app, API, oracle, issuer and Privy are closed. Nothing needed to run the product can be forked. | |
| Wise | The components needed to run Wise are proprietary and closed, so nothing that runs the rail can be forked. Among the public repos, four carry MIT or Apache-2.0 licences and wise-platform-samples has none. | |
| WORM (BETH proof-of-burn) | The contracts and circuits repos carry MIT, though the deployed source files say UNLICENSED in their SPDX headers. The proof client a payer or payee needs to settle without the hosted prover, worm-miner, has no licence, and neither do the frontend and trusted-setup repos. Scored 0: a repository needed to run the product has no licence. | |
| XPlace Card | The only public repo is source-available (BUSL-1.1), and the XPlace app, backend and Rain card programme are closed. Required components are closed, so 0. | |
| Zcash (shielded transfers) | Every repository listed carries an OSI-approved licence, including the required node and protocol libraries. The Zodl Android SDK is AGPL-3.0-only, which is OSI-approved but copyleft, and is also sold under commercial terms. | |
| zERC20 (zBNB on BNB Chain) | The token and Verifier source is BUSL-1.1 with no additional use grant, so production use of a fork needs a commercial licence until 2030. The required root prover and indexer are not public. Scored 0: required components are closed, and the core contracts are source-available only. |