Contract, network, and integration guide.

Overview

SplitPay coordinates shared ERC-20 payments through a non-upgradeable escrow contract deployed on Robinhood Chain. A bill creator fixes the token, participants, shares, deadline, name, and description in one transaction.

The frontend reads state directly from Robinhood Chain and asks the connected wallet to sign each state-changing transaction. No private key, recovery phrase, or wallet password is collected by the website.

Robinhood Chain mainnet

The public Robinhood Chain RPC is rate-limited. Configure a dedicated Alchemy, QuickNode, or comparable endpoint before a high-traffic launch.

Supported tokens

SplitPay is exclusive to ERC-20 tokens deployed on Robinhood Chain. The website reads Robinhood's official Stock Token asset API and includes canonical WETH and USDG. The contract makes the final decision through its owner-managed token allowlist.

A token appearing in Robinhood's registry does not automatically make it safe for SplitPay. The operator should review transfer behavior, decimals, restrictions, and legal availability before allowlisting it.

$SPAY project token

$SPAY is the native token of the SplitPay project and is presented exclusively as a Robinhood Chain token. It is separate from ETH, which remains Robinhood Chain’s native gas asset.

The $SPAY contract address is maintained in config.json. The public Buy button is generated from that address using the configured Pons Family launchpad URL template.

Escrow contract

The fixed fee recipient is embedded as an immutable constructor value. The owner can pause new bills and payments, manage the token allowlist, and transfer ownership through a two-step process. The owner cannot withdraw participant escrow.

Bill lifecycle

1. Create: the creator publishes immutable bill data and participant shares.
2. Pay: an assigned wallet transfers its share plus the 1% fee into escrow.
3. Withdraw: after every participant pays or the deadline passes, the creator withdraws collected principal and fees route to the fixed address.
4. Cancel: before withdrawal, the creator can cancel the bill.
5. Refund: after cancellation, each paid participant claims principal and fee from escrow.

New payments stop after the deadline. A partially funded bill can be withdrawn by the creator after the deadline.

Security model

• Checks, state effects, and token interactions are ordered to reduce reentrancy risk.
• A reentrancy guard protects pay, withdraw, refund, and excess-token rescue paths.
• Balance-delta validation rejects tokens that transfer less than the requested amount.
• Escrow obligations are tracked per token, preventing owner rescue of participant funds.
• Pause mode blocks new creation and payment but leaves exit functions available.
• Shares and deadlines have no edit functions.
• Frontend token approvals use the exact payment total, not unlimited allowances.

Production deployment

1. Compile contracts/SplitPayEscrow.sol with a pinned Solidity compiler.
2. Run unit, invariant, and Robinhood Chain fork tests.
3. Deploy to testnet and exercise every lifecycle path.
4. Complete an independent security audit.
5. Deploy to mainnet with the fixed fee recipient and reviewed token list.
6. Verify source on Blockscout.
7. Transfer ownership to a multisig.
8. Set the $SPAY address in config.json, then configure the escrow contract address, deployment block, production RPC, operator details, and site URL through the documented Vercel environment variables.
9. Run npm run check before deploying to Vercel.