Security
Last Updated: MVP Phase
1. Overview
Security is the foundation of decentralized commerce. This document outlines the security posture of the PadiPay ecosystem during its current MVP phase. Please note that this is an early-stage deployment intended for testing and validation.
2. Smart Contracts & Testnet
Our core escrow logic is built with Rust and deployed to the Stellar Soroban Testnet. The contracts are designed to enforce multi-party agreements and securely hold funds in escrow.
Status: The smart contracts are currently deployed on Testnet. They have not yet undergone formal, independent security audits. They are intended for testing purposes only, and users should not interact with them using mainnet assets or real funds.
3. Relayer API & Fee Sponsorship
The PadiPay Relayer API abstracts away blockchain complexity and sponsors transaction fees for users. The API communicates with the Stellar network via secure endpoints. The Relayer architecture is designed so that it does not hold or require access to users' personal private keys for escrow interactions.
4. Frontend & Web UI
This frontend is currently a UI-first MVP. At this stage, it does not handle private keys, manage direct custody of assets, or connect to mainnet blockchain wallets. Wallet integration and corresponding client-side security measures are planned for a future milestone.
5. Vulnerability Reporting
We welcome collaboration with the security community. If you discover a vulnerability in the PadiPay Frontend, Relayer API, or Smart Contracts, we kindly ask that you do not disclose it publicly. Please contact the core maintainers via our official GitHub repository by creating a confidential security advisory.