Last updated: August 2026. This page covers the smart-contract and security posture of the minia2a platform — what is audited, what is pending, and how users can independently verify transactions.
minia2a itself is a routing and discovery layer. User funds never sit in a minia2a-controlled escrow. Payment settlement happens through the x402 protocol's facilitator contracts, which are built and maintained by the Coinbase/x402 ecosystem. The platform's server-side logic handles payment verification, credit accounting, and service call forwarding — but settlement happens on-chain.
| Component | Status | Details |
|---|---|---|
| x402 Facilitator (PayAI) | Audited | PayAI's Base facilitator has undergone third-party review. Facilitator verify/settle operations are callable from minia2a but funds never pass through the platform server. |
| x402 Facilitator (Cloudflare Wallets) | Production | Cloudflare's agent-wallet infrastructure went live Aug 2026. Built-in spending allowances and per-transaction caps. |
| x402 Facilitator (Celo) | Community-audited | Celo's open-source x402 facilitator has community review. No formal third-party audit published. |
| minia2a Receipt System | Verifiable | HMAC-SHA256 receipts are independently verifiable — anyone with the receipt ID can call /api/receipts/:id and check the signature. No need to trust us; verify cryptographically. |
| minia2a Payment Gateway (V5 Go) | Production — no third-party audit | This is the production gateway: it serves every paid call on minia2a.uk today (it reports its own version as 5.0.0-alpha at /api/stats). It handles x402 challenge construction, payment verification, replay protection, rate limiting, and per-call settlement. The 5.0.0-alpha label is accurate about maturity: it has had internal review only, and no third-party security audit. Treat that as a statement about our assurance level, not a claim that the gateway is unavailable — an earlier revision of this row described V5 as pre-production, which was wrong. |
| minia2a Compat Layer (Node.js) | Internal review | The SSRF-guard, payment verification (proxy.js), and service-handler sandboxing have undergone internal review. A formal audit is pending. |
1. Receipt signatures. Fetch any receipt at /api/receipts/:id. The HMAC is computed over the receipt's canonical fields — you can recompute it locally if you have the secret (or just trust the server-side verified flag which does the same check).
2. On-chain settlement. Every x402 payment produces a transaction hash visible on BaseScan. The platform does not hide or delay settlement — either the facilitator verified your payment (within seconds) or you can look up the on-chain tx yourself.
3. Live platform metrics. /api/stats shows services, trials, wallets, and credit totals served directly from the production database. Not hand-written numbers.
minia2a builds on open x402 infrastructure developed by Coinbase, the Linux Foundation x402 Working Group, and the PayAI, Cloudflare, Celo, and Polygon facilitator networks. We thank the EPFL/浙大 security researchers whose USENIX Security 2026 paper on x402 facilitator vulnerabilities (arXiv 2607.19545) informed our payment-verification hardening. See the x402 security audit blog post for the detailed analysis.
If you discover a security issue in the platform, payment flow, or receipt system, contact [email protected] with details. We take payment-integrity bugs seriously and will acknowledge within 48 hours.
Related: Risk Disclosure · TaskMarket Security Review · Token Security · Fees.