+ Verify
Don't trust us.
Check.
Every claim on this site about what Signetpay can and cannot do is either readable on chain or observable in your own browser. Here is where to look, and here is the part nobody can check from the outside.
The addresses01
What the router cannot do02
No owner
There is no admin address and no access-controlled function. Nothing in the contract asks who is calling it.
No pause
There is no switch that stops payments. Once it is on chain it answers every caller, including after we are gone.
No upgrade
It is not a proxy and there is no implementation slot to repoint. The bytecode at that address is the bytecode forever.
No fee
It takes nothing from a payment. The amount that goes in is the amount that comes out, minus the chain's own gas.
Check it yourself03
Rebuild the bytecode
Compile the router from source with solc 0.8.28, optimizer on at 4000 runs, evmVersion cancun, and compare the result with what the explorer shows at that address. Everything matches except the trailing metadata, which encodes a hash of the source files rather than executable code.
Watch your keys not leave
Open your browser's network panel before you unlock. The only thing posted is your meta-address: two public keys, both starting 02 or 03, which is what other people need in order to pay you. Your spending and viewing keys appear in no request, because there is no endpoint that accepts them.
Read the announcement feed
Every stealth payment writes a public announcement, and the feed is open at /api/v1/announcements. That is the point: it is readable by anyone and means nothing to them. Matching an announcement to a recipient needs a viewing key, and that happens in the recipient's browser.
What you cannot verify04
The source is not published yet
The explorer shows the router's bytecode but not its source, so the rebuild above is something you do locally rather than something the explorer confirms for you. Publishing the source there is the next thing on this list.
No third-party audit
Nobody independent has reviewed this. The contract is small and unprivileged by design, which lowers the stakes, and it does not replace an audit.
We can see your IP
Chain reads go through a proxy on this server, like any website. It keeps no log of them, and a promise not to log is not something you can check from outside. Point the app at your own RPC if that matters to you.
Your handle is public
A handle resolves to the wallet behind it, because that is how anyone pays you. The payments are private; the identity is not. If you need to be unlinkable from your wallet, a handle is the wrong tool.
This site serves the code
Perfect contracts do not help if the page shipping the JavaScript turns hostile. That is true of every web app. What limits it here: the contract is immutable, so nothing we could ship would let us take or freeze what is already yours.