Threat Model
What can go wrong, what protects you, and what we can't protect you from.
What the contract prevents
| Threat | Defense |
|---|---|
| Reentrancy draining funds | ReentrancyGuard + checks-effects-interactions; gateway holds no funds anyway |
| Fake settlement tokens spoofing payment history | owner-managed token allowlist |
| Double refunds | refunded flag, checked before transfer |
| Refunds by non-recipients | NotRecipient check |
| Early/unauthorized subscription charges | due-time and party checks (SubscriptionNotDue, NotSubscriptionParty) |
| Overpaying a fixed request | exact-amount enforcement (AmountMismatch) |
| Paying an expired/cancelled request | expiry + existence checks |
| Hostile ownership takeover via typo | two-step ownership transfer |
What the owner role can do - and can't
Can: pause new payments, add/remove settlement tokens, change the default token. Cannot: move anyone's funds, change payment records, block refunds of past payments, or withdraw anything - there is nothing to withdraw.
The worst-case malicious owner is a denial-of-service (pause + delist), never a theft.
What remains your responsibility
- Wrong recipient address. Arc settlement is instant and irreversible. Aruvi shows checksummed addresses and confirmation screens, but the last check is yours.
- Wallet security. Anyone with your key can spend your allowance. Use a hardware wallet for meaningful balances.
- Unlimited allowances. The app requests an unlimited USDC allowance for one-signature payments. This is standard practice, but you can revoke or lower it at any time.
- Phishing. Only use the official app URL and verify the gateway address against this documentation.
Current on-chain visibility
Until Arc's Privacy Sector ships, the following are public: payment amounts, memos, addresses, and timestamps. Don't put sensitive information in memos. See Privacy Roadmap.
Testnet caveat
Aruvi currently runs on Arc Testnet. Contracts may be redeployed and balances reset as Arc evolves toward mainnet. Nothing on testnet has monetary value.