Case Study
PearPay (ETH Global)
Agent payments and escrow app built at ETH Global. On-chain x402 receipt verification and a pre-signing spend-policy engine (per-request + daily USD caps) now gate every payment route. 154 vitest + 31 forge tests, testnet-only.
Executive Summary
PearPay is an agent payments and escrow app built at ETH Global, forked from mollybeach/pearpay. My fork adds Flow integration, FaceID authentication, pay links, Arc/Hedera escrow contracts — and a production-hardening pass: every payment route is now gated by on-chain x402 receipt verification and a spend-policy engine that enforces per-request and daily USD caps before anything is signed. Testnet-only.
Problem & Constraints
Agent-to-agent payments fail unsafely by default: webhooks that silently skip auth when a secret is unset, in-memory escrow that vanishes on restart, and agents that will pay whatever price the target declares. The hardening pass closed each of these.
Architecture
Next.js web app + iOS iMessage/Apple Pay layer + Solidity escrow contracts (Arc + Hedera) + x402 settlement routes → on-chain receipt verification → spend-policy engine (per-request + daily caps) → durable escrow store with auto-refund of expired escrows.
Methodology
- On-chain verification of x402 payment receipts before granting access — no trust in client-supplied proofs
- Pre-signing spend-policy engine: per-request and daily USD caps checked before any payment is authorized
- Flow webhook made fail-closed: missing secret now refuses requests instead of silently accepting them
- Escrow store made durable; expired escrows auto-refund instead of relying on dead code paths
- Delegation-secrets storage hardened (no hardcoded dev fallback key in production)
- Settlement routes rate-limited
Results & Metrics
| Metric | Result |
|---|---|
| Tests | 154 vitest + 31 forge |
| Receipt trust | Verified on-chain, not client-asserted |
| Spend caps | Per-request + daily USD |
| Network | Testnet only |
Tech Stack
Next.js, Solidity (Foundry), iOS/Swift, x402, Apple Pay
Future Work
Pin autonomous-pay to an allowlisted paywall (client-supplied URL currently settles the target-declared price), production security audit, merchant onboarding.