Obolus is a hackathon/testnet prototype. It moves real Arc Testnet USDC, but it is not production custody software and must not be used with mainnet private keys.

Related docs: README, Architecture, Adversarial Testing, Notice, License.

Report issues that can cause:

• unauthorized signing or spending from a configured buyer or creator wallet;
• bypass of x402 payment requirements;
• double payment despite idempotency keys;
• incorrect recipient or amount in toll or royalty settlement;
• quote attribution that passes without a literal source substring;
• public exposure of private keys or service-role credentials;
• misleading verification UI that claims on-chain proof where only a Gateway balance exists.

• .env.local must never be committed.
• BUYER_PRIVATE_KEY, SELLER_PRIVATE_KEY, generated source wallet keys, and Supabase service-role keys are server-side only.
• Browser test wallets are disposable Arc Testnet wallets. They are for demos only and must never hold mainnet funds.
• Sponsored research mode spends from the server-side buyer Gateway wallet, protected by rate limits and caps.
• Creator withdrawals are currently signed by the server-side SELLER_PRIVATE_KEY, not self-custodially by each creator. This is a testnet convenience; production would move withdrawal signing to the creator's own browser wallet so no seller key is server-held.

• All USDC math is integer atomic units.
• Per-payment guards run before signing an x402 authorization.
• Per-run access and royalty caps are enforced in code, not only in prompts.
• Payments are keyed by (query_id, source_id, kind) so retries do not double-pay.
• Royalty amounts are derived server-side from persisted contribution weights. The buyer does not pass the amount to trust.
• A source with zero verified grounding receives no royalty.

Source text can contain prompt injection. The application treats source content as data:

• source text is delimited in prompts;
• the model cannot set weights or amounts;
• code computes contribution weights from verified claim-to-source edges;
• every supporting quote must be a literal substring of the stored source text.

Nanopayments are batched by Circle Gateway. Individual tolls and royalties do not each have their own Arc transaction hash. The UI must not link a creator EOA address as if it proves an individual nanopayment.

The truthful proof stack is:

• the Circle settlement/payment identifier for each nanopayment;
• live Circle Gateway balance for the creator wallet;
• an Arc Testnet withdrawal transaction when creator Gateway funds are withdrawn on-chain.

Do not file public GitHub issues for security vulnerabilities.

For upstream Circle SDK or Gateway vulnerabilities, use Circle's private bug bounty process: https://hackerone.com/circle-bbp.

For Obolus application issues in this fork, report privately to the repository owner or hackathon maintainer with:

• affected route or script;
• exact reproduction steps;
• expected and observed behavior;
• whether testnet USDC moved;
• relevant query_id, source_id, settlement id, or withdrawal transaction hash.

Public repository: https://github.com/winsznx/obolus

Public project handle: https://x.com/obolusxyz