Security Posture

What protects a payment request at each layer, and which controls are available in production. The code describes more routes than are currently enabled for live settlement; the status of each rail must be checked separately.

Client-signed payment flows

In routes that return wallet-signable transaction data, the connected wallet reviews, signs and submits the transaction. Those specific flows do not use FurlPay custody. This statement does not describe every wallet action; see the signing disclosure for the web signing model. EIP-3009 transferWithAuthorization binds the payer, recipient and amount to the signed authorization. The production relayer-dependent x402 and gasless transfer rails are not currently enabled. CCTP bundles and LI.FI routes are prepared by the service but signed and submitted by the client when that route is available.

• LIVE EIP-712 signature recovery (ECDSA + ERC-1271 smart wallets), fail-closed.
• LIVE Atomic cross-instance replay protection (Redis SET NX on every EIP-3009 nonce).
• LIVE Amount-scaled confirmation depth before any resource is released.
• LIVE Fabricated-settlement guard: production refuses to run money paths in mock mode.

Authentication

• WebAuthn / FIDO2 passkeys — phishing-resistant, hardware-backed where the device provides it. The Relying Party ID comes from server configuration, never the Host header.
• Step-up TOTP for privileged operations; MFA state writable only through the dedicated MFA route (mass-assignment is rejected schema-level).
• Sessions are short-lived signed JWTs in HttpOnly cookies; roles resolve from the user record on every request, and admin is pinned to a single founder account in production.

Money controls

• Hard per-transaction caps on every execution rail (swaps, CCTP, gasless transfers), enforced server-side.
• An ops control plane that can pause any rail — the pause is enforced at the route, not decorative.
• An append-only event ledger (Postgres triggers block update/delete) recording every settlement and every rejected attack: replays, bad signatures, tampered quotes, over-limit attempts.
• Agent spending is governed by user-signed mandates — an agent cannot widen its own permissions.

Continuous security pipeline

Every pull request runs:

• Slither + Semgrep over the Solidity contracts.
• CodeQL over the application code.
• gitleaks secret scanning.
• Dependabot with a reasoned allowlist — npm audit fix --force is banned by policy.

External audits

Responsible disclosure

Found something? We run a coordinated disclosure program with safe harbor — see the responsible disclosure policy or email security@furlpay.com.

Verify it yourself

The application is open-source at github.com/FurlPay — every claim above can be checked against the code.