Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
The terms say the MiniPay Service is available only to users in "qualifying countries" and is void where prohibited, but neither the terms, the FAQ nor the site publishes the list of qualifying countries. The only country the terms name is the People's Republic of China, where Blueboard offers no crypto-related services, so CN is the only entry. This is a floor, not a claim that MiniPay is offered everywhere else: availability elsewhere depends on the unpublished qualifying-country list, and users also warrant they are not on any trade embargo or sanctions list (no list named). The site's "send to 70+ countries" and the FAQ's "53 countries" and "over 60 countries" for local top-up describe transfer and ramp reach, not where the wallet is offered. The MiniPay Card is offered only "in selected supported markets", also unlisted. The underlying Celo contracts have no country restriction; this block describes the MiniPay app.
MiniPay (Blueboard Limited) terms of service, general terms; same section says the Services are made available to users in qualifying countries and are void where prohibited.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Blueboard can cut an individual user off from the MiniPay app at any time with no notice, which blocks the MiniPay payment path for that user. MiniPay has no settlement contracts of its own: transfers are plain stablecoin transfers on Celo, and issuer freeze powers over USDC and USDT belong under C5. Judgment call: scored 0 on the termination power over the app path. The user's keys stay with the user (see C2 and S4), so the funds themselves are not frozen by this power.
Evidence (1)1 documented
Documented
Blueboard Terms of Service, general section: Blueboard may terminate an individual user's access to the Services at any time, with or without notice.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A MiniPay payment is an ERC-20 transfer on Celo signed with a key the user holds, so a user holding the recovery phrase can settle by calling the token contract directly from any Celo wallet. This is shown by terms and docs only. No trace of exporting a MiniPay key and settling elsewhere was run, so the documented cap of 1 applies.
Evidence (2)2 documented
Documented
MiniPay service terms: the app stores a key pair with an encrypted private key; assets live on Celo; 'Neither your key pair nor the Secret Recovery Phrase is available to us.'
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Using MiniPay requires an account with Blueboard's closed backend, reached only through Blueboard's closed app. No intermediary code is public and no alternative operator exists. The RPC endpoint the app uses was not identified. Judgment call: anchor 1 (documented, no public code) and anchor 0 (closed, single-vendor) both fit; took 0.
Evidence (2)2 documented
Documented
Privacy statement section 2: a phone number is collected to set up a MiniPay account; Technical Data (IP, UID, device data) and Transactional Data are collected by Blueboard when the app is used.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Geographic and sanctions gating at the app edge is disclosed in the terms. The terms do not name the list source or the country list. Whether the closed app or backend filters addresses or transactions cannot be checked from code. The settlement layer (Celo plus the stablecoin contracts) is outside MiniPay and was not examined here.
Evidence (1)1 documented
Documented
Terms: MiniPay is limited to qualifying countries (the general section excludes the People's Republic of China); users warrant they are not on any trade embargo or economic sanction list.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The chain and supported tokens are listed in docs. No user-facing document read states the USDC and USDT issuers' freeze or blacklist powers or the Celo sequencer assumptions. No MiniPay code is public, so the token list cannot be shown in code.
Evidence (1)1 documented
Documented
Celo's MiniPay page enumerates the chain (Celo mainnet 42220) and the three tokens (USDm 0x765DE816845861e75A25fCA122bb6898B8B1282a, USDC 0xcebA9300f2b948710d2653dD7B07f33A8B32118C, USDT 0x48065fbBE25f71C9282ddf5e1cD6D6A887483D5e).
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No component of MiniPay itself (app, backend, issuer service) is public. The public MiniPay code is Celo's partner snippets and Mini App templates, which do not run the wallet.
Evidence (2)1 verified · 1 documented
Verified
The only repo named for MiniPay that carries MiniPay-specific values is celo-org/minipay ('MiniPay snippet code for external partners'): balance, gas and SocialConnect lookup snippets, no LICENSE file. github.com/opera (13 repos) and github.com/operasoftware (137 repos) contain no MiniPay code.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The Mini App interface is documented on a hosted docs site, not versioned in a public repo. No payee data export format is documented. Settlement uses standard ERC-20 ABIs that MiniPay does not define.
Evidence (1)1 documented
Documented
MiniPay developer docs document the injected EIP-1193 provider, custom methods (getExchangeRate, scanQrCode, requestContact) and token transfer examples for Mini Apps.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
An attribution/analytics SDK (AppsFlyer) and Firebase messaging are in the app, disclosed in the privacy statement. Whether they are on by default, and what they send, could not be checked: the app is closed and no trace was run.
Evidence (1)1 documented
Documented
Privacy statement section 5 names AppsFlyer and Firebase Cloud Messaging as third-party code in MiniPay and lists 'analytic system technology providers' among processors.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
MiniPay collects identity, device and behavioural data and links transactions to a user ID, well beyond addresses and amounts. All of this is disclosed in the privacy statement, and part of it is used for marketing and product analytics rather than any legal requirement. Judgment call: anchor 1 (disclosed in a policy) and anchor 0 (collection beyond the stated legal requirement) both fit; took 0.
Evidence (2)2 documented
Documented
Privacy statement: collects phone number, receiver phone number, IP, UID, device data and in-app actions, wallet address and holdings, and transaction type and amount linked to the UID; processed for contract, legitimate interests, legal compliance and marketing.
What do calldata and events reveal about who paid whom for what? P3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Each payment is a plain stablecoin transfer, which links payer and payee publicly. In addition, MiniPay's issuer publishes onchain an attestation that ties each registered wallet address to an ODIS-obfuscated phone identifier. That marks the address as a MiniPay account, and anyone with ODIS quota can resolve a phone number to it. The user-facing privacy statement says no personal data goes to blockchain networks. Judgment call: the attestation is described in developer docs but not to users, so the linkage is treated as undisclosed; 0 rather than 1.
Evidence (3)2 verified · 1 documented
Verified
FederatedAttestations emitted 1975 AttestationRegistered events with issuer = MiniPay issuer 0x7888612486844Bb9BE598668081c59A9f7367FBc in blocks 79454281-79459279. Example: lookupIdentifiers(0xad14248c1A6401162Abbe73047c941397b22F5c2, [MiniPay issuer]) at block 79459279 returns the phone-derived identifier 0xda87e60402949f20227d37ae0693c65441a0cafe18435dd982c5b2cf1eafb9a5.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Third parties in and around the payment flow are disclosed by category in the privacy statement. The ramp providers and the RPC provider are not named, and none of this can be checked or swapped in code because the app is closed.
Evidence (1)1 documented
Documented
Privacy statement section 5 lists Opera Group companies, text-message, support and analytics providers, on/off-ramp and swap providers, AppsFlyer, Firebase Cloud Messaging, WhatsApp and Telegram (Indonesia).
Who holds funds between payer and payee, and can the provider redirect them? S1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
By the terms, MiniPay is self-custodial and payments go directly from payer to payee as token transfers. That matches anchor 3, but it rests on documents only: key generation and storage in the closed app cannot be checked. The documented cap of 1 applies.
Evidence (1)1 documented
Documented
MiniPay service terms: the app generates the key pair on the device, stores an encrypted private key, and backs up the recovery phrase to the user's Google account; Blueboard says it has no access to either.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived. S1 = 1 (self-custody per terms, documented cap), C2 = 1 (direct ERC-20 transfer possible with the user's key, documented only), C3 = 0 (closed single-vendor app and backend), O3 unknown (nothing public to self-host). If Blueboard disappears, a user with the recovery phrase can move funds through another Celo wallet. This is documented, not verified, and the MiniPay app path itself stops.
Evidence (1)1 documented
Documented
Terms: user-held keys and recovery phrase; assets held on Celo, not by Blueboard (see S1, C2).
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 4
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Mento Core v3, including StableTokenV3 and StableTokenSpoke (the USDm token contracts), FPMM swaps, liquidity strategies, oracle adapter and ReserveV2 at 0e07807c22 Five review rounds from 22 October 2025 (683af1f) to the final version 0e07807. USDm is one of the tokens MiniPay users hold and send; whether the USDm proxy on Celo points to the audited StableTokenV3 was not checked.
Celo L2 blockchain (OP Stack fork): token duality, fee currencies, alt-DA, L1-to-L2 data migration; celo-monorepo contracts, celo-org/op-geth and celo-org/optimism at c6d7b55 Targets: celo-monorepo 89591e1 and PR #11261, op-geth c6d7b55, optimism 50977c3; review October-November 2024. Celo mainnet has since moved to later rebases of op-geth and optimism (celo-rebase-17/18), so the audit covers an earlier version of the chain MiniPay settles on.
Shared component: Celo OdisPayments contract and proxy (ODIS quota payments made by SocialConnect issuers such as MiniPay's), celo-monorepo PR #9740 at 4bf959b Listed as a Core Contracts Release 8 audit in the Celo forum release post. Used only in the optional phone-number lookup flow.
Unknown
1 medium (cUSD paid in cannot be withdrawn; acknowledged), 1 informational (resolved)
Shared component: Celo Core Contracts Release 8 (per the Celo forum post, the release that added FederatedAttestations and updated Escrow); exact contract list not read Linked as the Core Contracts Release 8 audit report in the Celo forum post "Core Contracts Release 8" (forum.celo.org/t/core-contracts-release-8/4050) and in the cLabs Identity Team milestone post. The URL returns HTTP 403 to scripted requests, so the report was not read; the date is taken from the file name. FederatedAttestations holds the MiniPay issuer's phone attestations.
Unknown
Compiled from: minipay.to and Opera's press and security blog pages (no MiniPay audit linked), github.com/celo-org/minipay, the security-reviews folders of celo-org/celo-monorepo and celo-org/optimism (the latter holds upstream OP Stack reviews, not listed here), the Celo forum (L2 audit and Core Contracts Release 8 posts), mento.org/audits and ChainSecurity's Mento reports, and web searches for MiniPay, ODIS and SocialConnect audits. No audit of the MiniPay app, backend or issuer service was found. Not listed: Immunefi's Nov-Dec 2024 Celo competition (L1-to-L2 migration tooling and stCelo); Mento's Hats, Sherlock and Macro entries (no report linked); the ChainSecurity Mento Liquity v2 audit. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 0 attested, 0 absent, 3 not applicable, 35 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
provider
none
no MiniPay fee on wallet transfers
MiniPay FAQ; set by Blueboard and changeable.
network
payer
Celo network fee, stated as typically under $0.01
Celo gas, payable in stablecoins; set by the network, not MiniPay.
provider
payee
$1 + 1% on deposits to a USD virtual account; EUR 1 + 1% on EUR
MiniPay FAQ (virtual accounts provided by NOAH).
card
none
no issuance or monthly MiniPay Card fee
MiniPay FAQ; Visa exchange rates and fees may apply on non-USD purchases.
cashout
payer
set by third-party ramp providers; FAQ says fee-free local-currency withdrawals are available through some
MiniPay FAQ; partner fees are not published by MiniPay.
Judgment call. The provider file treats the FAQ as claimed (support content) for CROPS scores, but here it is cited as documented because it is the operator's only published pricing statement. Ramp-partner fees are unknown.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Self-custody
Self-custody per the terms (key pair generated on device, recovery phrase backed up to the user's Google account, "not available to us"). The app is closed, so this rests on documents only (CROPS S1 holds at the documented cap). The MiniPay backend still holds account and transaction data, so operator controls apply.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licences and registrations
Unknown
No licence held by Blueboard Limited was found in the terms, privacy statement, FAQ or minipay.to. The terms say Blueboard offers no exchange services and that buying and selling crypto assets is provided by third parties under their own terms, so any licences sit with the unnamed ramp and virtual-account partners (NOAH named for virtual accounts). No regulator register was searched for Blueboard.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
exchange
Integrated third-party ramp partners (not named per country)
Partner-set; not published by MiniPay
The payout method (bank, mobile money or other) depends on the ramp partner in each country, and MiniPay publishes no per-country partner list, so the method is recorded as exchange through a ramp. Because the wallet is self-custodial, a user can also move stablecoins to any exchange on Celo. The MiniPay Card is digital-only, and no ATM withdrawal is documented.
Documented
MiniPay FAQ, "How can I withdraw my funds from MiniPay?"; top-ups and withdrawals are provided by third parties.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Evidenced
Blueboard Limited, IE
Jurisdiction IE comes from Opera Ltd's Form 20-F for 2020 (SEC accession 0001437749-21-014514, exhibit 8.1 list of subsidiaries, "Blueboard Limited Ireland"), read 2026-10-09. sec.gov returns 403 to the validator's user agent, so it is not cited as an evidence URL. The Irish Companies Registration Office entry was not read, so no registration number is recorded.
Documented
MiniPay terms of service (last update April 27, 2026); governed by Norwegian law with the Oslo City Court as venue.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
MiniPay transfers are ordinary stablecoin transfers on Celo, but the provider file lists no settlement contracts. The only MiniPay-specific onchain marker is the SocialConnect issuer's attestations, which identify registered addresses, not MiniPay-originated transfers. A volume figure would need an attribution method that has not been reviewed. Reported figures are not recorded.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement for Blueboard Limited or Opera found; not in the Coalfire Certification directory (checked for Wise).
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
Opera runs public and private bug bounties (security.opera.com, bugcrowd.com/opera); whether MiniPay is in scope was not established, and no penetration-test report was found.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
N/A: falls to the institution
Self-custody per the terms. Funds sit on Celo under user-held keys, and the recovery phrase is backed up to the user's own Google account, not by Blueboard. Backups of Blueboard's account and transaction metadata are not covered by this control and were not found.
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
N/A: falls to the institution
Self-custody per the terms. If the app stops, recovery is the user's recovery phrase in another Celo wallet (CROPS S4, documented only).
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown
No status page found.
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Access and recovery go through the user's Google Account login. Any MFA is whatever the user sets on that Google account; MiniPay states no MFA of its own. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
N/A: no such service implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
The documented Mini App interface is an injected EIP-1193 provider in the app (CROPS O4); the authentication of the app-to-backend API is not documented.
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Observed: minipay.to refuses TLS 1.1 and accepts TLS 1.2. The terms say the private key is stored encrypted on the device. No statement on server-side encryption at rest or data classification was found. source 1
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Contact, technical, personal and wallet data kept for two years after use ends; transactional data while active and for two years after. Deletion on request through an online form. See CROPS P2 for what is collected. source 1
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Blueboard Limited is the data controller under the GDPR; a Data Protection Officer is reachable by form; the Irish DPC and Norway's Datatilsynet are named as supervisory authorities. DPIA availability not found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Integration view only (docs.minipay.xyz documents the injected provider, custom methods and token transfers for Mini Apps); the logical and infrastructure architecture of the app and backend is not published. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Blueboard Limited (Opera Group; Ireland per Opera's 20-F subsidiary list). Terms governed by Norwegian law, with the Oslo City Court as venue. source 1
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Unknown
MiniPay charges no wallet fees. It takes deposit fees on virtual accounts and pays card cashback; it is part of the Opera Group. No primary source on how its ongoing operation is funded was read.
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Blueboard may terminate access at any time, with or without notice; termination ends the software licence. Funds stay on Celo under the user's keys (self-custody per the terms), so exit is through the recovery phrase. source 1 CROPS S4
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown
The terms and privacy statement (searched for AI, automated decision-making and machine learning) do not mention AI in payment processing or compliance. The app is closed, so absence cannot be shown.
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Third-party KYC (e.g. SumSub) for ramp and card services
kyc
No
proprietary
Third parties
No
AppsFlyer and Firebase Cloud Messaging SDKs
other
No
proprietary
AppsFlyer; Google
No
Google Drive key backup
other
No
proprietary
Google
No
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Incumbent by the eligibility rule: no verified contract and no public repository needed to run MiniPay was found. MiniPay is a closed, self-custodial stablecoin wallet app (Android, iOS, inside Opera Mini) offered by Blueboard Limited (Opera Group) on Celo mainnet (chain 42220). It settles in third-party stablecoins (USDm, USDC, USDT) and maps phone numbers through Celo's generic SocialConnect stack (ODIS plus the FederatedAttestations core contract 0x0aD5b1d0C25ecF6266Dd951403723B2687d6aff2). The one MiniPay-specific onchain element is its SocialConnect issuer, 0x7888612486844Bb9BE598668081c59A9f7367FBc, which has no code (an EOA), so it is not a verified contract. MiniPay-related public repos all belong to celo-org (snippets, Mini App templates, workshops); none runs the wallet. The Opera and operasoftware GitHub orgs have no MiniPay repo, and github.com/minipay is an unrelated 2019 org. www.opera.com/products/minipay redirects to minipay.to, which links the terms, privacy statement and docs.minipay.xyz. The FAQ on minipay.to is support content, so it is claimed tier and holds no score up. Search log: docs/research/minipay.md.
