Security

The money, the ledger and the exit are on a public chain you can read without us.

Where your money is

When you pay over x402, your collateral sits in the x402 batch-settlement escrow at 0x4020074e9dF2ce1deE5A9C1b5c3f541D02a10003. It is not our contract: it is hardcoded in @x402/evm. No owner, no pause, no upgrade, no sweep. Deposits enter through its collectors, 0x4020806089470a89826cB9fB1f4059150b550004 (EIP-3009) and 0x4020425FAf3B746C082C2f942b4E5159887B0005 (Permit2). Read any of it free, no wallet, at /verify.

When you pay by an MPP session, your deposit sits in the session escrow at 0x5e09aD70b644414cD1cD7Df1d9a10fF7899D92B8, a separate contract from the x402 escrow, and it pays the split through the payee 0x715721CB50E9e70b8044A45B0385e4eB7812a6c4. The session escrow was deployed by ZEAM, has no owner or administrator, and is not audited: nobody outside its authors has reviewed it.

Who holds which key

The receiver 0x22e35149493B9BB147F8225AF27Bcf499407Aa7b is a split with no owner that pays 0xc60996007B7657DE2F39fA0577E97d7aAF3b7d1e 100%. The settle key 0x7116bf728132088d7819A93A980d002d8550bFc6 signs claims and refunds and holds none of your money, only a little ETH for gas; it is the receiverAuthorizer in every quote. The ZEAM relay sends those transactions and pays their gas. Our relay pays the gas of a refund when our fee on what the buyer spent covers the gas of the deposit, of the refund and of settling any calls not yet settled, and of every further deposit and every earlier refund it paid for on that channel, with a 15% margin; otherwise the buyer pays the refund's gas, with a 15% margin, in USDC, quoted before the buyer signs that payment. Here ZEAM is the seller, so our fee is all of what the buyer spent, and every 402 states the gas it has to cover. With ZEAM :: Pass on your own wallet, or your own code, your key signs each voucher on your machine. With a pass, the pass service signs with the pass's key, which can only pay this seller or return the balance to the wallet that funded it. A voucher is a signed ceiling; we cannot claim above it.

What we can charge

A claim takes what you were charged: the price of each paid call, the time buy_time bought, and never time you did not burn, which comes back on refund. /healthz/books reconciles the receiver against the escrow's Settled events. /healthz/settlement reports what is unclaimed and the last claim and payout.

Leaving without us

For an x402 deposit, POST /refund and the unspent balance, unburned time included, goes back to the payer. Or take it yourself: initiateWithdraw, then finalizeWithdraw after 86400 seconds, your gas, in ETH on Base, and it works if we refuse. Stop signing and we cannot charge you again.

The unspent part of a session's deposit comes back when you close the session, in the same transaction. The ZEAM relay sends the close, or your signed exit, and you need no ETH. It pays the gas of a close when what the session spent covers the gas of opening it, of any top-up or close request the relay sent and of the close, plus 15%, and of an exit when what the session has settled covers the gas of opening it, of any top-up or close request the relay sent and of the exit, plus 15%; otherwise an MPP session pays that gas in USDC out of what returns, as an x402 refund does. You can also leave without us: requestClose on the session escrow, then withdraw after its grace period, the only way out of a session that needs ETH on Base for gas.

What we keep

No accounts, no API keys, no names. The network address we see counts free calls for an hour. A channel's time lives while the channel does; its record is kept for as long as settlement needs it, with no automatic deletion date. The privacy notice is the whole list.

Proving it is us

x402-trust.txt carries the key this endpoint answers x402 Trust with. security.txt is where to report a problem; a person reads it. Issues with the x402 escrow contract go upstream to x402; issues with the session escrow contract, which we deployed, come to us through security.txt.

Who we are

ZEAM Labs, LLC, Delaware file number 10206382; the filed documents are at https://github.com/zeam-labs/ZEAM-Labs-Corporate-Docs. Contact: info@zeamlabs.com.

For agents · Terms · Patent pending · services.json · Status