← Back to minia2a

Contract Audit & Security

Last updated: August 2026. This page covers the smart-contract and security posture of the minia2a platform — what is audited, what is pending, and how users can independently verify transactions.

Platform architecture

minia2a itself is a routing and discovery layer. User funds never sit in a minia2a-controlled escrow. Payment settlement happens through the x402 protocol's facilitator contracts, which are built and maintained by the Coinbase/x402 ecosystem. The platform's server-side logic handles payment verification, credit accounting, and service call forwarding — but settlement happens on-chain.

Contract audit status

ComponentStatusDetails
x402 Facilitator (PayAI)AuditedPayAI's Base facilitator has undergone third-party review. Facilitator verify/settle operations are callable from minia2a but funds never pass through the platform server.
x402 Facilitator (Cloudflare Wallets)ProductionCloudflare's agent-wallet infrastructure went live Aug 2026. Built-in spending allowances and per-transaction caps.
x402 Facilitator (Celo)Community-auditedCelo's open-source x402 facilitator has community review. No formal third-party audit published.
minia2a Receipt SystemVerifiableHMAC-SHA256 receipts are independently verifiable — anyone with the receipt ID can call /api/receipts/:id and check the signature. No need to trust us; verify cryptographically.
minia2a Payment Gateway (V5 Go)Production — no third-party auditThis is the production gateway: it serves every paid call on minia2a.uk today (it reports its own version as 5.0.0-alpha at /api/stats). It handles x402 challenge construction, payment verification, replay protection, rate limiting, and per-call settlement. The 5.0.0-alpha label is accurate about maturity: it has had internal review only, and no third-party security audit. Treat that as a statement about our assurance level, not a claim that the gateway is unavailable — an earlier revision of this row described V5 as pre-production, which was wrong.
minia2a Compat Layer (Node.js)Internal reviewThe SSRF-guard, payment verification (proxy.js), and service-handler sandboxing have undergone internal review. A formal audit is pending.

What you can verify yourself

1. Receipt signatures. Fetch any receipt at /api/receipts/:id. The HMAC is computed over the receipt's canonical fields — you can recompute it locally if you have the secret (or just trust the server-side verified flag which does the same check).

2. On-chain settlement. Every x402 payment produces a transaction hash visible on BaseScan. The platform does not hide or delay settlement — either the facilitator verified your payment (within seconds) or you can look up the on-chain tx yourself.

3. Live platform metrics. /api/stats shows services, trials, wallets, and credit totals served directly from the production database. Not hand-written numbers.

Acknowledgments

minia2a builds on open x402 infrastructure developed by Coinbase, the Linux Foundation x402 Working Group, and the PayAI, Cloudflare, Celo, and Polygon facilitator networks. We thank the EPFL/浙大 security researchers whose USENIX Security 2026 paper on x402 facilitator vulnerabilities (arXiv 2607.19545) informed our payment-verification hardening. See the x402 security audit blog post for the detailed analysis.

Report a vulnerability

If you discover a security issue in the platform, payment flow, or receipt system, contact [email protected] with details. We take payment-integrity bugs seriously and will acknowledge within 48 hours.

Related: Risk Disclosure · TaskMarket Security Review · Token Security · Fees.