Rubric
Criteria
23 criteria across 5 pillars. Each sets out the question, what earns each score, and which artifacts count as evidence.
Censorship Resistance
Who can block valid use, and can users route around them?
- C1Admin pause or freeze powers
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained?
- C2Settle without the provider
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer?
- C3Reliance on hosted services
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs?
- C4Neutral settlement, disclosed filtering
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable?
- C5Token and chain freeze risks disclosed
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees?
Open
Is the whole stack visible?
- O1Contracts verified onchain
Does the deployed bytecode match public source, and can a third party rebuild it?
- O2Whole stack published
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public?
- O3Can be self-hosted
Can a stranger reach a working deployment from the README?
- O4Interfaces and data export
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo?
Free
Does the license actually let a third party fork, modify, and run it?
- F1Open-source licences
Does every repository needed to run the product carry an OSI-approved license?
- F2Protection against relicensing
Can the provider unilaterally relicense future versions, and has it committed not to?
- F3No proprietary dependencies
Does a production deployment need a proprietary plugin or hosted-only service?
Privacy
What can an observer learn, and did the user knowingly choose it?
- P1Tracking and analytics
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting?
- P2Data collected beyond payment
Does the flow collect anything beyond addresses, amounts, token, and chain?
- P3Payments linkable onchain
What do calldata and events reveal about who paid whom for what?
- P4Third parties in the payment flow
Which third parties see a request during a payment, and can they be swapped out?
- P5Endpoints can be changed
Can RPC and indexer URLs be changed, and is the indexer code public?
Security
Who can cause loss, lock users in, or change the rules?
- S1Who holds funds in transit
Who holds funds between payer and payee, and can the provider redirect them?
- S2Who can upgrade the code
Who can change the contract code, and with how much notice?
- S3Token approval scope
How large an allowance does the SDK ask users to grant, and for how long?
- S4Funds safe if provider disappears
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling?
- S5Secrets and webhook handling
Are secrets kept out of client bundles and are webhooks signed and verified?
- S6Audits and bug bounty
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty?