Exa Card

card Assessed on OP Mainnet (chain 10)www.exactly.app

Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Production app builds default to Optimism (exactly/exa 4fba32b, common/wagmi.config.ts#L18: CHAIN_ID falls back to optimism.id for EAS builds), and the Exa help center says the protocol behind the card "works on Optimism". Unit: the ExaPlugin, IssuerChecker and ProposalManager deployed by contracts/broadcast/*/10/run-latest.json at commit aceb1b5 (Sourcify exact match), the exaUSDC market they settle from, and a live collectDebit at block 157882808. Excluded: the Base deployment and its Firewall-gated markets, Exa Business, and ramp partners.

Outside this assessment

Not scored. The Exa Card terms name Third National as issuer of the card program, "issued by the Issuer under license from Visa" (https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions). The help center says the card is issued in the United States and gives a legal address "provided by Rain" (https://help.exactly.app/en/articles/10209480-where-is-the-exa-card-issued).

The app operator is EXA LABS S.A.S., incorporated in Uruguay (app terms and privacy policy), and the app terms let it suspend or terminate access with or without notice. Card terms for US citizens and Exa Business cards are separate documents, not assessed.

Protections such as regulation, safeguarding and legal recourse are not CROPS properties and are not scored. They are shown because a risk assessment should weigh them.

At a glance

Category: Cards
Chain: OP Mainnet
CROPS tally: 6 of 23 hold up
Settles in: USDC, exaUSDC
Security audits: 25 published
Offered: 41 countries
Last edited: 2026-10-13 · History

Censorship Resistance0 FailsWeakest: Admin pause or freeze powers; Settle without the provider; Reliance on hosted services
Open1 WeakWeakest: Contracts verified onchain; Can be self-hosted
Free0 FailsWeakest: Open-source licences; Protection against relicensing; No proprietary dependencies
Privacy0 FailsWeakest: Endpoints can be changed
Security0 FailsWeakest: Who holds funds in transit

Holds up 6

2 PartialToken and chain freeze risks disclosed
3 StrongWhole stack published
2 PartialInterfaces and data export
2 PartialPayments linkable onchain
2 PartialFunds safe if provider disappears
2 PartialSecrets and webhook handling

Falls short 17

0 FailsAdmin pause or freeze powers
0 FailsSettle without the provider
0 FailsReliance on hosted services
1 WeakNeutral settlement, disclosed filtering
1 WeakContracts verified onchain
1 WeakCan be self-hosted
0 FailsOpen-source licences
0 FailsProtection against relicensing
0 FailsNo proprietary dependencies
1 WeakTracking and analytics
1 WeakData collected beyond payment
1 WeakThird parties in the payment flow
0 FailsEndpoints can be changed
0 FailsWho holds funds in transit
1 WeakWho can upgrade the code
1 WeakToken approval scope
1 WeakAudits and bug bounty

Not yet evidenced 0

Every criterion has evidence.

Where it is offered

Offered only in the countries listed. Checked 2026-10-09. Not scored.

The help-centre article "Card availability and usage" lists 46 countries and 31 US states where the card can be issued. Exa's documents disagree on six of these, and we take the more restrictive reading. Nigeria is listed as eligible "with conditional approval" but is on the separate List of prohibited countries (2026-01-15). Ecuador, El Salvador, Guatemala and Hong Kong are listed as eligible but are named among sanctioned jurisdictions in the Exa App Terms (2025-10-02). The United States is excluded: the help article lists eligible US states and Exa publishes card terms for US citizens (2025-05-20), but the App Terms say US Persons are prohibited from using the App, and the card is created in the App. The App Terms' sanctions list also names countries that are not on the help list (for example England, Greece, Estonia, Slovenia, Cyprus); those are already outside the allowlist. The card can be spent anywhere Visa is accepted except Cuba, Iran, North Korea, Russia, Syria, Ukraine and Venezuela. Protocol level: the Exa account contracts on Optimism are usable without the card.

Listed countries (41): United Arab Emirates, Antigua & Barbuda, Argentina, Australia, Barbados, Bolivia, Brazil, Bahamas, Belize, Côte d’Ivoire, Colombia, Costa Rica, Dominican Republic, Grenada, Ghana, Guyana, Honduras, Japan, Kenya, St. Kitts & Nevis, Cayman Islands, St. Lucia, Morocco, Mexico, Malaysia, New Zealand, Panama, Peru, Philippines, Pakistan, Paraguay, Singapore, Senegal, Suriname, Turks & Caicos Islands, Trinidad & Tobago, Uganda, Uruguay, St. Vincent & Grenadines, South Africa, Zambia

Evidence (3)1 documented · 2 claimed

Documented
Exa App Terms (2025-10-02) prohibit US Persons from using the App and list sanctioned jurisdictions, including Ecuador, El Salvador, Guatemala and Hong Kong.
help.exactly.app/en/articles/9942510-exa-app-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Claimed
Help article "Card availability and usage" lists 46 eligible countries, 31 eligible US states, 18 ineligible countries and 7 countries where the card cannot be spent.
help.exactly.app/en/articles/8979641-card-availability-and-usage
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Claimed
List of prohibited countries for the Exa Card (2026-01-15) names 32 countries where issuance is forbidden, including Nigeria.
help.exactly.app/en/articles/10715755-list-of-prohibited-countries-for-the-exa-card
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Settlement token

What the balance is held in and debited from. Shown as context; it does not change any rating.

Token	Class	Issuer	Contract
USDC Default	fiat-backed stablecoin	Circle	`0x0b2C…Ff85` explorer · Sourcify
exaUSDC	other token		`0x6926…A8bb` explorer · Sourcify

Conversion. The token is sold for fiat when a payment is authorised.

Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Other token. A wrapped, liquid-staking or yield token. It carries the risks of the underlying asset plus those of the wrapper or protocol; see the note.

Deposits sit in Exactly Protocol markets, so a USDC balance is held as exaUSDC, the yield-bearing share of the exaUSDC market (a deposit receipt, not a separate dollar). Every card payment is collected in USDC from that market: Pay Now withdraws USDC from the user's exaUSDC deposit, and installment purchases borrow USDC from the market against the user's deposits. Other deposited assets (ETH, wstETH, WBTC, OP) are collateral for installment credit and are not spent directly. Exa converts the USDC to USD for the merchant; non-USD purchases carry a 1.5% FX fee. Scope is the OP Mainnet card; the Base deployment was not checked.

Checked 2026-10-12

Evidence (3)3 verified

Verified
Exa's docs say deposits (USDC, ETH, wstETH, WBTC, OP) are allocated to Exactly Protocol markets; Pay Now deducts the amount from the user's funds in those markets, and installment purchases borrow from the fixed-rate markets, converting the borrowed funds to USD for the merchant.
exactly/docs · exa-app/credit-and-debit-modes.md
commit fd734e9c1b · checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Verified
The OP Mainnet deploy config enumerates the tokens accounts can use; the card itself settles from the exaUSDC market (EXA_USDC immutable in ExaPlugin).
exactly/exa · contracts/deploy.json
commit 4fba32be18 · checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Verified
A sample card debit - the keeper called collectDebit on the user's account and the exaUSDC market emitted Withdraw of USDC to the card collector 0x3a73880f....
0x973c…14b8 on explorer.optimism.io
0x973c…14b8 explorer · Sourcify · block 157882808 · checked 2026-10-12

Censorship Resistance

Who can block valid use, and can users route around them?

0 FailsPillar rating: weakest of 5
1 of 5 Partial or better

What would raise this pillar

Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Reliance on hosted services reaching Weak: Intermediaries required, only documented, no public code.

Admin pause or freeze powers

Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Three things can stop card settlement. A single EOA owns the Pauser, which can pause the exaUSDC market and so freeze every card debit and every user withdrawal, with no notice or timelock. Card collections run only through Exa's keeper EOA. The card terms let Exa and the issuer block transactions and suspend accounts. The longer-standing PAUSER_ROLE sits with a 3-of-6 Safe (undisclosed signers, no timelock). An EOA-held pause meets anchor 0.

Evidence (4)3 verified · 1 documented

Verified
The Exactly Pauser holds EMERGENCY_ADMIN_ROLE on exaUSDC; its pause() and pauseProtocol() are onlyOwner, and owner() is 0xEa2127b14D05229CB3d4b75b42052e556AB7391F (no code, nonce 0). A paused market blocks every withdraw, including card debits and user exits (Market.sol beforeWithdraw whenNotPaused).
0x8cC0…F2A3 on repo.sourcify.dev
0x8cC0…F2A3 explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
ExaPlugin hasRole(KEEPER_ROLE, 0xcDdB23654595C224A563f62943D9Ff189138c04e) = true. The keeper is an EOA (nonce 417500) and the only party allowed to call collectDebit/collectCredit on accounts.
0x3d73…7f3e on repo.sourcify.dev
0x3d73…7f3e explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The market's PAUSER_ROLE (pause and unpause) is held by Safe 1.3.0 0xC0d6Bc5d... with getThreshold() = 3 and 6 owners; no modules and a zero guard slot.
0xC0d6…86D3 on explorer.optimism.io
0xC0d6…86D3 explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The Exa Card terms let Exa Labs and the issuer block transactions and suspend account access.
help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Settle without the provider

Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Merchants are paid by Visa, Third National and Rain offchain. The only onchain step is a debit or borrow that needs both Exa's issuer signature and Exa's keeper. Neither payer nor payee can settle a card payment by calling the contracts.

Evidence (2)2 verified

Verified
collectCredit and collectDebit first call ISSUER_CHECKER.checkIssuer (an Exa issuer signature) and then withdraw or borrow to the collector. The manifest at L403 binds collectDebit to keeper-only runtime validation (L553-L560). This source is identical to the Sourcify exact match for 0x3d73D0fb....
exactly/exa · contracts/src/ExaPlugin.sol
commit aceb1b5be2 · checked 2026-10-07
Verified
A sample card debit. Keeper EOA 0xcDdB2365... called collectDebit (0x8980d703) on account 0x973ccce3...; IssuerChecker emitted Collected and exaUSDC emitted Withdraw to collector 0x3a73880f....
0x973c…14b8 on explorer.optimism.io
0x973c…14b8 explorer · Sourcify · block 157882808 · checked 2026-10-07

Reliance on hosted services

Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Exa publishes its own backend, which is unusual for a card. A card payment still requires Rain's closed issuing platform, Third National and Visa, plus Exa's own keeper and issuer keys. The deployed IssuerChecker accepts only Exa's issuer key, so a self-hosted server could not settle against the deployed contracts. The required issuer path is closed and single-vendor, so 0.

Evidence (2)2 verified

Verified
The public server requires PANDA_API_KEY/URL (Rain issuing API), PERSONA_API_KEY/URL and SARDINE_API_KEY/URL to start.
exactly/exa · server/index.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Exa's docs say KYC (Persona), card issuing (Rain) and support (Intercom) are integrated in the Exa App's backend.
exactly/docs · exa-app/the-exa-tech-stack.md
commit fd734e9c1b · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Neutral settlement, disclosed filtering

Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The Optimism settlement contracts (ExaPlugin and the standard exaUSDC market) have no address or country filter; the Firewall allowlist exists only on Base. Edge screening is disclosed in the terms, but it runs inside closed vendors with no named list source in code, and it cannot be bypassed because C2 = 0. Disclosed in docs only, so 1.

Evidence (2)1 verified · 1 documented

Verified
Card authorisation calls Sardine risk scoring before approving. KYC goes through Persona. No sanctions list, list source or country blocklist is defined in the public code; screening happens inside those vendors and Rain.
exactly/exa · server/hooks/panda.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The card terms require that the cardholder is not blocked or sanctioned by the US Government, including OFAC listings.
help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Token and chain freeze risks disclosed

Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Chain and tokens are enumerated in code. USDC carries a Circle blacklister, the exaUSDC market can be paused (C1), and OP Mainnet has a single sequencer. None of this is stated to cardholders in the help center or the terms I read. Enumerated in code, assumptions not stated, so 2.

Evidence (3)2 verified · 1 claimed

Verified
The ProposalManager allowlist enumerates the OP Mainnet tokens the account can interact with. The card itself settles from the exaUSDC market (EXA_USDC immutable in ExaPlugin).
exactly/exa · contracts/deploy.json
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Native USDC on OP Mainnet has blacklister() 0x551e855b7355C98534175879A300972856C04D7C.
0x0b2C…Ff85 on explorer.optimism.io
0x0b2C…Ff85 explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Claimed
The help article names Optimism and explains rollups, but says nothing about the sequencer, forced inclusion, or issuer freeze powers.
help.exactly.app/en/articles/9071732-which-blockchain-does-exa-app-work-on
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Open

Is the whole stack visible?

1 WeakPillar rating: weakest of 4
2 of 4 Partial or better

What would raise this pillar

Contracts verified onchain reaching Partial: Verified on an explorer only, or partial match.
Can be self-hosted reaching Partial: Reproducible with minor undocumented steps, recorded.

Contracts verified onchain

Does the deployed bytecode match public source, and can a third party rebuild it? O1

1 Weak

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Exa's own contracts and Rain's collateral beacon and implementation are exact matches, and Exa has a committed Foundry deploy. The exaUSDC market implementation that holds all card collateral is not on Sourcify, and the Optimism Blockscout API returned no verification record for it. Some settlement contracts are verified, so 1. Judgment call: the unverified market implementation sits in the settlement path, so I did not go higher.

Evidence (2)2 verified

Verified
Sourcify v2 returns exact_match for ExaPlugin, IssuerChecker, ProposalManager, Refunder, Pauser, WebauthnOwnerPlugin, the account implementation 0x00460000...a61e and the market proxy. It returns null for the exaUSDC implementation 0xEBd58C87... and for the collector proxy 0x3a73880f.... The collector is a BeaconProxy whose beacon is RainCollateralBeacon 0xE84110fF... (exact) and whose implementation is RainCollateral 0xD71Fd741... (exact).
0x3d73…7f3e on repo.sourcify.dev
0x3d73…7f3e explorer · Sourcify · block 157885618 · checked 2026-10-07
Verified
The Foundry broadcast for the OP Mainnet deployment is committed, and ExaPlugin.sol at this commit matches the Sourcify source apart from a trailing newline.
exactly/exa · contracts/broadcast/ExaPlugin.s.sol/10/run-latest.json
commit aceb1b5be2 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Whole stack published

Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2

3 Strong

Best evidence: VerifiedChecked 2026-10-07 12 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Exa's own stack is public: SDK and contracts, frontend, backend, indexer and deploy scripts. The closed parts are third parties (Rain, Third National, Visa, Persona, Sardine, Alchemy) and Exa's operating keys; they are scored under C3, F1 and F3. Judgment call: O2 counts what the provider runs, and all of that is published.

Evidence (1)1 verified

Verified
The exa monorepo contains the backend (server/, with Dockerfile and deploy workflows), the mobile and web app (src/), contracts with deploy scripts and broadcasts (contracts/), and the substreams indexer (substreams/).
exactly/exa · server
commit 4fba32be18 · checked 2026-10-07

Can be self-hosted

Can a stranger reach a working deployment from the README? O3

1 Weak

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-12 7 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Build docs exist. Reproduction not attempted. Visible blockers: the server needs Rain, Persona and Sardine API keys, and a working card needs an issuer key that the deployed IssuerChecker accepts.

Evidence (1)1 verified

Verified
The README lists toolchain requirements and install, run and e2e commands for the app, and links to the server and contracts.
exactly/exa · README.md
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-12

Interfaces and data export

Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

ABIs, events and an API schema generator are versioned with the code. The cardholder export is a PDF statement (server/api/activity.ts); there is no payee export, since merchants are paid through Visa. Judgment call: the API schema is generated rather than committed, and there is no payee export, so 2.

Evidence (2)2 verified

Verified
An OpenAPI spec is generated from the server routes (hono-openapi generateSpecs).
exactly/exa · server/script/openapi.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Event schemas (Collected, Refunded, IssuerSet...) are in the contract source; ABIs come from the Foundry build.
exactly/exa · contracts/src/IssuerChecker.sol
commit aceb1b5be2 · checked 2026-10-07

Free

Does the license actually let a third party fork, modify, and run it?

0 FailsPillar rating: weakest of 3
0 of 3 Partial or better

What would raise this pillar

Open-source licences reaching Weak: Source-available (BUSL, SSPL, ELv2, Commons Clause, custom) on a critical repo.
Protection against relicensing reaching Weak: CLA permits relicensing; commitment exists in docs.
No proprietary dependencies reaching Weak: Documented that production needs a hosted service with no open alternative.

Open-source licences

Does every repository needed to run the product carry an OSI-approved license? F1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The backend and app repo has no license. The market contracts are source-available (BUSL-1.1). The issuer, network and Rain are closed. Closed required components alone set F1 to 0.

Evidence (2)2 verified

Verified
The exa monorepo has no LICENSE file at the root or in any package, and the package.json files have no license field. Contract files carry SPDX GPL-3.0 headers only. GitHub reports no license.
exactly/exa · README.md
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-12
Verified
Exactly Protocol (the exaUSDC market) is under BUSL-1.1, changing to GPL-3.0-or-later two years after each release.
exactly/protocol · LICENSE
commit 0d1ca2a6b7 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Protection against relicensing

Can the provider unilaterally relicense future versions, and has it committed not to? F2

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-07

There is no CLA, but there is also no license, so Exa Labs holds every right in its code and can license future versions however it likes. Judgment call: the anchors assume a license exists. "No CLA, no commitment" (2) would credit stability that an unlicensed repo does not have, so I took the lower anchor, 0.

Evidence (1)1 verified

Verified
There is no CLA workflow, no CONTRIBUTING file or license-stability commitment, and the LICENSE path has no history (gh api 'repos/exactly/exa/commits?path=LICENSE' returns none).
exactly/exa · .github/workflows
commit 4fba32be18 · checked 2026-10-07

No proprietary dependencies

Does a production deployment need a proprietary plugin or hosted-only service? F3

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The card cannot run without Rain's issuing platform, the issuer and Visa, and Persona and Sardine. These are hosted-only proprietary services.

Evidence (1)1 verified

Verified
The server will not start without Rain (panda), Persona and Sardine credentials.
exactly/exa · server/index.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Privacy

What can an observer learn, and did the user knowingly choose it?

0 FailsPillar rating: weakest of 5
1 of 5 Partial or better

What would raise this pillar

Endpoints can be changed reaching Weak: Documented workaround.

Tracking and analytics

Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Analytics (Segment, keyed to the wallet address) and error reporting (Sentry) are on by default, with no opt-in in code. The privacy policy discloses analytics in general terms. Present, on by default, disclosed, so 1.

Evidence (2)1 verified · 1 documented

Verified
The web app loads Segment with hardcoded write keys per domain, with no consent check, and identify() sends the account address. package.json also ships @sentry/react-native, @sentry/browser, Intercom, OneSignal and expo-insights.
exactly/exa · src/utils/segment.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The privacy policy discloses usage analytics, including third-party analysis.
help.exactly.app/en/articles/9945134-privacy-policy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Data collected beyond payment

Does the flow collect anything beyond addresses, amounts, token, and chain? P2

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Full KYC, including biometrics, is collected for the card. The basis is given only loosely ("Visa regulations") in a versioned doc, and the field list is disclosed in the privacy policy. Collection goes well beyond settlement needs. Judgment call: a stated basis without a field-level limit to the legal requirement does not reach 2, so 1.

Evidence (2)1 verified · 1 documented

Verified
Exa's docs repo says KYC is required to comply with Visa regulations.
exactly/docs · exa-app/credit-and-debit-modes.md
commit fd734e9c1b · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The privacy policy lists the KYC data collected through Persona, including ID document, photo and biometric face scans, plus IP and wallet address.
help.exactly.app/en/articles/9945134-privacy-policy
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Payments linkable onchain

What do calldata and events reveal about who paid whom for what? P3

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Every card spend is publicly tied to the user's long-lived Exa account (amount and time), and the Collected event marks the account as an Exa cardholder. No merchant data goes onchain, and there are no fresh addresses. Minimal linkage that is documented, so 2.

Evidence (2)2 verified

Verified
A card debit emits IssuerChecker Collected(account, amount, timestamp) and an exaUSDC Withdraw to the collector. No merchant or order data is emitted.
0x59A6…Eb3A on explorer.optimism.io
0x59A6…Eb3A explorer · Sourcify · block 157882808 · checked 2026-10-07
Verified
The docs describe the keeper-run collectDebit and collectCredit and the IssuerChecker that signs them.
exactly/docs · exa-app/exa-plugin.md
commit fd734e9c1b · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Third parties in the payment flow

Which third parties see a request during a payment, and can they be swapped out? P4

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

A payment is seen by Rain, Third National, Visa, Sardine and Segment, plus Alchemy on the app side. All of them are named in public code or docs, but none can be swapped without code changes. No trace was run. Judgment call: named in code (2) but not swappable by config (1); I took the lower anchor.

Evidence (2)2 verified

Verified
Each card authorisation is sent to Sardine for risk scoring and tracked to Segment (L816). Rain sends the authorisation webhook. The endpoints are env-set, but each integration is vendor-specific code.
exactly/exa · server/hooks/panda.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
Persona, Rain and Intercom are named in the docs.
exactly/docs · exa-app/the-exa-tech-stack.md
commit fd734e9c1b · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Endpoints can be changed

Can RPC and indexer URLs be changed, and is the indexer code public? P5

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The RPC endpoint is fixed to Alchemy; only the key can be overridden at build time. The indexer (substreams) is public, but users cannot point the app at their own endpoints. Judgment call: changing the key is not changing the endpoint, so this is "hardcoded" (0).

Evidence (1)1 verified

Verified
The app reads through Alchemy (src/utils/publicClient.ts#L7-L10), with per-chain keys hardcoded and an env override for the key only. The RPC vendor is fixed in code.
exactly/exa · common/alchemyAPIKey.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Security

Who can cause loss, lock users in, or change the rules?

0 FailsPillar rating: weakest of 6
2 of 6 Partial or better

What would raise this pillar

Who holds funds in transit reaching Weak: Provider-held wallet or upgradeable escrow, disclosed.

Who holds funds in transit

Who holds funds between payer and payee, and can the provider redirect them? S1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

At rest, funds sit in the user's own account as exaUSDC shares in an upgradeable lending market. Exa's issuer key plus its keeper can debit any amount from any account to the collector without a user signature, and the admin Safe can repoint the collector without a timelock. Card debits land in Rain's upgradeable collateral contract (beacon owned by a 2-of-5 Safe). The provider can redirect funds, which meets anchor 0.

Evidence (3)3 verified

Verified
check() verifies only an Exa issuer signature over (account, amount, timestamp) with replay protection. There is no per-account limit and no user signature.
exactly/exa · contracts/src/IssuerChecker.sol
commit aceb1b5be2 · checked 2026-10-07
Verified
ExaPlugin collector() = 0x3a73880f...efc5, a BeaconProxy to RainCollateral whose beacon owner is Safe 0x6454cf01... (2-of-5). setCollector is DEFAULT_ADMIN_ROLE, held by Safe 0x6561b09d... (3-of-4, no modules, no guard, no timelock).
0x3d73…7f3e on repo.sourcify.dev
0x3d73…7f3e explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
IssuerChecker issuer() = 0x3Ed5B7C4F0406b0D5afbe8ccFd1BD845f8F9D415, a key with no code and nonce 0 (a signing-only EOA).
0x59A6…Eb3A on repo.sourcify.dev
0x59A6…Eb3A explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Who can upgrade the code

Who can change the contract code, and with how much notice? S2

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

ExaPlugin itself is immutable, and each account's implementation can be upgraded only by its owner. The market holding user funds is upgradeable behind a 1-day timelock driven by a 3-of-6 Safe, which on its own would score 2 (signers and notice channel undisclosed). The plugin admin, a 3-of-4 Safe with no timelock, can also swap the ProposalManager and swapper contracts that every withdrawal passes through, which amounts to changing the rules with no notice. Judgment call: that is "multisig admin, no timelock", so 1.

Evidence (3)3 verified

Verified
The exaUSDC proxy admin (EIP-1967 admin slot) is ProxyAdmin 0xfBa759BC..., whose owner() is TimelockController 0x92024C4b... (getMinDelay 86400 s). The timelock's PROPOSER_ROLE includes Safe 0xC0d6Bc5d... (3-of-6).
0xfBa7…941A on explorer.optimism.io
0xfBa7…941A explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The ExaPlugin admin Safe has getThreshold() = 3 with 4 owners, no modules and no guard. Through setProposalManager, setSwapper, setFlashLoaner and allowPlugin it can replace, with no timelock, the contracts that gate every user withdrawal.
0x6561…434C on explorer.optimism.io
0x6561…434C explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The admin-only setters for flashLoaner, collector, proposalManager and swapper, and the plugin allowlist.
exactly/exa · contracts/src/ExaPlugin.sol
commit aceb1b5be2 · checked 2026-10-07

Token approval scope

How large an allowance does the SDK ask users to grant, and for how long? S3

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

The card's spending authority is an unbounded keeper permission built into the account, not a capped allowance. It is disclosed in docs and code. Unbounded by default, disclosed, so 1.

Evidence (2)2 verified

Verified
There is no ERC-20 approval. Instead, the installed plugin gives KEEPER_ROLE runtime validation over collectDebit, collectCredit and collectInstallments on every account, bounded only by the issuer signature and the account's balance or credit.
exactly/exa · contracts/src/ExaPlugin.sol
commit aceb1b5be2 · checked 2026-10-07
Verified
The docs disclose the keeper's collect functions and the issuer's role.
exactly/docs · exa-app/exa-plugin.md
commit fd734e9c1b · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Funds safe if provider disappears Derived

If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Chain of reasoning. By S1, funds sit in the user's own account, though in an upgradeable, pausable market. By the evidence above, the user can withdraw through a verified two-step path after 60 s without Exa's keeper, using any ERC-4337 bundler and the public app source. By C2 = 0 and C3 = 0, card settlement stops without Exa. By O3 = 1, self-hosting is unproven. Caveats: a market pause (C1) would block the exit, and the admin can swap the ProposalManager (S2). Funds retained and retrievable, settlement stops, so 2.

Evidence (2)2 verified

Verified
ProposalManager delay() = 60 s (code caps it at 1 hour, L317-L318 at aceb1b5). A user proposes a withdrawal through propose (self-validated) and runs executeProposal after the delay; neither step needs the keeper.
0x6817…8338 on repo.sourcify.dev
0x6817…8338 explorer · Sourcify · block 157885618 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The sample account's installed plugins are ExaPlugin and WebauthnOwnerPlugin, and its implementation is UpgradeableModularAccount 0x00460000...a61e (Sourcify exact). Only the user's passkey owns it.
0x973c…14b8 on explorer.optimism.io
0x973c…14b8 explorer · Sourcify · block 157885618 · checked 2026-10-07

Secrets and webhook handling

Are secrets kept out of client bundles and are webhooks signed and verified? S5

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

No issuing or KYC secrets are in the client, and webhooks are signature-verified with rotation support. The client ships publishable Alchemy and Segment keys, which authorise metered RPC use and analytics writes. Judgment call: minor, so 2. A 3 is not possible while required components are closed.

Evidence (2)2 verified

Verified
Card webhooks are verified with HMAC-SHA256 and timingSafeEqual (server/utils/verifySignature.ts#L9-L15) against a comma-separated key list, so keys can rotate. Persona webhooks need PERSONA_WEBHOOK_SECRET.
exactly/exa · server/hooks/panda.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Verified
The client bundle ships Alchemy keys and Segment write keys (src/utils/segment.ts#L11-L18). Both are publishable client identifiers; Rain, Persona and Sardine secrets stay server-side.
exactly/exa · common/alchemyAPIKey.ts
commit 4fba32be18 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19

Audits and bug bounty

Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-07

Audits exist, with pinned commits and per-finding fix commits, but the deployed OP Mainnet plugin is not the audited commit. I found no bug bounty in any exactly repo. Judgment call: an audit of a neighbouring version does not cover the deployed contract, so this is held at "audit report only" (1).

Evidence (2)1 verified · 1 documented

Verified
The deployed source (aceb1b5) is 23 commits after 368df25, and ExaPlugin.sol changed in between (gh api repos/exactly/exa/compare/368df25...aceb1b5). The Oct-25 update audit covers later code that is not deployed on OP Mainnet.
exactly/exa · contracts/src/ExaPlugin.sol
commit aceb1b5be2 · checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Documented
The Quantstamp ExaPlugin audit (Mar 2025) reports 11 findings, all fixed, each with an "Addressed in" commit, and a fix review ending at commit 368df25.
exactly/audits
checked 2026-10-07

Security audits 25

Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.

Date	Auditor	Type	Scope	Covers deployed code	Findings
2026-09-17	ABDK Consulting	Security review	Exactly Protocol pull request review: non-collateral markets (Auditor and Market changes). Exactly Protocol (shared component: the exaUSDC market that holds card collateral). Initial draft 2026-09-08; public report 2026-09-17 with client responses; two findings withdrawn.	Unknown
2025-10-31	ABDK Consulting	Audit	Exactly Protocol update (Market and related contracts). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	Moderate issues and recommendations; most marked info, several fixed
2025-10-30	Quantstamp	Audit	Exa App diff review: ExaPlugin changes between 1a27efdf and 16efc1be (batched proposal execution, cross-repay with non-USDC markets, minor fixes). at `16efc1be67` Reviewed 2025-09-17 to 2025-09-29. Per S6, this later code is not what is deployed on OP Mainnet (deployed source aceb1b5).	No	1 informational, fixed (fix review 2025-10-30)
2025-03-27	ABDK Consulting	Audit	Exactly RewardsController update (called by the market on deposits, borrows and repays). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	Moderate and minor issues; some fixed, the rest informational
2025-03	Quantstamp	Audit	Exa App Plugin: ExaPlugin (ERC-6900 plugin for card debit and credit, collateral and withdrawal proposals), IssuerChecker and ProposalManager. at `b262356` Reviewed 2025-01-14 to 2025-01-27 on exactly/mobile (now exactly/exa); fix review ended at 368df25. The deployed source aceb1b5 is 23 commits later and ExaPlugin.sol changed in between (S6).	No	3 high, 3 medium, 5 low; all fixed
2024-06-10	Quantstamp	Audit	Exactly WebAuthn Owner Plugin (ERC-6900 owner plugin with ECDSA, ERC-1271 and WebAuthn P-256 signatures), the passkey owner of each Exa account. at `7fcf594` Reviewed 2024-06-05 to 2024-06-10. The same PDF is in exactly/webauthn-owner-plugin audits/2024-06-10-quantstamp.pdf. Not checked against the deployed plugin 0x8f498c82...	Unknown	1 medium (fixed), 2 low (acknowledged), 5 informational
2024-04-15	ABDK Consulting	Audit	Exactly Protocol update part II: InstallmentsRouter and new Market roles. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	Recommendations only; several fixed
2024-04	Hashlock	Audit	Exactly Protocol Market.sol and InstallmentsRouter.sol on Optimism (new market roles and installments router). Exactly Protocol (shared component: the exaUSDC market that holds card collateral). at `9bd8d2e29f`	Unknown
2024-03-12	ABDK Consulting	Audit	Exactly Protocol update: interest rate model v2. Exactly Protocol (shared component: the exaUSDC market that holds card collateral). Report v3.0; v2.0 of the same report (2024-02-14) is 'ABDK Interest Rate Model v2 (Feb-24).pdf' in the same repo.	Unknown	1 major, 3 moderate (all fixed), minor issues
2024-03	Hashlock	Audit	Exactly Protocol InterestRateModel.sol and Market.sol on Optimism (interest rate model v2). Exactly Protocol (shared component: the exaUSDC market that holds card collateral). at `d424a0758a`	Unknown
2024-03	ChainSafe	Audit	Exactly Protocol interest rate model v2 review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral). at `d424a0758a` A follow-up diff review is in 'Chainsafe Interest Rate Model v2 Diff (Mar-24).pdf' in the same repo.	Unknown
2024-02-19	Quantstamp	Audit	Alchemy Modular Account v1 (shared component: the user's UpgradeableModularAccount), ERC-6900 account and plugins. at `0e3fd1e` Reviewed 2023-11-20 to 2023-12-19. Also in the v1.0.1 tag as audits/2024-02-20-quantstamp-8ae319e.pdf. Not checked against the deployed implementation 0x00460000...a61e.	Unknown	33 findings (2 high, 6 medium, 15 low, 3 undetermined, 7 informational); 21 fixed, 11 acknowledged, 1 mitigated
2024-01-31	Spearbit	Audit	Alchemy Modular Account v1 (shared component: the user's UpgradeableModularAccount), account, factory and plugins. at `0e3fd1e` Also in the v1.0.1 tag. Not checked against the deployed implementation 0x00460000...a61e.	Unknown	High finding: SESSION_KEY_DATA_PREFIX storage collision; plus medium and lower findings
2023-05-17	ABDK Consulting	Audit	Exactly Protocol phase II. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	Major, moderate and minor issues; majors marked fixed
2023-03	Coinspect	Audit	Exactly Protocol fifth audit (fixed rate curve and interest rate model changes). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	EXA-40 fixed rate curve discontinuity, EXA-41 retroactive fee collection on model change
2023-03	Coinspect	Audit	Exactly RewardsController, third review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown
2023-02	Coinspect	Audit	Exactly RewardsController, second review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	EXR-8 to EXR-12
2023-01	Coinspect	Audit	Exactly RewardsController, first review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	EXR-1 to EXR-7
2022-11-05	ABDK Consulting	Audit	Exactly Protocol first ABDK audit. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown
2022-10	Coinspect	Audit	Exactly Protocol fourth audit (price feeds and market enabling). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	EXA-36 to EXA-39
2022-10	ChainSafe	Audit	Exactly Protocol update review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral). at `af5b4907ec`	Unknown
2022-09	Coinspect	Audit	Exactly Protocol third audit. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	EXA-23 to EXA-35, including a liquidity-check bypass
2022-05	ChainSafe	Audit	Exactly Finance fixed lending protocol review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown
2022-05	Coinspect	Audit	Exactly Protocol second audit. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).	Unknown	EXA-06 to EXA-22, including a liquidity-check bypass that could drain funds
2021-11	Coinspect	Audit	Exactly Protocol first audit (FixedLender and early protocol contracts). Exactly Protocol (shared component: the exaUSDC market that holds card collateral). at `351d868e85` Covers the pre-launch FixedLender design, later replaced by Market.	No	EXA-1 to EXA-5, including reward-token theft and an admin able to seize user funds

Compiled from: github.com/exactly/audits (32 reports for Exa and the Exactly Protocol), the audits/ folders of exactly/webauthn-owner-plugin and alchemyplatform/modular-account (v1 reports; the Dec 2024 ChainLight and Quantstamp reports cover Modular Account v2, which Exa accounts do not use), exactly/exa and exactly/protocol (no audit folders), and circlefin/stablecoin-evm (no published USDC audit). Left out as outside the card path: EXA token cross-chain, EscrowedEXA (ABDK, OpenZeppelin), staking (ChainSafe, Sherlock), peripheral contracts (ABDK Sep-23) and the Cryptecon economics paper. No audit of Rain's collateral contracts is published. Exactly Protocol reports are marked unknown because the deployed exaUSDC implementation is not source-verified. No bug bounty was found. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.

Operational and procurement

Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.

Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 22 evidenced, 0 attested, 4 absent, 0 not applicable, 19 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.

Group A: operational facts

Fees

Evidenced

Component	Paid by	Amount	Basis
fx	payer	Up to 1.5% foreign exchange fee plus up to 1.5% cross-border fee (card terms); help centre states 1.5% FX	Card terms Important Disclosures (effective 12 Nov 2024); Exa may change fees on 30 days' notice.
cashout	payer	ATM 1 USD + 0.65% per withdrawal, plus any ATM operator charge	Help-centre ATM article.
cashout	payer	Bank off-ramp via Bridge: USD ACH 0.4%, US wire 1.0%, EUR SEPA 0.7% after the sponsored quota	Help-centre ramp fees article; Exa sponsors fees up to 3,000 USD or 60 transactions; wires are never sponsored.
provider	payer	Origination fee on loans (pay-later installments), included in the interest; 0% APR on card purchases	Help-centre fees article and card terms Important Disclosures.

No issuance, monthly or annual fee is stated; the card is virtual only (no physical card). Card terms and help centre differ on FX: the terms allow up to 1.5% FX plus up to 1.5% cross-border, the help centre says 1.5%. Judgment call: first-party help-centre pricing pages are treated as documented here.

Documented
Exa Labs Spend Card Terms, Important Disclosures, Fees.
help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Help article "Exa Card associated fees and costs" (Oct 2024).
help.exactly.app/en/articles/9055779-exa-card-associated-fees-and-costs
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
ATM article, Limits & Fees.
help.exactly.app/en/articles/11758961-how-to-withdraw-cash-from-an-atm-with-your-exa-card
checked 2026-10-09
Documented
Onramping and offramping fees and limits (Bridge and Manteca).
help.exactly.app/en/articles/14093183-onramping-offramping-fees-limits
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Custody model

Evidenced

Hybrid: self-custody with a provider-controlled spend path

Funds rest in the user's own passkey-owned modular account as exaUSDC, but Exa's issuer signature plus keeper can debit any amount to a collector the admin Safe can repoint without a timelock. Agrees with the S1 finding (score 0, provider can redirect funds); the spend path is unbounded, which is the weakest form of hybrid.

Evidence shared with CROPS: S1 item 1, S1 item 2, S1 item 3

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Licences and registrations

Unknown

The card terms name Third National as issuer under a Visa licence with Puerto Rico governing law, and the help centre says the card is issued in the US with Rain's address in San Juan, PR. No first-party document states Third National's regulator, licence type or number. FDIC BankFind lists no active institution named Third National; the OCIF licence verification site failed the TLS handshake from this environment. Ramp partners Bridge Ventures Inc. and Sixalime S.A.S. (Manteca) were not checked against registers.

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Cash-out options

Evidenced

Where	Method	Partner	Fee	Limits
everywhere offered	card withdrawal	Third National (issuer), Rain, Visa	FX up to 1.5% (+ up to 1.5% cross-border) on non-USD spend	Card spend at merchants (the schema has no card-spend value); 10,000 USD weekly purchase limit before source-of-funds checks; not usable in CU, IR, KP, RU, SY, UA, VE.
everywhere offered	atm	Third National (issuer), Visa	1 USD + 0.65% per withdrawal	250 USD per withdrawal, 4 per day; contactless ATMs via Apple Pay or Google Wallet only (no physical card).
everywhere offered	bank transfer	Bridge Ventures Inc.	USD ACH 0.4%, US wire 1.0%, EUR SEPA 0.7% after sponsored quota	USDC converted to USD (ACH, wire) or EUR (SEPA) to an account in the user's name; Bridge may restrict by jurisdiction.

Contradiction: the card terms say cash advances are not available while the help centre documents ATM withdrawals with fees. Recorded as the help centre states. Manteca (ARS, USD, BRL) is a deposit service only in its Exa terms and is not listed as a cash-out route.

Documented
Card terms, purchases and restrictions; cash advances are not available under the card terms.
help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
ATM article; withdrawal by tapping a phone wallet at a contactless ATM.
help.exactly.app/en/articles/11758961-how-to-withdraw-cash-from-an-atm-with-your-exa-card
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Bridge Particular Terms, section 2.2 Offramp Service.
help.exactly.app/en/articles/13862897-bridge-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

First deployment

Evidenced

2025-04-08 (block 134272952): IssuerChecker 0x59A644E490E48235adF8ba9b814A4f666C4fEb3A on OP Mainnet (current settlement path; ExaPlugin 0x3d73...7f3e followed at block 134273180)

Dates the deployed contracts scored in CROPS. The card existed before this (card terms effective 12 Nov 2024, fee article Oct 2024) on earlier plugin versions; the exa repo keeps only run-latest broadcasts, so earlier deployments were not dated.

Verified
IssuerChecker has code size 0 at block 134272951 and 4241 at 134272952 (2025-04-08 20:38:01 UTC), creation tx 0xce519a2e...3fb5. ExaPlugin 0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e goes from 0 to 24567 bytes at block 134273180 (2025-04-08 20:45:37 UTC), tx 0x23fa401b...a9ba.
0x59A6…Eb3A on explorer.optimism.io
0x59A6…Eb3A explorer · Sourcify · block 134272952 · checked 2026-10-09

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Operating entity

Evidenced

EXA LABS S.A.S., UY

No company-register entry checked.

Documented
App Terms opening paragraph names EXA LABS S.A.S., incorporated under the laws of Uruguay.
help.exactly.app/en/articles/9942510-exa-app-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Security incidents

Unknown

Absence of a found incident is not evidence that none occurred.

No primary-source incident report found in the help centre, exactly/docs, exactly/audits or a GitHub code search of the exactly org (post-mortem, exploit). Exactly's Medium and Mirror return 403 to curl and were not read. A reviewer should check for incidents on the underlying Exactly Protocol markets before the card launch.

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Product changes affecting users

Evidenced

2024-11-12: Card terms Important Disclosures take effect (0% APR on purchases, FX and cross-border fees up to 1.5%); the terms were revised on 2 Oct 2025. source
2025-04-08: New IssuerChecker and ExaPlugin deployed on OP Mainnet (the versions currently installed on user accounts). source

Documented
Card terms Important Disclosures effective date.
help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Volume transacted (verified only)

Unknown

not computed on 2026-10-19: eth_getLogs: Your IP has exceeded its requests per second capacity. Please consider using a dedicated API provider: https://community.optimism.io/docs/useful-tools/providers

Card collections are recorded as Collected events on the listed IssuerChecker, so they can be separated from ordinary transfers. Not yet computed; the maintainer runs scripts/volumes.mjs. The amount is USD-denominated USDC per the plugin; the token is fixed to native USDC on OP.

UnreviewedAssessed by AI research agent (operational), 2026-10-09

Group B: institutional due diligence

Control	State	What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?	Unknown	No ISO 27001 statement for EXA LABS S.A.S. found in the help centre (sitemap, security and compliance collection), exactly/docs or the exa repository.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?	Unknown	No hosting or support organisation certification found.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?	Unknown	No SOC 2 or ISAE report or statement of availability found. The help article "How secure is your card?" only says the card is issued and certified by Visa.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?	Evidenced	Quantstamp audits of the Exa App Plugin (Mar 2025, Oct 2025 update) and WebAuthn plugin (Jul 2024), plus many Exactly Protocol audits; the deployed OP plugin is 23 commits past the Mar 2025 fix review. No review of the server or app found. Cross-reference CROPS S6 (score 1). The Exactly Protocol bug bounty (Immunefi) is described in exactly/docs security/bug-bounty-program.md; its scope for the Exa plugin is not stated. CROPS S6 · CROPS S6
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?	Unknown	No penetration-test report or attestation found.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?	Unknown	No vulnerability-scanning cadence stated; exactly/docs describes Hypernative onchain monitoring and Codecov coverage for the protocol, not platform scanning.
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?	Absent	none of 4 repo(s): exactly/exa ✗ no security policy file; exactly/webauthn-owner-plugin ✗ no security policy file; exactly/protocol ✗ no security policy file; exactly/docs ✗ no security policy file source 1 · source 2 · source 3 · source 4
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?	Unknown	No patch service levels found in the terms, help centre or docs.
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?	Absent	none of 4 repo(s): exactly/exa ✗ no scanning config or workflow step found; exactly/webauthn-owner-plugin ✗ no scanning config or workflow step found; exactly/protocol ✗ no scanning config or workflow step found; exactly/docs ✗ no scanning config or workflow step found source 1 · source 2 · source 3 · source 4
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?	Evidenced	No time-bound notification commitment. The published emergency procedure says to communicate internally and externally "as appropriate" and to assign a security disclosure report; the Privacy Policy has no breach-notification clause. source 1
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?	Unknown	No statement on backups or restore testing found.
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?	Evidenced	Published emergency procedure (roles, war room, checklist) for loss-of-funds incidents in the protocol and contracts; not stated to be tested, and no recovery plan for the card backend. For the user exit path see CROPS S4. source 1 CROPS S4
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?	Unknown	No status page and no post-mortem found (help centre sitemap, exactly/docs tree, GitHub code search in the exactly org for post-mortem or exploit). Exactly's Medium and Mirror pages return 403 to curl and were not read; a reviewer should check whether Exactly published post-mortems there.
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?	Evidenced	The account is owned by a device passkey (WebAuthn owner plugin); sign-in uses the passkey with no password. SIWE sign-in is also accepted. source 1 CROPS S4
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?	Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?	Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?	Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?	Evidenced	Server session cookie expires 24 hours after sign-in (absolute expiry); no idle timeout found in the server code. source 1 · source 2
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?	Evidenced	Browser-to-server calls are authenticated with a signed httpOnly cookie issued after WebAuthn (passkey) or SIWE verification; not OAuth or OIDC. source 1 · source 2
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?	Evidenced	Card-issuer (Rain, "panda") webhooks are authenticated by a signature header checked against a comma-separated list of signing keys, which allows key rotation; outbound calls to Rain, Persona and Sardine use API keys from environment variables. Cross-reference CROPS S5. Key scoping is not visible from the code. source 1 CROPS F3
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?	Evidenced	Session cookie lifetime 24 hours; no shorter token for sensitive data. source 1
B5.4 Export controls If an API exports data, does it limit volumes and log exports?	Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?	Evidenced	Privacy Policy states only "appropriate technical and organizational security measures"; no data classification, encryption-at-rest or TLS statement. source 1
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?	Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?	Evidenced	Retained only as long as necessary for the stated purposes, with periods set by record type and legal requirements; no fixed periods and no deletion-on-termination clause. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?	Evidenced	EXA LABS S.A.S. (Uruguay) is named as the company processing user data; KYC is run by Persona as a third-party provider. The policy does not use controller/processor terms and mentions no DPIA. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?	Unknown	No customer DPA found; the Privacy Policy says international transfers are made "on the basis of a previous agreement with the third-party processor".
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?	Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?	Unknown	exactly/docs describes Hypernative real-time monitoring of protocol contracts with automated pause; the server reports errors to Sentry. No SIEM or endpoint-detection statement found.
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?	Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?	Absent	none of 4 repo(s): exactly/exa ✗ no deployment configuration; exactly/webauthn-owner-plugin ✗ no deployment configuration; exactly/protocol ✗ no deployment configuration; exactly/docs ✗ no deployment configuration source 1 · source 2 · source 3 · source 4
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?	Evidenced	some of 4 repo(s): exactly/exa ✓ rules: deletion, non_fast_forward, creation, required_linear_history, required_signatures, pull_request, required_status_checks, copilot_code_review; exactly/webauthn-owner-plugin ✗ no branch rules visible (classic branch protection is not readable without push access); exactly/protocol ✗ no branch rules visible (classic branch protection is not readable without push access); exactly/docs ✗ no branch rules visible (classic branch protection is not readable without push access) source 1 · source 2 · source 3 · source 4
B9.2 CI runs on pull requests Does every pull request trigger automated checks?	Evidenced	some of 4 repo(s): exactly/exa ✗ 12 workflow file(s); exactly/webauthn-owner-plugin ✓ 1 workflow file(s); exactly/protocol ✓ 2 workflow file(s); exactly/docs ✓ 1 workflow file(s) source 1 · source 2 · source 3 · source 4
B9.3 Tests run in CI Do the CI workflows run the test suite?	Evidenced	some of 4 repo(s): exactly/exa ✗ test command in a workflow; exactly/webauthn-owner-plugin ✓ test command in a workflow; exactly/protocol ✗ test command in a workflow; exactly/docs ✗ test command in a workflow source 1 · source 2 · source 3 · source 4
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?	Evidenced	some of 4 repo(s): exactly/exa ✓ coverage tooling referenced; exactly/webauthn-owner-plugin ✓ coverage tooling referenced; exactly/protocol ✓ coverage tooling referenced; exactly/docs ✗ coverage tooling referenced source 1 · source 2 · source 3 · source 4
B9.5 Versioned releases Are releases tagged with immutable semantic versions?	Evidenced	some of 4 repo(s): exactly/exa ✗ latest tags: @exactly/substreams@0.1.0, @exactly/server@0.2.129, @exactly/server@0.2.128; exactly/webauthn-owner-plugin ✗ no tags; exactly/protocol ✓ latest tags: v0.2.24, v0.2.23, v0.2.22; exactly/docs ✗ no tags source 1 · source 2 · source 3 · source 4
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?	Evidenced	some of 4 repo(s): exactly/exa ✗ 2 of 10 recent commits signed; exactly/webauthn-owner-plugin ✓ 10 of 10 recent commits signed; exactly/protocol ✓ 9 of 10 recent commits signed; exactly/docs ✓ 10 of 10 recent commits signed source 1 · source 2 · source 3 · source 4
B9.7 Changelog Is a changelog maintained with the code?	Evidenced	some of 4 repo(s): exactly/exa ✓ CHANGELOG file; exactly/webauthn-owner-plugin ✗ no changelog or release notes; exactly/protocol ✓ CHANGELOG file; exactly/docs ✗ no changelog or release notes source 1 · source 2 · source 3 · source 4
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?	Absent	none of 4 repo(s): exactly/exa ✗ none found; exactly/webauthn-owner-plugin ✗ none found; exactly/protocol ✗ none found; exactly/docs ✗ none found source 1 · source 2 · source 3 · source 4
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?	Evidenced	The Exa tech-stack page gives a three-layer logical view (Exactly Protocol, Alchemy modular account with WebAuthn and Exa plugins, Exa App); the full server and app source is public. No infrastructure or integration view of Rain, Persona and Sardine. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?	Evidenced	EXA LABS S.A.S., incorporated in Uruguay, under the App Terms; the card terms are between the user, Exa Labs SAS and the issuer Third National, governed by Puerto Rico law. Ramps add Bridge Ventures Inc. (USD/EUR) and Sixalime S.A.S. (Manteca, deposits). No Uruguayan company-register entry was checked. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?	Unknown implied from the component list
B11.3 Termination terms What happens to customer funds and data on termination by either side?	Evidenced	Exa and the issuer may suspend, revoke or cancel the card at any time with or without notice; Exa may terminate app access for any reason without notice. Amounts owed survive. Funds stay in the user's self-custodial account and can be withdrawn through the contract path (CROPS S4). source 1 CROPS S4
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?	Evidenced	Every card authorisation and refund is sent to Sardine for an automated risk level and score, but at 4fba32b the result only raises an error alert for high or very high risk; it does not decline the payment in code. Whether Sardine's scoring is machine-learning based is not stated by Exa. source 1 · source 2
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?	Unknown	No documentation of monitoring, override or bias evaluation for the Sardine risk scoring was found.

Scope of assessment

Components in the payment path

Component	Role	Public	Licence	Operator	Required
User's modular smart account (Alchemy UpgradeableModularAccount v1)	wallet	Yes	GPL-3.0	User (passkey owner via WebauthnOwnerPlugin)	Yes
WebauthnOwnerPlugin	contracts	Yes	GPL-3.0	Exa Labs (code); user (owner)	Yes
ExaPlugin, IssuerChecker and ProposalManager	contracts	Yes	GPL-3.0	Exa Labs (admin Safe 0x6561...434C)	Yes
Exactly Protocol exaUSDC market (card collateral and credit)	contracts	Yes	source-available	Exactly (timelock, protocol Safe, Pauser)	Yes
USDC (Circle) on OP Mainnet	contracts	Yes	Apache-2.0	Circle	Yes
Exa server (card authorisation webhooks, KYC orchestration, collection signing)	backend	Yes	none	Exa Labs	Yes
Keeper EOA and issuer signing key	signer	No	proprietary	Exa Labs	Yes
Card collector (Rain collateral BeaconProxy; implementation RainCollateral)	contracts	Yes	none	Rain (beacon owner Safe 0x6454...Bf15, 2-of-5)	Yes
Rain (card program and issuing API, "panda" in code)	api	No	proprietary	Rain	Yes
Third National (card issuer)	card-issuer	No	proprietary	Third National	Yes
Visa (card network)	card-network	No	proprietary	Visa	Yes
Persona (KYC)	kyc	No	proprietary	Persona	Yes
Sardine (transaction risk scoring in card authorisation)	other	No	proprietary	Sardine	Yes
Exa App (mobile and web frontend)	frontend	Yes	none	Exa Labs	No
Alchemy (RPC, bundler, gas manager for the app)	bundler	No	proprietary	Alchemy	No
Exa substreams indexer	indexer	Yes	none	Exa Labs	No

Repositories

Repository	Role	License
exactly/exa	backend	none
exactly/webauthn-owner-plugin	contracts	GPL-3.0
exactly/protocol	contracts	BUSL-1.1
exactly/docs	docs	none

Contracts

Role	Address	Source verified
ExaPlugin (ERC-6900 account plugin), non-upgradeable	`0x3d73…7f3e` explorer · Sourcify	sourcify
IssuerChecker (Exa issuer signature check)	`0x59A6…Eb3A` explorer · Sourcify	sourcify
ProposalManager (60 s delay on user withdrawals)	`0x6817…8338` explorer · Sourcify	sourcify
Refunder	`0xd5f8…d228` explorer · Sourcify	sourcify
Exactly exaUSDC market (TransparentUpgradeableProxy)	`0x6926…A8bb` explorer · Sourcify	sourcify
Card collector, Rain collateral BeaconProxy	`0x3a73…eFc5` explorer · Sourcify	none
RainCollateral implementation behind the collector beacon	`0xD71F…7624` explorer · Sourcify	sourcify
Exa contracts admin, Safe 1.4.1 3-of-4	`0x6561…434C` explorer · Sourcify	none
Exactly Safe 3-of-6 (PAUSER_ROLE, timelock proposer)	`0xC0d6…86D3` explorer · Sourcify	none
TimelockController (1 day) owning the market ProxyAdmin	`0x9202…b58b` explorer · Sourcify	sourcify
Exactly Pauser (EMERGENCY_ADMIN_ROLE), owned by an EOA	`0x8cC0…F2A3` explorer · Sourcify	sourcify
WebauthnOwnerPlugin (passkey owner of each account)	`0x8f49…4ca0` explorer · Sourcify	sourcify
Sample user account (ERC-1967 proxy, modular account)	`0x973c…14b8` explorer · Sourcify	none

Assessor notes

Scored the OP Mainnet card on contracts pinned at exactly/exa aceb1b5 (which matches Sourcify), the backend and app at HEAD 4fba32b, and onchain reads at OP block 157885618. The card is issued by Third National through Rain, on Visa. Collateral sits in the user's own Alchemy modular account as exaUSDC in the Exactly Protocol market; Exa's keeper debits it with an Exa issuer signature. Explorer verification could not be checked because Optimistic Etherscan and Blockscout block automated requests.