Open · O2
Full stack public
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public?
Why it matters
Open contracts with a closed backend still leave you trusting the backend. The public share of the stack is the share you can inspect, fork, or run without asking.
Scoring anchors
| SDK, frontend/widget, backend or API, indexer, and deploy scripts all public. | |
| Everything except the backend, with the API schema published. | |
| SDK or contracts only. | |
| Nothing, or a client shell that cannot run without private services. | |
| No admissible evidence submitted yet. Counts as 0 in the pillar. |
Admissible evidence
- The provider's repos list with roles; absence is the finding verified
Common failures
- Archived or stale repos counted as the live stack.
Current ratings
| Provider | Score | Finding |
|---|---|---|
| Aleo (credits.aleo private transfers) | The node, VM, settlement program, CLI and SDK are public, and the node's REST API is in its source. The hosted indexer and explorer API that the SDK and CLI use by default, and every consumer wallet we know of, have no public source. Scored 2: everything a user strictly needs is public, but the default backend and the usual frontends are not. | |
| AnomaPay | Contracts, SDK and proving libraries are public; the web app, transaction and proving service, and indexer are not. Scored 1. | |
| Avalanche Card | Nothing in the Avalanche Card payment path is public. Rain's open SDKs serve other integrators and are not shown to run this product. Judgment call: 0 rather than 1, because no public SDK or contract is evidenced as part of this card. | |
| Avici Card | Nothing in the card payment path is public. Absence is the finding. | |
| Aztec (Alpha mainnet private token transfers) | The whole protocol stack is public in one Apache-2.0 monorepo, including node, sequencer, prover, client, contracts and deploy tooling. The hosted RPC's access policy and third-party browser wallets are not public, but neither is needed. Judgment call: we score the stack a user needs, not the hosted conveniences, at 3. | |
| Bitget Wallet Card | Only the contracts are public (through Sourcify). The Bitget card screens, Fiat24's backend, the authorizer and the API are closed, and no SDK is published. Contracts only, so 1. | |
| Blanksquare (Shielder) | Contracts, circuits, SDK, relayer and deploy scripts are public, and no indexer is needed. The frontend that served Base mainnet (app.blanksquare.io) and the mobile app were not traced to public source; the public shielding-dapp does not configure Base mainnet. Judgment call: 2, everything public except the live app. | |
| COCA Card | No admissible evidence yet. | |
| Coinbase Commerce (Onchain Payment Protocol) | The contracts, a now-deprecated SDK checkout component, and the old API client libraries are public. The Charge API, the operator signer, the hosted checkout page, the merchant dashboard and any indexer are closed. The Commerce API reference has been removed from Coinbase's docs. Judgment call: we score 1 and not 0, because the public contracts can be used without the closed stack (C2). | |
| Curvy | Public: contracts, SDK, Rust prover, payments SDK and docs. Not public: the API, indexer, relayer and Portal Broadcaster, all required, and the app.curvy.box frontend. Scored 1. | |
| Daimo Pay | The contracts, the deploy scripts, the SDK, and its embeddable React modal are public. The Daimo API, the relayer, the price signer, the indexer, and the hosted deposit flow that DaimoFrame loads from daimo.com are all private. The SDK cannot run without those private services. Judgment call: we score 1 and not 2, because the frontend and indexer are closed as well as the backend. We score 1 and not 0, because the public contracts and deploy scripts are more than a client shell. | |
| Deblock Card | No admissible evidence yet. | |
| Ethena Pay | Contract source is public through explorer verification; the app, backend, executor, relayer, API and indexer are not, and no API schema is published. Judgment call: explorer-verified source counts as "contracts only" (1) rather than "nothing" (0). | |
| ether.fi Cash | Only the contracts and their deploy scripts are public. The app, web frontend, card backend, settlement bridger and indexer are closed, and no API schema is published. "SDK or contracts only" = 1. | |
| Exa Card | Exa's own stack is public: SDK and contracts, frontend, backend, indexer and deploy scripts. The closed parts are third parties (Rain, Third National, Visa, Persona, Sardine, Alchemy) and Exa's operating keys; they are scored under C3, F1 and F3. Judgment call: O2 counts what the provider runs, and all of that is published. | |
| Fluidkey | Only the SDK-level kit and contracts are public. The app, backend, resolver, relayer and indexer are closed. Scored 1. | |
| Fuse Card | Only the program and SDK are public. The Fuse app, backend and card integration are closed, and no API schema is published. 1. | |
| Gnosis Pay | Public: SDK, contracts, the full web app frontend (with Dockerfile and deploy workflows), a PSE demo backend, and docs. Closed: the Gnosis Pay API, card-transaction indexer, delay relay and spend service. The API schema is published (hosted OpenAPI plus a committed generated client). This is "everything except the backend, with the API schema published". | |
| HesabPay | No part of the stack is public. GitHub searches found no HesabPay-owned organisation or repository (search log in docs/research/hesabpay.md), and the terms reserve all IP. | |
| Hinkal | Public: contracts, circuits, the enclave-api source and several SDK wrappers. Not public: the main TypeScript SDK's source (only its npm build is published), the relayer, the snapshot, data and compliance servers, the Hinkal Pay and Wallet frontends, and the proving keys. Scored 1. | |
| Holyheld Card | The public part is the SDK source, and it cannot even be built from the repo because its core library is private. Contracts, backend, app and indexer are closed. Judgment call: this is a client shell that cannot run without private services (0), rather than "SDK only" (1). | |
| Houdini Swap | Only client code for the hosted API is public. The backend, routing engine, web app and widget are closed. Judgment call: 1 (SDK only), consistent with other incumbents with public client libraries. | |
| Hyperbeat Card | No part of the card stack is public: contracts unverified, Liquid-Bank repo private, app and backend closed. 0. | |
| Jupiter Card | No part of the card stack is public. The Solana-pay repos in jup-ag are unrelated forks. 0. | |
| M-Pesa | Only client SDKs and samples are public. The platform itself (ledger, API gateway, USSD/STK services) is closed. | |
| MetaMask Card | Public: the app-side card client (source-available) and the verified FoxConnect source on Sourcify and Lineascan. Closed: the Baanx API (no published schema), the authorisation backend and the operator service. Judgment call: this is more than "SDK or contracts only", but without the backend or an API schema it does not reach 2, so 1. | |
| Opera MiniPay | No component of MiniPay itself (app, backend, issuer service) is public. The public MiniPay code is Celo's partner snippets and Mini App templates, which do not run the wallet. | |
| Monero | Every layer of a payment is public: node, wallet library, CLI and GUI wallets, RPC servers and build scripts. Remote nodes run the same public code. Scored 3. | |
| Nullmask | Nothing in the payment path is public. Two repos under an unrelated account (rocket0xdev1025, created 2026-10-07) contain built site copies and are not first-party. Scored 0. | |
| Oobit Card | Nothing needed to run the product is public. The partner SDK is published to npm with an MIT tag, but it is a client shell around Oobit's hosted widget and its source repo is private. 0. | |
| Payy Card | The contracts, circuits, rollup node, aggregator and prover are public. The wallet app that holds keys and funds card debits is closed, and so is the card, ramps and KYC backend. Typed client bindings exist, but there is no published API schema. Judgment call: this is more than "SDK or contracts only", but both the frontend and the backend of the card path are closed, so 1. | |
| Phantom Cash | Nothing needed to run Phantom Cash is public. 0. | |
| Plasma One | Contract source is visible through explorer verification; the app, backend, API and indexer are closed and no API schema is published. Judgment call: explorer-verified source counts as "contracts only", so 1. | |
| Privacy Pools (0xbow) | Contracts, circuits, SDK, relayer, deploy scripts and frontend are public. The ASP backend (screening and root posting) and the ASP API are closed. Judgment call: the API has no published schema document, but its endpoints and response types are committed in the frontend client, which we accept as the schema for 2. | |
| Railgun | Every layer has public source, and the repos are active. We could not tie the hosted Subsquid deployment, the ppoi.fdi.network aggregator, or broadcaster builds to public commits, and the broadcaster server is public only as an example (ppoi-safe-broadcaster-example). Judgment call: 2 rather than 3 for that reason. | |
| Request Network | Every part of the open protocol stack is public: contracts, deploy scripts, SDK, Request Node, both indexers, deployment tooling, and reference frontends. The product Request's docs now steer integrators to is the hosted API, and its backend, Secure Payment page, and Dashboard are closed. Their API schema is published only on a hosted site. Judgment call: we score 2 and not 3. The open path alone would reach 3, but the backend behind the vendor's recommended integration is closed, which matches anchor 2's "everything except the backend". | |
| Rizon Card | No admissible evidence yet. | |
| SafePal Card | Only the contracts are public (through Sourcify). The SafePal card screens, Fiat24's backend, the authorizer and the API are closed, and no SDK is published. Contracts only, so 1. | |
| Solayer Card (Emerald Card / Solayer Pay) | Nothing needed to run the card is public. 0. | |
| Tongo (confidential ERC-20 on Starknet) | Contracts and the SDK are public, and no backend or indexer is needed. The demo frontend at demo.tongo.cash has no public source. Judgment call: anchor 2 means everything but the backend, which here would include the frontend, so 1. | |
| Tornado Cash (Classic pools) | Every layer has public source on GitHub, but all of it is archived since 2022. For the immutable pools and the proof client the archive is still the running code. The governance-era router and registries are public only as Sourcify source, and the frontend now served via tornadocash.eth and current relayer builds were not traced to any public repository in this review. Judgment call: between 2 and 1 we take 1, because we could not show the live frontend and relayer builds are public. | |
| Tria | Nothing in the card stack is public. 0. | |
| Tuyo Card | Only third-party account contracts are public. Tuyo's app, backend and card integration are closed. 1. | |
| Umbra Cash | Contracts, SDK, frontend, subgraph and deploy history are public. The backend (Umbra API relayer and token list) and the production Ponder indexer are closed. Judgment call: their API types are committed in the frontend, which we accept as the schema for 2. | |
| Wirex One | Contract source is visible only through Sourcify verification. The app, API, oracle, indexer and SDK are closed. Contracts only, so 1. | |
| Wise | Only client-side samples, a signing library and API collections are public. The platform that runs transfers is closed. Judgment call: 1 (SDK-level code only) rather than 0, consistent with M-Pesa's client libraries. | |
| WORM (BETH proof-of-burn) | Contracts, circuits, client, prover/broadcaster server, setup and frontend are all public, and no indexer is needed. The hosted prover at prover-2.worm.cx could not be tied to a specific public build. Judgment call: 2 rather than 3 for that reason. | |
| XPlace Card | Only third-party contracts are public. The XPlace app, backend, any XPlace contracts and the card integration are closed, with no API schema published. Contracts only, so 1. | |
| Zcash (shielded transfers) | Every layer a payment touches has public, maintained source: node, protocol libraries, light-wallet server and indexer, wallets and SDKs, plus deploy files. The only closed parts are optional store-build integrations in the mobile wallet. Judgment call: light-wallet servers are run by third parties and we cannot see which build they run, but the wallet treats them as replaceable, so we score the stack, not the operators, at 3. | |
| zERC20 (zBNB on BNB Chain) | Officially, only the contracts (as Sourcify source) and the compiled MIT SDK on npm are public. The docs' repository link returns 404. A full-stack snapshot exists under an unaffiliated personal account; we cite it only where it matches deployed bytecode and do not treat it as the provider's published stack. Judgment call: 1 (contracts and SDK only). |