Security

The topup product depends on its payment contract, BNB/USD oracle, identity registry, RPC finality, database ledger, and AI provider.

Contract permissions

CreditTopUp is non-upgradeable. Treasury, USDT, and registry are immutable. The admin can change the oracle and manage roles. The pauser can stop and resume new payments. The contract uses a reentrancy guard, validates oracle freshness and decimals, checks exact USDT receipt, and reverts failed treasury transfers or BNB refunds.

Credit trust boundary

Only a validated event from the configured contract grants credit. The worker verifies RPC finality and at least 15 blocks after payment. Event identity and grant-source uniqueness prevent duplicate credit. Application inserts are atomic under event and wallet locks.

Ponder owns raw reorg-managed tables. The application ledger is separate. A consensus failure after finalized settlement requires operator reconciliation; it does not automatically reverse already-spent credit.

AI credit is an off-chain service balance. Users depend on the operator to retain the database and provide inference. Credit does not expire, but that does not guarantee perpetual service availability.

Authentication and API keys

Wallet login uses EIP-712 and httpOnly cookies. Credit/history reads verify the expected wallet against the session. Keys use 256 random bits and are stored as hashes. Full secrets are returned once. Scope, model restrictions, expiry, revocation, budgets, wallet balance, and rate limits are checked before reservations.

Concurrent requests share a wallet lock. In-flight pricing is fixed and charges cannot exceed reserved credit. Provider credentials stay on the server. Users must store their own one-time API secrets in server-side environments.

Browser data

Chat history is saved locally per wallet. Wallet scoping separates the displayed accounts; it does not encrypt browser storage. Signing out hides history without erasing it. Delete conversations or clear site data when removing history from a shared device.

New API secrets are held only in the creation dialog and cleared on dismissal, route changes, and account changes. Previously copied secrets remain wherever the user saved or pasted them. See Legal and privacy for provider processing and API keys for rotation.

Review status

The historical self-audit does not cover the new topup contract, settlement worker, or migration. Testnet deployment and source verification are complete. Independent review and mainnet deployment are pending. See Audit.

Historical contracts retain their original upgrade roles and claim behavior. Their controls are separate from topup payments.