Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Base Transfers deployments of the Commerce Onchain Payment Protocol. OnchainKit Checkout, the only public Commerce checkout SDK, forces base.id and USDC on Base (CheckoutProvider.tsx L297-L300, constants.ts L49 at 3ecbd8fd). Sampled Transferred logs put Base payments on 0x0305…b7a8 until 2026-04-01; 0xeADE…4971 is the README address. Excluded: Ethereum 0x1DAe…b25C, Polygon 0xc225…28FB, older Base deployments, testnets.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
The Commerce Terms (last updated 2025-10-29, read from a Wayback snapshot because coinbase.com returns 403 to curl) bar merchants who are in, controlled by, or nationals or residents of Cuba, Iran, North Korea, Sudan or Syria, and bar supplying the Services to those countries or their nationals or residents. They also bar "any other country subject to United States embargo or HM Treasury's financial sanctions regime" without naming more; only the five named countries are listed. The Terms are addressed to merchants; payers reach the product through a merchant, and the supply clause covers them. Protocol level: the Transfers contract has no geographic filter, and a payee acting as its own operator can sign intents without Coinbase (see C2, C4). No first-party allowlist of merchant countries was found (help.coinbase.com returns 403; no Wayback copy of a supported-countries page). The product is being retired in favour of Coinbase Business Checkouts.
Commerce Terms (last updated 2025-10-29), export controls and sanctions clause, names Cuba, Iran, North Korea, Sudan and Syria plus any other country under US embargo or HM Treasury sanctions.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 3 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
One externally owned account can pause every payment method of both Base Transfers contracts at once, with no multisig and no timelock. The same key can appoint a sweeper (see S1). Pause is global; the contract has no per-address blacklist. A second control sits outside the contract: every payment needs a TransferIntent signed by its operator, and for Commerce payments that operator is Coinbase, which can decline to sign for any payer or merchant without notice (README L60-L65). The contracts were not paused at block 52285285.
Evidence (4)4 verified
Verified
pause() and unpause() are onlyOwner; every payment entrypoint (transferNative L147-L155, transferToken L172, transferTokenPreApproved L224, wrapAndTransfer L271, unwrapAndTransfer L298, swap paths L389/L417/L463, subsidizedTransferToken L512) carries whenNotPaused.
The owner has no code at block 52285285 (cast codesize returns 0, nonce 22); getThreshold() and getOwners() revert, so it is an EOA and not a Safe. It is also the deployer of both Transfers contracts (Sourcify deployment data).
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
3 Strong
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A payee can settle without Coinbase. It registers its own address as an operator, signs a TransferIntent for each payer, and the payer calls a documented method on the deployed contract. The README documents the ABI-level methods, the addresses and the permissionless operator role, and the deployed code matches the repo exactly. Refunds have no onchain path because payments are atomic; nothing is held to refund. The direct path still depends on the owner not pausing the contract (C1). Judgment call: we read "payer or payee completes settlement" as satisfied when the payee acts as its own operator, because the operator signature then comes from a party to the payment and not from the provider.
Evidence (3)3 verified
Verified
README states that registering as an operator is permissionless and that Coinbase controls only the operator address used for Coinbase Commerce; L10-L24 lists the deployed addresses, including Base 0xeADE6bE02d043b3550bE19E960504dbA14A14971, and L81-L104 documents each payment method.
registerOperator and registerOperatorWithFeeDestination have no access modifier; validIntent (L79-L124) only requires the intent to be signed by the intent's own operator, so a payee registered as its own operator can sign intents for its payers.
Sourcify reports exact_match (creation and runtime) for the README Base address, and its Transfers.sol, ITransfers.sol and Sweepable.sol are byte-identical to the repo at d891289; paused() returns false at block 52285285.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A Commerce payment needs three things only Coinbase runs and has not published: the Charge API, the operator key that signs each TransferIntent, and the merchant account. The public SDK can point at another RPC URL, but only Coinbase serves the cdp_ charge methods. On 2026-10-07 api.commerce.coinbase.com returned HTTP 503 and commerce.coinbase.com returned 502 to curl. Judgment call: we score 1 and not 0, because anchor 0 says single-vendor, and the protocol documents that anyone can register as an operator. No operator code exists to self-host, so it cannot be 2.
Evidence (4)3 verified · 1 documented
Verified
The checkout obtains the signed TransferIntent and contract address only from the JSON-RPC methods cdp_hydrateCharge or cdp_createProductCharge, sent to the CDP endpoint built in getRPCUrl.ts L7-L16 (throws without a CDP API key or rpcUrl).
The merchant client library defaults to https://api.commerce.coinbase.com/ for creating charges; no repo in the coinbase org contains the Charge API, the operator signing service, or an alternative operator implementation.
CDP docs direct Commerce merchants from the Charge API at api.commerce.coinbase.com to the Coinbase Business Checkouts API; the Commerce API docs no longer resolve (docs.cdp.coinbase.com/commerce/... returns 404).
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The settlement contract has no address or geographic filter. Filtering sits at the edge: Coinbase, as operator, can refuse to sign an intent. The README says this power exists, and the Terms name the sanctions lists Coinbase applies to merchants. A payee who acts as its own operator bypasses it (C2). The cell misses 3 for two reasons. The disclosure in the repo does not name a list source; only the Terms do. And the API and signer that apply the filter are closed, so we cannot see what they screen in practice, including payer screening. No trace was run.
Evidence (3)2 verified · 1 documented
Verified
The only per-payment checks are the operator signature, deadline, non-zero recipient, replay and operator registration; a search of contracts/ for blocklist, sanction, deny, allowlist or country finds nothing.
The README discloses that the operator signature lets an operator be selective about which payments to allow based on internal policies, legal requirements or other reasons.
Commerce Terms (last updated 2025-10-29) bar embargoed countries and persons on the SDN, Denied Persons, Unverified and Entity lists and HM Treasury's sanctions regime.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Chains and Transfers addresses are listed in the repo, and the SDK checkout's settlement token, USDC on Base, is in code. The hosted checkout's accepted-token list lives only in the closed API. Nothing in the repo, the SDK, or the Terms tells payees that Circle can freeze USDC or that Base runs a centralized sequencer. Judgment call: we score 2 and not 1, because the enumeration for the public path is in code. The hosted checkout's list being API-only is the listed common failure, and it keeps the cell from 3.
Evidence (2)2 verified
Verified
Deployments are enumerated per chain (Ethereum, Polygon, Base, plus testnets); L5-L7 says payers may use any token with Uniswap liquidity.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Both Base Transfers contracts are exact matches on Sourcify. The cell misses 3 because the repo has no build script that reproduces the bytecode. The contract that carried most Base payments (0x0305…b7a8) was built from source that was never pushed to the repo; that source is public only through Sourcify. We did not check Basescan verification, because Basescan blocks automated requests.
Evidence (3)3 verified
Verified
Sourcify exact_match (creation and runtime, solc 0.8.17, verified 2024-10-20); its Transfers.sol differs from the repo by a permit nonce check and PermitCallFailed error that exist only in the Sourcify sources.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The contracts, a now-deprecated SDK checkout component, and the old API client libraries are public. The Charge API, the operator signer, the hosted checkout page, the merchant dashboard and any indexer are closed. The Commerce API reference has been removed from Coinbase's docs. Judgment call: we score 1 and not 0, because the public contracts can be used without the closed stack (C2).
Evidence (2)2 verified
Verified
The protocol repo holds only Transfers.sol, Sweepable.sol and three interfaces; no deploy scripts, tests, operator service, API or indexer.
Can a stranger reach a working deployment from the README? O3
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The docs are enough to operate the deployed contract as your own operator, though you would have to write the signing and frontend code yourself. They are not enough to rebuild Coinbase Commerce. Reproduction not attempted, so the cap is 1.
Evidence (1)1 verified
Verified
The README explains operators, TransferIntent fields and signing, and lists addresses (L10-L24), but gives no build, deploy or operator-service steps.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
ABIs can be derived from the verified source, and the events are in the repo. No repo has an API schema; the Charge API was only ever described on hosted docs, which are now replaced by a migration page. We found no payee data export in any format. Judgment call: we score 1, because the API schema is not in the repo.
Evidence (2)1 verified · 1 documented
Verified
The Transferred, OperatorRegistered and OperatorUnregistered events and the TransferIntent struct (L19-L30) are defined in source; no ABI JSON is committed.
Does every repository needed to run the product carry an OSI-approved license? F1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Three required components are closed: the Charge API, the operator signer and the merchant backend. A closed component cannot be forked, so the cell is 0. The public contracts also carry mixed signals: the repo license is Apache-2.0, but every source file is tagged UNLICENSED. OnchainKit and the client libraries are MIT.
Evidence (1)1 verified
Verified
The repo LICENSE.md is Apache License 2.0, but every Solidity file starts with SPDX-License-Identifier UNLICENSED (Transfers.sol L1, Sweepable.sol L1, ITransfers.sol L1).
Can the provider unilaterally relicense future versions, and has it committed not to? F2
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
We found no CLA and no relicensing event. The repo makes no written commitment to keep the license stable. The UNLICENSED SPDX headers are an ambiguity, not a relicense, and are noted under F1.
Evidence (2)2 verified
Verified
The repo root holds only .gitignore, LICENSE.md, README.md and contracts/; there is no CONTRIBUTING, CLA or license-stability statement. Merged PR
Does a production deployment need a proprietary plugin or hosted-only service? F3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A Coinbase Commerce deployment needs the hosted Charge API and Coinbase's operator key, and no open alternative is published. The settlement contract does not need them, since any operator can use it. Judgment call: we score 1 and not 0, because the core contract can run without proprietary parts. A merchant would still have to write their own operator and checkout code, because none exists in the open.
Evidence (2)2 verified
Verified
The checkout's charge calls throw "API Key Unset" without a Coinbase Developer Platform API key or rpcUrl, and only Coinbase serves the cdp_ charge methods.
What can an observer learn, and did the user knowingly choose it?
1 WeakPillar rating: weakest of 5 1 of 5 Partial or better
What would raise this pillar
Tracking and analytics reaching Partial: Present, off by default, opt-in visible in code.
Data collected beyond payment reaching Partial: Additional fields are either optional and clearly optional in code, or legally required, limited to that requirement, and disclosed with their legal basis in code or a versioned repo document.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Telemetry is on by default in both payment frontends. The SDK checkout sends the payer's address and amount to Coinbase's analytics endpoint unless the integrator sets analytics to false. The hosted checkout bundles Amplitude, Sprig (which includes session-replay code), Bugsnag and Coinbase's own analytics service. The privacy policy discloses analytics providers only by category. Judgment call: we score 1 and not 0, following the Daimo precedent: the policy disclosure covers analytics in general, even though it names no vendor. We found no fingerprinting library; the "fingerprint" matches are Bugsnag ID helpers and icon names.
Evidence (4)2 verified · 2 documented
Verified
On pay, the checkout sends a checkoutInitiated event with the payer address, amount and productId; analyticsService.ts L11-L47 posts it with apiKey, sessionId, page origin and document.title to https://api.developer.coinbase.com/analytics.
Steps run 2026-10-07: curl the page, then curl its two bundles /pay/static/main.3b876a63b31216f2b5a8.js and /pay/static/27849.279546bfef0c8b7f57c7.js and grep. The bundles initialise Amplitude (amplitudeApiKey a576ff6d…), the Sprig SDK (api.sprig.com, session-replay code), Bugsnag, Coinbase's as.coinbase.com analytics service and reCAPTCHA Enterprise.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The public SDK request carries only what settlement needs. The privacy policy says Commerce also collects device, IP and cookie data. It analyses payers' wallet addresses on public chains, and it lets merchants collect further customer fields at checkout. All of this is disclosed only in the policy. The hosted checkout's form code is closed, so we could not see which fields are optional.
Evidence (2)1 verified · 1 documented
Verified
The SDK charge request carries only the payer address and a chargeId or productId.
The policy lists device, browser, IP and cookie data collected automatically, blockchain analysis of wallet addresses, and personal information merchants choose to request from customers.
What do calldata and events reveal about who paid whom for what? P3
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every payment publishes payer, payee, amount and a per-charge id in a single event, with Coinbase's operator address indexed. Anyone can list all of a merchant's Commerce payers and revenue by filtering on the operator and recipient. The README documents the event fields. The protocol offers no fresh-address or privacy option, because the recipient is the merchant's fixed wallet.
Evidence (2)2 verified
Verified
Transferred emits the operator (indexed), the 16-byte intent id, the recipient, the sender, the amount and the currency; README L110-L120 documents the same fields.
The Transferred log in this swapAndTransferUniswapV3Native payment names operator 0x8fcCC78Dae0a8f93B0fE6799de888d4C57e273db, id 0x5e1eb104b16f4718bb6ef87845be984d, recipient 0xFf5680F0938B01b07952eF075B23082eB136E8Af and sender 0x33a7A26d9C6C799a02E4870137dE647674371FfC.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
In the SDK path, the only third party besides Coinbase is the RPC provider, and an integrator can replace the RPC. In the hosted path, Sprig, Amplitude, Bugsnag and Google reCAPTCHA see the payer's session, and nobody can swap them out. The policy discloses them only as categories. Judgment call: we score 1 and not 0, because the vendors appear in shipped code and are covered by the category disclosure. They are not named in any document.
Evidence (3)1 verified · 2 documented
Verified
Balance reads go to Coinbase's CDP node when an API key is set, otherwise to viem's default public RPC; the charge call and analytics go to api.developer.coinbase.com; insufficient balance opens keys.coinbase.com (CheckoutProvider.tsx L303-L309).
Steps run 2026-10-07: grep of the hosted checkout bundles (see P1) shows requests to api.commerce.coinbase.com, api.sprig.com, Amplitude, Bugsnag, as.coinbase.com, google.com/recaptcha and mainnet.base.org.
Can RPC and indexer URLs be changed, and is the indexer code public? P5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The SDK's endpoints can be changed in code, but not in a UI. The charge methods only work against Coinbase, and no indexer code is public, so payment data cannot stay inside the integrator's own perimeter. The hosted checkout has no endpoint setting at all.
Evidence (1)1 verified
Verified
rpcUrl overrides the CDP endpoint, and analyticsUrl overrides the analytics endpoint (analyticsService.ts L38); defaultPublicClients overrides the read client.
Who holds funds between payer and payee, and can the provider redirect them? S1
3 Strong
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A completed payment moves from payer to merchant inside one atomic transaction, so funds are never held across blocks. The Commerce Terms state that Coinbase does not store the crypto merchants receive (see S4). Once a merchant has been paid, the provider cannot redirect the money. The recipient is fixed in the operator-signed intent, which the payer's wallet shows before signing. The contract does hold residual balances, about 6,250 USDC across the two Base contracts. These are most likely tokens sent to the contract directly by mistake, and the owner EOA can sweep them through a sweeper it appoints. Judgment call: we score 3, because the sweep reaches only stray balances and never funds in an in-progress payment.
Evidence (3)3 verified
Verified
Inside the payer's own transaction, the contract pulls exactly recipientAmount+feeAmount (L189-L214) and immediately sends recipientAmount to the intent's recipient and feeAmount to the operator's fee destination; if any step fails, the transaction reverts.
sweeper() is the zero address at block 52285285; the contract nonetheless holds 4,578.07 USDC (0xeADE…4971 holds 1,673.48 USDC) that did not arrive through a completed payment and that an owner-appointed sweeper could move.
Who can change the contract code, and with how much notice? S2
3 Strong
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Neither Base Transfers contract can be upgraded. Coinbase changes behaviour by deploying a new contract and pointing its API at it. It has done this at least six times on Base, and the new address carries no notice to anyone integrating directly. Integrators who call a fixed address keep the old code. The pause power is scored under C1.
Evidence (3)3 verified
Verified
The EIP-1967 implementation and admin slots both read zero at block 52285285; the verified source has no delegatecall, upgradeTo or selfdestruct.
How large an allowance does the SDK ask users to grant, and for how long? S3
3 Strong
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The SDK asks for an exact-amount approval to the Transfers contract. The contract's other token paths use Permit2 or EIP-2612 permits for the exact amount, with a deadline. The hosted checkout bundles the Permit2 SDK. Its one-time token approval to Permit2 is not readable from the minified code, and that approval may be unbounded. Permit2 still enforces the per-payment amount and expiry.
Evidence (2)2 verified
Verified
The SDK batches approve(transfersContract, recipientAmount + feeAmount), an exact amount, with transferTokenPreApproved.
The Permit2 path requires requestedAmount == recipientAmount+feeAmount and uses a SignatureTransfer permit with deadline; subsidizedTransferToken (L505-L536) uses an EIP-2612 permit for the exact amount, expiring at the intent deadline.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived from S1=3, C2=3, C3=1 and O3=1. Payees already hold their funds, which arrive in their own wallet atomically (S1). Settlement can continue in principle: a payee can register as operator and sign intents against the unpaused, non-upgradeable contract (C2). No public frontend or operator service exists to do this (C3, O3), and the public SDK only works against Coinbase's API. That fails the anchor-3 condition of a public frontend build. A paused contract would also stay paused if the owner key were lost (C1).
Evidence (3)2 verified · 1 documented
Verified
Merchant funds land in the recipient address inside the payment transaction, so nothing remains to withdraw afterwards.
The README-documented contract is non-upgradeable (implementation slot zero) and unpaused at block 52285285, so the self-operator path from C2 stays usable if Coinbase disappears with the contract unpaused.
Are secrets kept out of client bundles and are webhooks signed and verified? S5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Merchant API keys stay on the server, and the reference code verifies webhooks. The SDK puts a CDP client key in the browser. That key is meant to be public, but it does authorise charge creation for productId checkouts. No repo describes key scoping or rotation, and the PHP client was last changed in 2021.
Evidence (2)2 verified
Verified
The reference client verifies the webhook signature as HMAC-SHA256 over the raw payload with a constant-time comparison (Util::hashEqual); the API key goes only in a server-side X-CC-Api-Key header (ApiClient.php L214-L224).
The browser bundle embeds a CDP client API key in the RPC URL path and in analytics payloads; that key is a client key meant to be public and authorises the cdp_ charge and RPC calls.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
We found no audit report for any Transfers deployment. The live Base contract (0x0305…b7a8) carries a fix that is not in the repo. Coinbase runs a bug bounty on HackerOne, but no repo states its scope.
Evidence (2)2 verified
Verified
The repo has no audit report, no tests and no SECURITY file at this commit; a GitHub code search for a Commerce onchain protocol audit returns nothing.
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
No published audit report was found.
Compiled from: The coinbase/commerce-onchain-payment-protocol repo (no audits folder, SECURITY file or tests; GitHub code and commit searches for "audit" return nothing), the coinbase/.github security policy (HackerOne bug bounty, not an audit), Coinbase's Commerce protocol announcement and docs, web searches for a Transfers contract audit, and auditor portfolios (Trail of Bits publications, Spearbit portfolio, OpenZeppelin, Nethermind). No published audit of any Transfers deployment was found. The separate Commerce Payments Protocol (AuthCaptureEscrow) is a different contract set and is not the assessed path. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 17 evidenced, 0 attested, 6 absent, 4 not applicable, 18 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
provider
payee
1% in the sampled payment (0.03 of 3.00 USDC to the operator fee destination)
feeAmount is set per TransferIntent by Coinbase as operator and sent to its registered fee destination; the Terms point to a Fee page (coinbase.com returns 403 to curl) and allow changes with notice.
network
payer
Base sample 2026-04-01, about 0.0000012 ETH (235,051 gas at 0.005 gwei plus L1 fee)
Gas of the last Commerce payment found on Base (swapAndTransferUniswapV3Native, tx 0xb20c…e2fb); varies with Base gas price and payment path.
The fee rate is from one observed payment, not from a fee schedule; the Fee page the Terms cite could not be read. The swap path adds Uniswap pool fees and slippage, paid by the payer, which are not itemised. No limits were found.
Verified
Receipt read 2026-10-09: the payer spent 0.001405 ETH, swapped to 3.00 USDC; USDC Transfer of 30000 (0.03) to 0x6d86…29c8 and 2970000 (2.97) to recipient 0xFf56…6E8Af; Transferred log from 0x0305…b7a8 with operator 0x8fcC…73db. gasUsed 235051, effectiveGasPrice 5000150 wei, l1Fee 10808119346 wei.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Self-custody
Agrees with S1 (score 3). Payments move payer to merchant wallet atomically; the Terms say Coinbase does not store the crypto merchants receive. Stray balances in the contract can be swept by an owner-appointed sweeper; they are not payment funds.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licences and registrations
Absent
Absent for the contracting entity. Searched: the BMA regulated-entities register (full page, string "Coinbase Bermuda Technologies" not found), the Commerce Terms and Privacy Policy. The affiliate Coinbase Bermuda Services Limited holds a BMA Class F licence covering payment services with digital assets (registration 202302681, effective 2023-09-15), but no Commerce document names it, so it is not recorded as a partner licence. Other Coinbase group licences (US, EU, UK) were not searched because the Commerce Terms name only the Bermuda entity.
Documented
The Bermuda Monetary Authority's register of regulated entities lists two Coinbase affiliates (Coinbase Bermuda Limited and Coinbase Bermuda Services Limited, both Class F digital asset business licences) and no entry for Coinbase Bermuda Technologies Limited.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
N/A: falls to the institution
The Privacy Policy mentions affiliates converting crypto to fiat and withdrawing to a bank account; no first-party cash-out terms for Commerce merchants were found (help.coinbase.com returns 403).
Payments settle to the merchant's own wallet; the Terms say Coinbase does not store the crypto received. Converting it to local currency is outside the product.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2024-10-14 (block 21073248): Transfers 0x0305…b7a8 on Base, the contract that carried Base payments; the README address 0xeADE…4971 was deployed earlier, at block 17832328 (2024-07-31).
Judgment call. Recorded the primary settlement contract (0x0305…b7a8). The protocol has earlier Base deployments that are not in the provider's contracts list (DefiLlama tracks six Base addresses), so the rail is older than this date; those were not dated here.
Verified
Sourcify creation data gives transactionHash 0x84f4bb975782746100fde2d23fd5250cfebb8efa26b9f6a97808cdaa22ae6f62, blockNumber 21073248, deployer 0x8899CECFD929504414696C734eAf6300FDbB428C (the owner EOA); block time 2024-10-14 UTC.
Sourcify creation data gives tx 0x29836b71657b710efae9c81e34220aca20a40049e410e2f68bdffb8cc69d82ea at block 17832328 by the same deployer; block time 2024-07-31 UTC.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Coinbase Bermuda Technologies Limited, BM
From the Terms only; the Bermuda Registrar of Companies entry was not looked up (its search is not machine-readable), so there is no register URL or number.
Documented
Commerce Terms (last updated 2025-10-29) name the provider of the Services.
2024-04-21: Payments from Coinbase retail accounts unavailable; self-custodial wallet payments continued (impact minor). funds lost: unknownsource
2024-04-21: Donations on Commerce unavailable; status update says funds are safe (impact minor). funds lost: nosource
2025-09-17: Delayed payment confirmations from Coinbase accounts and self-custodial wallets on Polygon; transactions submitted but did not confirm (impact minor). funds lost: unknownsource
2025-10-20: Coinbase-wide login and transaction outage caused by an AWS outage; status update says funds are safe (impact minor). funds lost: nosource
Absence of a found incident is not evidence that none occurred.
Service incidents only; no security incident or loss of payment funds was found. Searched: the Commerce status page feed, the protocol repo (no SECURITY file, no advisories) and the org SECURITY.md. The 2025 Coinbase customer data incident concerned Coinbase retail accounts and is not recorded for Commerce; no Commerce primary source mentions it.
Documented
Statuspage incidents feed, 50 incidents from 2021-01-06 to 2026-03-20; listed here are those since 2024 (the onchain-protocol period) with impact above none.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2024-10-14: New Transfers contract 0x0305…b7a8 deployed on Base from source that was never pushed to the repo (permit nonce fix); it carried Base payments from then on. source
2025-10-29: Commerce Terms of Service updated (current version). source
2026-04-01: Last Transferred event found on Base in the seed scan (block 44134913); none found since in sampled windows. Coinbase now directs Commerce merchants to the Coinbase Business Checkouts API. source
2026-09-22: OnchainKit, the public checkout SDK, deprecated and its repository archived. source
The product appears to be winding down; no dated first-party retirement notice was found (coinbase.com returns 403).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Unknown
not computed on 2026-10-19: eth_getLogs: request limit reached
Spec checked against the log in tx 0xb20c…e2fb (word 3 = 1405295302545581, word 4 = 0). The seed scan found no Transferred event on Base after 2026-04-01, so a 30-day window will likely return zero events. Not computed; the maintainer runs scripts/volumes.mjs.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown implied from the component list
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown implied from the component list
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown implied from the component list
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown implied from the component list
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown implied from the component list
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Absent
none of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✗ no security policy file; coinbase/onchainkit (archived) ✗ no security policy file; coinbase/coinbase-commerce-php ✗ no security policy file source 1 · source 2 · source 3
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Absent
Searched: Commerce Terms and Privacy Policy (archived), the protocol repo, and the coinbase org SECURITY.md (points to HackerOne, no timelines). coinbase.com/security returns 403 and has no Wayback snapshot. source 1 CROPS S6
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Evidenced
some of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✗ no scanning config or workflow step found; coinbase/onchainkit (archived) ✓ scanning step in a workflow; coinbase/coinbase-commerce-php ✗ no scanning config or workflow step found source 1 · source 2 · source 3
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Absent
Searched both documents for notify, notification, breach and incident; the only notice commitment concerns changes to the arbitration agreement. source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
N/A: no such service implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
N/A: no such service implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Statuspage at status.commerce.coinbase.com with 50 incidents since 2021; updates are short status notes and no post-mortem with root cause was found. source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
N/A: no such service implied from the component list
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
N/A: no such service implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Evidenced
The SDK checkout calls Coinbase's JSON-RPC endpoint with a public CDP client key in the URL path; no OAuth, OpenID Connect or JWT on the Commerce path. The successor Checkouts API uses JWT bearer tokens. source 1 CROPS S5
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Evidenced
Charge API calls use a static X-CC-Api-Key header held server-side; webhooks are HMAC-SHA256 signed and verified in constant time by the reference client. No key scoping or rotation is documented. CROPS S5
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown implied from the component list
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Information is retained as needed under internal retention policies, with no fixed periods; on account closure data is retained or deleted per the policy. Coinbase may terminate access with immediate effect. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Coinbase Bermuda Technologies Limited processes merchant and user data under the policy; processing it does as processor on behalf of merchants is excluded from the policy. No DPIA is mentioned. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Absent
Searched the Terms and Privacy Policy for processing agreement, addendum and DPA; the Wayback Machine has no snapshot of coinbase.com/legal/commerce/data-processing-agreement; coinbase.com returns 403 to curl. source 1
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Absent
none of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✗ no deployment configuration; coinbase/onchainkit (archived) ✗ no deployment configuration; coinbase/coinbase-commerce-php ✗ no deployment configuration source 1 · source 2 · source 3
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Evidenced
some of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✗ no .github/workflows; coinbase/onchainkit (archived) ✓ 14 workflow file(s); coinbase/coinbase-commerce-php ✗ no .github/workflows source 1 · source 2 · source 3
B9.3 Tests run in CI Do the CI workflows run the test suite?
Absent
none of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✗ test command in a workflow; coinbase/onchainkit (archived) ✗ test command in a workflow; coinbase/coinbase-commerce-php ✗ test command in a workflow source 1 · source 2 · source 3
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Evidenced
all of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✓ 4 of 8 recent commits signed; coinbase/onchainkit (archived) ✓ 10 of 10 recent commits signed; coinbase/coinbase-commerce-php ✓ 7 of 10 recent commits signed source 1 · source 2 · source 3
B9.7 Changelog Is a changelog maintained with the code?
Evidenced
some of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✗ no changelog or release notes; coinbase/onchainkit (archived) ✓ 6 release(s) with notes; coinbase/coinbase-commerce-php ✓ 1 release(s) with notes source 1 · source 2 · source 3
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Evidenced
some of 3 repo(s): coinbase/commerce-onchain-payment-protocol ✗ none found; coinbase/onchainkit (archived) ✓ contribution section in README; coinbase/coinbase-commerce-php ✓ contribution section in README source 1 · source 2 · source 3
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Logical view only. The protocol README explains operators, TransferIntent signing and the contract methods; no infrastructure or integration architecture for the Charge API, signer or checkout is published. CROPS C2 · CROPS O3
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Coinbase Bermuda Technologies Limited, Bermuda; the Terms' dispute clauses provide for AAA arbitration. Company-register entry not looked up; see maturity.entity. source 1
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Transaction fees charged to merchants (1% observed in a 2026-04-01 payment, paid to the operator's fee destination), within the Coinbase group. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Coinbase may terminate or suspend access with immediate effect, for any reason and without notice. Funds are already in the merchant's own wallet, so termination does not hold funds; data follows the privacy policy's retention rules. source 1 CROPS S4
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown
The Privacy Policy says Commerce analyses public blockchain data, including wallet addresses, to detect fraud and abuse, and the operator can refuse to sign intents; whether that screening is automated or uses AI is not stated, and the API and signer are closed. Searched the Terms, Privacy Policy and protocol README for automated, machine learning and artificial intelligence.
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Scope is the Commerce Onchain Payment Protocol (Transfers) on Base, as used by Coinbase Commerce charges. The product appears to be winding down. Sampled eth_getLogs on all six Base Transfers addresses DefiLlama tracks show the last Transferred event on 2026-04-01 (block 44134913) and none since. Ethereum and Polygon windows were also empty. On 2026-10-07, api.commerce.coinbase.com returned 503 and commerce.coinbase.com returned 502; www.coinbase.com/commerce now redirects to /business. CDP docs carry only a "Migrate from Commerce" guide, and OnchainKit was deprecated on 2026-09-22. Onchain reads are pinned to Base block 52285285; repo reads to commerce-onchain-payment-protocol@d891289, onchainkit@3ecbd8fd (equal to npm 1.1.3 except README) and coinbase-commerce-php@c258b69. No browser traces were run; the hosted checkout was inspected by curling its JS bundles. Search log: docs/research/coinbase-commerce.md.
