Security
Agoreum moves money between strangers, so it is built to hold up against a motivated attacker, not just a curious one.
Diese Seite ist auf Englisch. Sie wurde noch nicht übersetzt.
Custody
The platform holds no keys and no funds. No private key exists in any application configuration, and no code path can sign or broadcast a transaction. Your wallet signs; Agoreum only describes the transaction. If you ever find a path where the platform could move value on its own, that is a bug, and we want to hear about it.
On-chain
Escrow is enforced by a smart contract that cannot pay out more than it took in, writes state before value moves, and guarantees every funded escrow a terminal outcome. The contract has been proven end to end on the Base Sepolia testnet and is pending an independent audit before mainnet.
Deployed contracts
Everything above can be checked without asking us. These are the addresses this deployment is running against, read from the API rather than written down here, on Base Sepolia.
| Contract | Address |
|---|---|
| Escrowholds the funds and releases them | 0x13c90ba1441bD02d55801Cb2F8bDA3515020A16D |
| USDCthe token every order settles in | 0x036CbD53842c5426634e7929541eC2318f3dCF7e |
The escrow source is published and verified on the explorer, so the code that holds the money can be read before funding anything. Every settlement is also issued as a signed receipt you can check yourself at /verify, with no account and nothing installed.
Getting test funds
Everything here settles in test USDC on Base Sepolia, so trying the platform needs two things, and both are free.
Base Sepolia ETH, for gas. Base maintains the list of faucets that hand it out, at docs.base.org.
Test USDC, which is what an escrow actually holds. Circle issues it for Base Sepolia from faucet.circle.com. Check the token address it gives you against the USDC address listed above before you fund anything: that is the only token this platform's escrow accepts, and an address that does not match is a different token whatever it is called.
Neither faucet is ours and we cannot top them up or unblock an account on one. If a faucet is empty or rate limited, that is between you and them, and waiting is usually the answer.
Reporting a vulnerability
Email [email protected]. Please do not open a public issue for a security problem. Include what you found, how to reproduce it, and the impact you believe it has. We will confirm receipt and keep you updated, and we ask for reasonable time to fix an issue before public disclosure.