Where it is offered
Offered everywhere, per the provider's code or documents. Checked 2026-10-09. Not scored.
The docs say crypto deposits (self-custody wallets and deposit addresses) are offered everywhere; the deposit-address contracts and the SDK contain no country or sanctions check. Fiat rails are a regional variant, enabled per organization: Apple Pay, ACH and Google Pay (US), Interac (CA), SEPA (Europe), JPYC (JP, SG, KR, PH), ARS (AR) and Bre-B (CO). The terms of use name no countries, only that the Services are not intended for use where it would be contrary to law. Judgment call: the hosted API that builds the payment-method list is closed, so a server-side country gate cannot be ruled out from code; global rests on the docs statement plus the contracts.
Evidence (3)1 verified · 2 documented
- Verified
The deposit-address contracts contain no country or sanctions check; GitHub code search of packages/contract/src for sanction, country, OFAC, blacklist and blocked returns no results, and the 2026-10-07 read at this commit found no pause, blacklist or freeze logic.
daimo-eth/sdk · packages/contract/src
commit ac0a71453a · checked 2026-10-09
- Documented
Payment Methods guide lists localized methods by country and states that self-custody wallets and deposit addresses are offered in every country.
docs.daimo.com/guides/payment-methods
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
- Documented
Fiat guide's supported-rails table gives each fiat rail's region (US, Canada, Europe (SEPA), Japan/Singapore/South Korea/Philippines, Argentina, Colombia); users in other countries see crypto, exchange and wallet methods.
docs.daimo.com/guides/fiat
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
What would raise this pillar
- Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
- Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
- Reliance on hosted services reaching Weak: Intermediaries required, only documented, no public code.
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
There is no pause, freeze, or blacklist function in the settlement contracts. The contracts do hold a control the C1 anchors name explicitly: a relayer allowlist that a single EOA owner sets through setRelayer, with no timelock. Only allowlisted relayers can forward a deposit to the payee. The owner can stop all settlement by removing every relayer. Any relayer can decline a single deposit address, or refund it early to its refundAddress, without notice. Funds in an unforwarded deposit address can still be refunded by anyone once expiresAt passes. Under the updated anchor the cell is 0 on two counts: the role is EOA-held (the owner has no code, so there is no Safe, module, guard, or signer set to read), and relayers can act on individual deposit addresses with no notice.
Evidence (5)5 verified
- Verified
setRelayer(address,bool) is onlyOwner and is the only admin function; no pause, freeze, or blacklist function exists in DepositAddressManager, DepositAddress, DepositAddressFactory, DaimoPayExecutor, or DaimoPayPricer at this commit.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
onlyRelayer gates start, sameChainFinish, fastFinish, claim, hopStart and refundFulfillment (L258, L406, L483, L569, L697, L876), so de-authorizing relayers halts all forwarding to payees.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
owner() of DepositAddressManager is 0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131, which has no code at block 52280426 (EOA, not a Safe; getThreshold() reverts).
0xfca1…09b6 on basescan.org
0xfca1…09b6 explorer · Sourcify · block 52280426 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
relayerAuthorized(0xA9C38348C35Baf44aA269D52cDfafc3aFe274E2f) returns true; that relayer is an EOA (no code) and is also DEFAULT_ADMIN_ROLE on the DaimoPayRelayer wrapper 0xc88fd3c032406F64C70a6c1aAc9831602362eE04.
0xfca1…09b6 on basescan.org
0xfca1…09b6 explorer · Sourcify · block 52280426 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
The manager owner 0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131 has empty code (no EIP-7702 delegation) and nonce 173 at block 52280426, so it is an EOA; there is no Safe whose modules or guard could be read.
0xd4cF…b131 on basescan.org
0xd4cF…b131 explorer · Sourcify · block 52280426 · checked 2026-10-07
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A payer pays with a plain ERC-20 transfer to a deposit address, which needs no provider. Delivery from that address to the payee does need the provider. Every forwarding entrypoint is relayer-only and also needs a price signed by Daimo's key within the last 300 seconds. Neither party can finish settlement by calling the contracts directly. The direct path that does exist is a refund to the payer's refundAddress once the deposit address expires. Settlement to the payee has no direct path.
Evidence (3)3 verified
- Verified
sameChainFinish (and start for cross-chain) is onlyRelayer and requires PriceData signed by the pricer's trustedSigner (L413-L418); a payer or payee cannot call it.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
refundDepositAddress is callable by anyone after params.expiresAt and sends the deposit address balance only to params.refundAddress; this is the sole permissionless entrypoint.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
DaimoPayPricer trustedSigner() is 0xE1432f86d711925d788bba98CfC006516188AA25 (no code, nonce 0, offchain signing key) with maxPriceAge() 300 seconds.
0xA8DC…936a on basescan.org
0xA8DC…936a explorer · Sourcify · block 52280426 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Each payment depends on three services that only Daimo runs: the Daimo API, which creates sessions and deposit-address parameters; the relayer, which is allowlisted by the owner EOA; and the price signer. No repository in the daimo-eth org contains code for the API, the relayer service, or the price signer. Self-hosting would not help even if that code were published, because a third-party relayer must first be added to the allowlist by Daimo. The SDK lets an integrator change the API URL, but no alternative backend exists to point it at.
Evidence (3)3 verified
- Verified
DaimoSDKProvider defaults to https://api.daimo.com (apiUrl prop overrides it); every session, deposit-address, and payment-method call goes to this API.
daimo-eth/sdk · packages/sdk/src/web/hooks/DaimoClientContext.tsx
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
validatePrice accepts only EIP-191 signatures from the immutable trustedSigner; there is no fallback oracle.
daimo-eth/sdk · packages/contract/src/DaimoPayPricer.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
relayerAuthorized(0xc88fd3c032406F64C70a6c1aAc9831602362eE04) returns true; this DaimoPayRelayer wrapper's bytecode is unverified on Basescan and Sourcify.
0xfca1…09b6 on basescan.org
0xfca1…09b6 explorer · Sourcify · block 52280426 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Re-assessed under the updated anchor (neutral settlement plus disclosed, bypassable edge filtering). The SDK contains no address or geographic filtering. The closed API decides which payment methods a user sees by country, and the docs disclose this. The terms reserve a blanket right to deny access, including by IP, without naming any list. The settlement contracts hold no list, but only Daimo's allowlisted relayers can forward a deposit, so whether settlement is neutral cannot be shown from code, and there is no direct path to bypass edge filtering (C2 = 0). Both of those facts match anchor 1. Judgment call: we score 1 and not 0 because the only filtering we can see is disclosed in docs and terms, and we have no evidence of undisclosed screening; we could not rule it out either, because the API and relayer are closed. A trace or provider statement showing screening not covered by those documents would lower this to 0. A 3 is not reachable while required components are closed and no trace exists.
Evidence (4)2 verified · 2 documented
- Verified
The SDK renders a "server-effective location" and a nav tree built by the API; a search of packages/sdk/src for sanction, OFAC, blocklist, geoblock, chainalysis, and TRM returns nothing.
daimo-eth/sdk · packages/sdk/src/web/api/index.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
The settlement contracts contain no list or country check, but every forwarding entrypoint is onlyRelayer, so which deposits settle is decided by Daimo's closed relayer service; neutrality of the settlement path cannot be shown from code.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Docs state payment methods are localized per user country server-side, and that deposit addresses and self-custody wallets are available everywhere.
docs.daimo.com/guides/payment-methods
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Terms of use (last updated 2025-04-01; linked from the SDK account flow at packages/sdk/src/web/components/account/AccountOtpPage.tsx L61) reserve the right to deny access to anyone for any reason, including by blocking IP addresses; no list source is named.
daimo.com/terms-of-use
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Tokens and chains are listed in code and in the docs. Neither the repo nor docs.daimo.com tells payees that USDC, USDT, and EURC issuers can freeze balances. Neither tells them that Base and the other L2 destinations depend on a centralized sequencer. A search of SDK, docs, and README for freeze, blacklist, and sequencer found nothing.
Evidence (3)2 verified · 1 documented
- Verified
knownTokens enumerates per-chain token lists (USDC, USDT, USDT0, DAI, EURC and others) for 16 chains; supportedChains is at packages/sdk/src/common/chain.ts L145-L162.
daimo-eth/sdk · packages/sdk/src/common/token.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
Deploy constants pin USDC, DAI, and USDT addresses per chain, including Base USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913.
daimo-eth/sdk · packages/contract/script/Constants.s.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Supported-chains page lists destination chains and USDC addresses but says nothing about issuer freeze powers or sequencer assumptions.
docs.daimo.com/supported-chains
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
What would raise this pillar
- Can be self-hosted reaching Weak: Docs exist; reproduction not attempted, or failed with blockers listed.
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
All six settlement contracts have source verified on Basescan or Sourcify. Four are exact matches on Sourcify. DepositAddressManager is only a partial match on Sourcify, and DaimoPayExecutor is verified on the explorer only, so the cell cannot reach 3. A pinned Foundry build config exists, but we did not try to reproduce the deployed bytecode from it. The DaimoPayRelayer wrapper at 0xc88f…eE04 is an authorized relayer and is not verified anywhere. Judgment call: we class it as operator tooling rather than a settlement contract, which keeps the score at 2. If it counted as a settlement contract, the score would be 1.
Evidence (4)4 verified
- Verified
Sourcify returns match "match" (partial, runtime only, metadata hash differs) for DepositAddressManager; Basescan shows Source Code Verified (Exact Match).
0xfca1…09b6 on sourcify.dev
0xfca1…09b6 explorer · Sourcify · block 52280426 · checked 2026-10-07
- Verified
Basescan shows DaimoPayExecutor Source Code Verified (Exact Match); https://sourcify.dev/server/v2/contract/8453/0xc9b29db51142b00E697385092b80efc57402a2b6 returns 404 (not on Sourcify).
0xc9b2…a2b6 on basescan.org
0xc9b2…a2b6 explorer · Sourcify · block 52280426 · checked 2026-10-07
- Verified
Sourcify exact_match for DepositAddressFactory; also exact_match for DepositAddress impl 0x23EE5dD38d902caBBA4F0229532f1EB1B0346673, DaimoPayPricer 0xA8DCDF1f1D624d37949b54c34E9A85394c72936a, and DepositAddressBridger 0x59dc13C4317CfFEEBD77cdd295C3d7981eAc1264.
0xE917…a36A on sourcify.dev
0xE917…a36A explorer · Sourcify · block 52280426 · checked 2026-10-07
- Verified
Foundry config pins solc 0.8.26, via_ir, optimizer_runs 999999, evm london; the Makefile build target is forge install && forge build.
daimo-eth/sdk · packages/contract/foundry.toml
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The contracts, the deploy scripts, the SDK, and its embeddable React modal are public. The Daimo API, the relayer, the price signer, the indexer, and the hosted deposit flow that DaimoFrame loads from daimo.com are all private. The SDK cannot run without those private services. Judgment call: we score 1 and not 2, because the frontend and indexer are closed as well as the backend. We score 1 and not 0, because the public contracts and deploy scripts are more than a client shell.
Evidence (2)1 verified · 1 documented
- Verified
The only live, non-archived product repo is daimo-eth/sdk, containing packages/sdk (client and React modal) and packages/contract (Solidity plus deploy scripts and broadcasts); gh repo list daimo-eth shows no backend, relayer, indexer, or hosted-flow repo.
daimo-eth/sdk · packages
commit ac0a71453a · checked 2026-10-07
- Documented
An OpenAPI 3.1.0 spec (10 paths) for the merchant API is published on the hosted docs site, not in the repo.
docs.daimo.com/openapi.json
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Re-assessed under the updated anchor; the score is unchanged. No README can get a stranger to a working deployment, because the relayer, the price signer, the indexer, and the API are closed required components (see `components` and O2). The relayer slot is also owner-gated (see C1). The repo has no deploy script that completes a test payment. We did not attempt a reproduction. Anchor 1 ("docs exist; reproduction not attempted") would apply if the docs described a path; judgment call: we score 0 ("No path"), because the documented steps only build and test contracts and stop short of anything that settles a payment.
Evidence (1)1 verified
- Verified
The contracts README covers only installing Foundry, make full, make test, and make coverage; the SDK README covers pnpm add @daimo/sdk; neither documents running a relayer, price signer, or API.
daimo-eth/sdk · packages/contract/README.md
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
ABIs can be derived from the verified source, and the event schemas are in the repo. The repo's API schema covers only the endpoints the browser uses. The full merchant API is described only in a hosted OpenAPI file, which is the documented common failure. No payee data export exists in any format. Judgment call: we score 1 and not 2, because the API schema is not in the repo.
Evidence (3)2 verified · 1 documented
- Verified
Event schemas (Start, FastFinish, Claim, SameChainFinish, FinalCallExecuted, HopStart, RefundDepositAddress, RefundFulfillment) are defined in source; no generated ABI JSON is committed and the Makefile codegen target references a root npm script that does not exist.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
Zod schemas cover the client-side session endpoints only (payment method, check, token options, nav logging); merchant endpoints such as create session and webhooks are absent.
daimo-eth/sdk · packages/sdk/src/common/api.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
The full merchant API schema exists only as a hosted OpenAPI file, not versioned with the code; no payee data export format is documented in repo or docs.
docs.daimo.com/openapi.json
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
What would raise this pillar
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every public repo needed for the product carries an OSI-approved license: the SDK is BSD-2-Clause and the contracts are GPL-3.0-or-later. The product also needs four closed components that carry no license a third party can use: the Daimo API, the relayer service, the price signer, and the indexer (see `components`). Under the updated rule a closed required component counts as unlicensed, because it cannot be forked, so F1 is 0. The public repos alone would score 3. Two housekeeping issues remain: the root LICENSE file is a symlink to packages/connectkit/LICENSE, a path that does not exist at any commit, and the root BSD text does not mention the GPL headers on the contracts, so GitHub reports the license as NOASSERTION. Neither restricts forking the public code.
Evidence (2)2 verified
- Verified
Root license.txt is BSD 2-Clause (Copyright 2026 Daimo, Inc.); packages/sdk/package.json L6 declares BSD-2-Clause.
daimo-eth/sdk · license.txt
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
All 32 Solidity files under packages/contract/src carry SPDX-License-Identifier GPL-3.0-or-later.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The repo has no CLA and we found no CLA bot. The license has never changed in substance. The repo makes no written commitment to keep the license stable.
Evidence (2)2 verified
- Verified
The repo has no CONTRIBUTING, CLA, or SECURITY file at any path outside vendored lib/ (only .github/PULL_REQUEST_TEMPLATE/release.md and assets).
daimo-eth/sdk · .github
commit ac0a71453a · checked 2026-10-07
- Verified
git log -- license.txt shows two commits, f4ff7c83 (2025-05-27, added BSD-2) and 4a32d7b4 (2026-02-28, copyright line only); no relicense event.
daimo-eth/sdk · license.txt
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A production deployment cannot run without services only Daimo runs: the API (an API key is required), the allowlisted relayer, and the price-signing key. The open SDK and contracts do not work without them.
Evidence (2)2 verified
- Verified
start requires an authorized relayer and two prices signed by the pricer's trustedSigner; no code path settles without both.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
The README requires a server-side Daimo API key to create sessions; the SDK has no mode that works without the hosted API.
daimo-eth/sdk · packages/sdk/README.md
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
What would raise this pillar
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The SDK has no third-party analytics package, but it does ship first-party UI telemetry. That telemetry is on by default and sends navigation steps, amounts, copied addresses, and errors to Daimo's API. The privacy notice discloses analytics in general terms, which fits anchor 1. We did not review Privy's transitive dependencies or the hosted daimo.com flow, because the lockfile is stale and no trace was run. Without a trace this cell cannot reach 3.
Evidence (3)2 verified · 1 documented
- Verified
createNavLogger fires-and-forgets UI events (nav_open/close/select, flow_amount_continue with amountUsd, copy_address with the address, qr_toggle, error_shown, coinbase_widget_error) to POST /v1/sessions/{id}/internal/nav (createDaimoClient.ts L493-L498); no opt-out flag exists.
daimo-eth/sdk · packages/sdk/src/web/hooks/navEvent.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
Runtime dependencies include no Sentry, PostHog, Segment, Mixpanel, Amplitude, Datadog, or fingerprinting package; @privy-io/react-auth is a dependency. The committed package-lock.json is stale (1.0.0-rc.1, no Privy), so transitive deps are not locked.
daimo-eth/sdk · packages/sdk/package.json
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Privacy notice (last updated 2026-02-28) says usage information, IP, device characteristics, and "how and when you use our Services" are collected for internal analytics.
daimo.com/privacy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Re-assessed under the updated anchor; the score is unchanged. In code, the crypto deposit flow asks only for what settlement needs. The privacy notice says IP, device, and location data are collected on every flow. That is collection beyond settlement needs, it is not legally required, and it is disclosed only in the policy, which is anchor 1. KYC applies only to fiat flows, which the code keeps separate. The policy says that KYC is required by applicable law, but it names no specific requirement, and neither the basis nor the limit appears in code or a versioned repo document, so the KYC fields alone could not reach 2 either. Following the common-failures note, we do not treat that KYC as undisclosed.
Evidence (3)2 verified · 1 documented
- Verified
The crypto payment-method request carries only method type, amountUsd, and (for Solana) wallet address and token mint; fiat is a separate payment-method type.
daimo-eth/sdk · packages/sdk/src/common/api.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
Fiat/account flows collect legal first and last name, email, date of birth, and SSN last 4 (Apple Pay verification), plus phone OTP via Privy.
daimo-eth/sdk · packages/sdk/src/web/components/account/formSchemas.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Policy says crypto-to-crypto needs no personal information but IP, OS, device, country, and usage data are collected automatically; fiat ramps require KYC via a third-party partner, which the policy says is required by applicable law.
daimo.com/privacy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Each session gets a fresh CREATE2 deposit address. That freshness does not protect privacy, because the manager's events publish the payee, the refund address (usually the payer), and any integrator calldata together in one log. Anyone can join payer to payee from a single event. The sample transaction also shows integrator tags in plaintext onchain. Judgment call: we score 1 and not 0, because the event definitions are in public verified source and the policy says payments are onchain. No user-facing document describes this linkage.
Evidence (3)2 verified · 1 documented
- Verified
Every Start/Claim/SameChainFinish/Refund event emits the full DAParams, including toAddress (payee), refundAddress (normally the payer), and finalCallData.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
SameChainFinish for deposit address 0x392d3A24FAE804e7fbe5BED599A723348070b846 emits toAddress 0xba343479d98a1ed333899999d95a7343b808a76f, refundAddress 0x8944E0Ef7197675C86Bee1233B4C15ae8f798465, and finalCallData containing the ASCII strings "megapot:web" and "bc_a360xqro".
0xfca1…09b6 on basescan.org
0xfca1…09b6 explorer · Sourcify · block 52280330 · checked 2026-10-07
- Documented
The policy states that crypto transactions are processed on public blockchains using smart contracts.
daimo.com/privacy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
In the crypto wallet flow, the client talks only to Daimo's API and the user's wallet. The API receives the payer's address in order to list balances. The fiat and account flows name Privy, Coinbase, and Stripe in code, and Sumsub in the docs. An integrator cannot replace any of them through config. The backend's own vendors, such as indexers, price sources, and log aggregation, are not visible to us, and the policy names them only by category. No trace was run. Judgment call: we score 1 and not 0, because the third parties that are visible are named and disclosed.
Evidence (3)2 verified · 1 documented
- Verified
Account flows mount PrivyProvider with a privyAppId supplied by the API response (web/api/index.ts L37-L40), not by integrator config; Coinbase onramp iframe (useCoinbaseWalletPayWidget.ts) and Stripe onramp popup (StripeOnrampPage.tsx) are also wired in.
daimo-eth/sdk · packages/sdk/src/web/components/account/AccountFlowProvider.tsx
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
The EVM wallet path talks only to the user's injected EIP-1193 provider; balances and token options come from the Daimo API (tokenOptions with evmAddress), not a client-side RPC.
daimo-eth/sdk · packages/sdk/src/web/hooks/useWalletFlow.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Policy says technical API-usage data may be shared with unnamed third parties "such as for log aggregation" and fiat identity data with a third-party KYC partner and ramp provider.
daimo.com/privacy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
An integrator can change the API and hosted-flow endpoints in code, so traffic can go through the integrator's own proxy. The UI offers no endpoint setting. The indexer and API code are not public, so the integrator can reroute data but cannot keep it inside their own perimeter.
Evidence (1)1 verified
- Verified
apiUrl prop overrides the default https://api.daimo.com; DaimoFrame/DaimoFrameRN accept a baseUrl overriding https://daimo.com; the SDK uses the wallet's own RPC and ships no RPC URL of its own.
daimo-eth/sdk · packages/sdk/src/web/hooks/DaimoClientContext.tsx
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
What would raise this pillar
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A deposit sits in a per-session contract that cannot be upgraded. It can only be released to the fixed payee, or refunded to the fixed refund address. Even so, the provider can take funds in flight. The payee's minimum is computed from prices that Daimo's own key signs. The relayer runs arbitrary calls on the funds and keeps any surplus. A relayer working with the signer can push the minimum close to zero and take the difference, and an honest relayer can still keep up to the slippage bound. Funds bridged cross-chain sit in fulfillment contracts that only relayers can release (see S4).
Evidence (4)4 verified
- Verified
Each deposit address holds funds and releases them only via sendBalance called by params.escrow (the manager), with no upgrade function.
daimo-eth/sdk · packages/contract/src/DepositAddress.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
The executor runs arbitrary relayer-supplied calls on the payer's funds and only checks that the payee receives at least minOutputAmount; any surplus goes to the relayer (execute L73-L77).
daimo-eth/sdk · packages/contract/src/DaimoPayExecutor.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
minOutputAmount is computed solely from the two Daimo-signed USD prices and params slippage bps (sample session used 100/10/500 bps).
daimo-eth/sdk · packages/contract/src/SwapMath.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
maxPriceAge() is 300 seconds; the price signer and relayers are Daimo-held EOAs (see C2, C1).
0xA8DC…936a on basescan.org
0xA8DC…936a explorer · Sourcify · block 52280426 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Re-assessed under the updated anchor; the score is unchanged because the first branch of anchor 3 (non-upgradeable) applies, so the Safe, module, guard, and timelock conditions do not arise. None of the settlement contracts can be upgraded. Each deposit address uses an ERC-1967 proxy, but its implementation exposes no upgrade function and the admin slot is empty. Daimo can deploy new manager versions and have the API point new sessions at them. A deposit address that already exists stays bound to its original escrow, so this does not change open sessions. The bridge protocols used for cross-chain routes, such as CCTP and Stargate, have their own admin keys, which are outside this cell.
Evidence (3)3 verified
- Verified
EIP-1967 implementation slot of DepositAddressManager reads zero at block 52280426 (not a proxy; deployed directly via CREATE3 per DeployDepositAddressManager.s.sol L38-L51).
0xfca1…09b6 on basescan.org
0xfca1…09b6 explorer · Sourcify · block 52280426 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
Sample deposit address is an ERC1967Proxy whose implementation slot holds 0x23EE5dD38d902caBBA4F0229532f1EB1B0346673 and whose admin slot is zero; the implementation has no upgradeTo or UUPS function.
0x392d…b846 on basescan.org
0x392d…b846 explorer · Sourcify · block 52280426 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
The factory's depositAddressImpl is immutable; the executor's escrow and the pricer's signer and maxPriceAge are immutable; DepositAddressBridger has no owner (owner() reverts).
daimo-eth/sdk · packages/contract/src/DepositAddressFactory.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Re-assessed under the updated anchor; the score is unchanged and now rests on the distributed package as well as the source. In the default crypto flow the SDK asks for no token allowance: the payer sends the exact amount straight to the session's deposit address, both at the pinned commit and in the published @daimo/sdk 1.8.8 bundle. The only other route in the contracts, pullFromPermit, uses EIP-2612 with a deadline and the deposit address as spender. Limit: the optional fiat/account flow (off unless the merchant enables fiat) has the Daimo-provisioned Privy wallet sign server-supplied EIP-712 "routing authorization" data or send a server-supplied sponsored transaction (packages/sdk/src/common/account.ts L857-L876, web/hooks/useDraftDeposit.ts L231-L256); the scope of those authorizations is set by the closed API and cannot be read from client code. Judgment call: a default flow with no approval at all is stricter than the anchor-3 bar of exact-amount approvals, so we score it 3.
Evidence (4)2 verified · 2 documented
- Verified
The EVM payment is a single ERC-20 transfer(depositAddress, amount) or native value send via eth_sendTransaction; a search of packages/sdk/src finds no approve, permit, or maxUint call.
daimo-eth/sdk · packages/sdk/src/web/hooks/useWalletFlow.ts
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
The contract also supports pullFromPermit with an EIP-2612 permit whose spender is the deposit address itself and which carries a deadline; the SDK does not use it.
daimo-eth/sdk · packages/contract/src/DepositAddress.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
The latest published @daimo/sdk (1.8.8; the pinned commit is 1.8.9-dev) was read from its registry tarball. dist/web/hooks/useWalletFlow.js L520-L525 encodes only ERC-20 transfer(destAddr, tokenAmount) (L511-L518 is the native send); a grep of every non-test .js file in dist for approve, permit, and maxUint256 finds no approval call.
registry.npmjs.org/@daimo/sdk/1.8.8
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Fiat rails, the only flows that use the Privy account wallet, are off unless the merchant's org enables them.
docs.daimo.com/guides/payment-methods
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Re-assessed under the updated anchor; the score is unchanged, because anchor 2 needs a verified withdrawal path that works without the provider and none exists for funds in flight. Derived from S1=0, C2=0, C3=0, and O3=0. If Daimo disappeared, payees would keep funds already delivered, but no new payment could settle (C2, C3). A payer whose deposit has not been forwarded can get it back after expiry through refundDepositAddress. That call needs the full DAParams, which the API holds and which are not emitted onchain until Daimo acts on the session. Funds already bridged to a destination-chain fulfillment contract can only be claimed or refunded by an allowlisted relayer, so they depend on Daimo staying live.
Evidence (2)2 verified
- Verified
refundFulfillment and claim (L561-L569) are onlyRelayer; DAFulfillment.pull (L1169-L1179) is callable only by the manager, so bridged funds have no permissionless exit.
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Verified
refundDepositAddress lets anyone return an expired deposit address's balance to its refundAddress, but only if the caller knows the full DAParams (held by the Daimo API, or recoverable from a prior event).
daimo-eth/sdk · packages/contract/src/DepositAddressManager.sol
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The client bundle contains no long-lived secrets. Webhooks are HMAC-signed, but the only verification reference code is on the hosted docs, not in the repo. Neither the repo nor the docs describe API-key scoping or rotation. Judgment call: we score 2 and not 3, because the reference verification is not in the repo and rotation is not shown.
Evidence (2)1 verified · 1 documented
- Verified
README instructs integrators to keep the Daimo API key on their backend; the browser receives only a session-scoped clientSecret (common/session.ts L233-L234), a session-scoped Stripe onramp client secret (common/api.ts L172-L176), and a publishable privyAppId.
daimo-eth/sdk · packages/sdk/README.md
commit ac0a71453a · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
- Documented
Webhooks are signed with a Daimo-Signature header (HMAC-SHA256 over t.rawBody) and the docs give a timingSafeEqual verification snippet; no verification helper exists in the repo and secret rotation is not described.
docs.daimo.com/guides/webhooks
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The only audit in the repo covers the earlier Universal Address contracts. Those files were deleted in January 2026, and the audited commits are not in the public repo. We found no audit of the deployed DepositAddressManager, DepositAddress, or DaimoPayExecutor. We found no bug bounty in the repo, the docs, or daimo.com/.well-known/security.txt (404); the NatSpec lists a security@daimo.com contact. Judgment call: we score 0 and not 1, because an audit of a previous version does not cover the deployed contracts, which is the listed common failure.
Evidence (2)1 verified · 1 documented
- Verified
None of the audited files exist at this commit; UA code was deleted in 99c3f248 (2026-01-08) and the deployed DepositAddress* contracts were added in c990a190 (2025-12-17). The audited and fix commits (80312d47, b40d727e, 4bf78a65) return 422 from the GitHub API for daimo-eth/sdk.
daimo-eth/sdk · packages/contract/src
commit ac0a71453a · checked 2026-10-07
- Documented
Nethermind NM-0585 (final 2025-07-31) covers UniversalAddressBridger/Factory/Manager, SharedConfig, UniversalAddress, and TokenUtils at commits ef97c77f to 80312d47; 2 Low and 1 Best Practices findings, all marked fixed with commit hashes.
daimo-eth/sdk
checked 2026-10-07
Security audits 1
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Compiled from: The audit/ folder of github.com/daimo-eth/sdk (packages/contract/audit, one report), GitHub code and commit searches of the daimo-eth org for "audit", the audits/ folders of daimo-eth/daimo and daimo-eth/p256-verifier, docs.daimo.com (no security or audits page; /security and /audits return 404), and Nethermind's public report repo (NethermindEth/PublicAuditReports, no Daimo entry). Commit 76bc7df8 (2025-04-03, "NM-0500 audit fixes") shows an earlier Nethermind review of the DaimoPay/PayIntent contracts, but no NM-0500 report is published. The 2023 Veridise reports in daimo-eth/daimo and p256-verifier cover the Daimo wallet account and P256 verifier, which are not in the Daimo Pay payment path, so they are not listed. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
