NulvoPaymentBook · not deployed yet
No balance. No admin.
No custody: the book forwards each payment to the recipient in the same transaction and never keeps a balance. No owner, admin, fee, pause or upgrade.
The book is new code. It has its own tests and a written self-review, and has not had an independent security review yet. Use small amounts.
Status
Where it lives
- Network
- Elysium (99901), gas in HYPE
- Address
- Not deployed yet. The first deployment is meant for small test payments.
- Constructor
- No arguments. The deployer gets no role.
- Machine-readable
- /contracts.json (address, ABI, receipt formula)
- Requests opened
- —
- Requests paid
- —
- Cancelled
- —
- Links paid
- —
- Links revoked
- —
Read live from Elysium. Counters show activity anyone can create; they are not a measure of trust.
Functions
What it does
| Function | Who | Effect |
|---|---|---|
| open(recipient, token, amount, expiresAt, commitment) | Recipient or its operator | Opens a request. Its terms are public from now. Expiry at most 366 days. |
| pay(id) | Anyone but the recipient | Pays an open request in full. HYPE: exact value. USDC: transferFrom payer → recipient. Fee-taking tokens are refused. |
| payLink(recipient, token, amount, expiresAt, commitment) | Anyone but the recipient | Pays a link that was never opened. Its id is the hash of every term, so it is paid once and only on those terms. |
| cancel(id) | Recipient or its operator | Closes an open or expired request. |
| revokeLink(recipient, token, amount, expiresAt, commitment) | Recipient or its operator | Withdraws an unpaid link; publishes its terms, not its memo. |
| setOperator(operator, allowed) | Any address, for itself | Names who may open and cancel requests that pay you. Payments still go to you. |
| verifyRequest / verifyLink(key, salt, detailsHash) | Anyone (view) | True when that payment happened and its memo matches the commitment. |
Rules
What it never does
- No owner, admin, fee, pause, upgrade or withdraw function.
- Never keeps a balance: native HYPE is forwarded with call in the same transaction; ERC-20 goes from payer to recipient with transferFrom.
- Plain transfers to the book revert.
- Re-entry is blocked; state changes before any transfer.
- Tokens that return false, take a fee, or report a balance that does not move are refused; tokens with no return value work.
- Expiry uses block time, not block numbers (Elysium is an Arbitrum Orbit chain, where block.number is the parent chain's number).
Receipts
The commitment
detailsHash = keccak256(utf8('{"memo":"…","ref":"…"}'))
commitment = keccak256(abi.encode(keccak256("nulvo.receipt.v1"), salt, detailsHash))
linkId = keccak256(abi.encode(chainId, book, recipient, token, amount, expiresAt, commitment))The salt is 32 random bytes made in your browser, one per link. A test vector shared by the site tests and the contract tests keeps both sides computing the same values.
Check a deployment
Trust the code, not the page
The repository has a script that compares a deployed address with this build byte for byte: runtime code, creation input, chain id and the receipt formula.
npm run verify-deployment -- --book <address> --book-tx <creation tx>
Tests: Foundry unit, fuzz and invariant tests (the book never holds HYPE or tokens), plus hostile tokens. See the risk FAQ. Nulvo is open source under MIT.