Security | Wafermap

Payments

You sign, a facilitator settles. Every paid call is an x402 payment: you sign a transfer for the exact price, and an x402 facilitator executes it on-chain. Coinbase's facilitator handles Base, Arbitrum, Polygon and Solana. The heyelsa.build facilitator handles Robinhood Chain. Wafermap never sees your key.
Paid only on success. Wafermap settles a payment only after the call worked. If a resource fails, the signed authorization is released and never executed, so there is nothing to refund.
Straight to the recipient. For Wafermap's own resources, the transfer goes to Wafermap's treasury. For marketplace listings, it goes straight to the seller's wallet: Wafermap is not in the middle and takes no fee.
Every payment is public. Each settled payment is listed with its transaction on Proof, and Wafermap's own test wallets are labelled and counted apart.

Keys

Wafermap Wallet (browser). The key is generated in your browser and stored in its local storage. Wafermap's servers never receive it. Payments are signed inside the per-payment and daily caps you set. Keep only a small balance on it.
CLI and MCP server. The key stays on your machine, encrypted with your password (scrypt + AES-256-GCM). The code is open: github.com/wafermap/wafermap-cli.
Sign-in. Signing in to sell is a signed message. It costs nothing and sends no transaction.
Swaps. Swaps are sent from your own wallet, only after you approve the quote, and within a per-swap cap.

Paying in $WAFERMAP

$WAFERMAP has no permit of its own, so these payments use Uniswap's Permit2. You sign a permit for exactly the quoted amount. Only Wafermap's relayer can spend it, and only for two minutes. Only after the call succeeded does the relayer send those tokens straight to the dead address (0x…dEaD). Wafermap never holds them. The relayer is a hot wallet that holds only a little ETH for gas.

Marketplace sellers

Proof of domain. A seller proves they control an API's domain by serving /.well-known/wafermap-seller.json before a listing can go live.
Signed requests. Every call Wafermap forwards carries an HMAC-SHA256 signature over the timestamp and body, so a seller can reject calls that did not come through Wafermap (and its payment). How to verify, or see it in our open demo seller: wafermap-seller-demo.
Signing secrets. Signing secrets are shown once and stored encrypted (AES-GCM). A seller can rotate theirs at any time.
Fetch guards. Calls to sellers go over HTTPS only, follow no redirects, and are capped at 25 seconds and 2 MB.
Answer checks. An answer must be non-empty JSON and pass the seller's declared answer checks before payment settles.

What Wafermap does not claim

Wafermap has not had a third-party security audit. It runs no payment contracts of its own: payments use the stablecoins' own transfer authorizations (EIP-3009) and, for $WAFERMAP, Uniswap's Permit2. Marketplace listings are run by their sellers: answers, uptime and content are theirs.

Report a vulnerability

Found a bug that could move funds, leak data or let someone skip a payment? Email security@wafermap.xyz with the steps to reproduce it. If you don't hear back within 3 days, message @wafermap on X. Please don't test against other people's wallets or listings, and give us reasonable time to fix it before disclosing. Machine-readable: /.well-known/security.txt.

Anything else: hello@wafermap.xyz. Live state of payments and checks: Status. What changed and when: Changelog.