Risk disclosure

Using blockchain payments carries risks that do not exist with a bank or card processor. Read this before relying on Plinth for anything. Nothing on this site is investment, legal, tax or financial advice.

1. Plinth is testnet-only

Plinth currently runs on test networks. Test tokens have no value and nothing should be treated as production money. Mainnet support is configured but disabled, and nothing has been deployed to any mainnet from the project's tooling. No live acceptance run on a public testnet had been recorded when this was written.

2. The smart contracts are not audited

The contracts have been tested with unit, fuzz and invariant tests, and against real USDC bytecode on forks. That is not an independent security audit. Undiscovered bugs could lose funds. The contracts are deliberately not upgradeable, so a bug cannot be patched in place; funds would have to be moved to new contracts, and some losses may be permanent. Do not hold meaningful value until an independent audit is finished.

3. Blockchain finality and reorganisations

A transaction included in a block is not always final. Some networks can reorganise recent blocks, which can reverse a payment you thought had arrived. Plinth waits for a per-network finality rule (for example a number of confirmations or the chain's finalized block) before treating funds as final, and it reverses its records if a block is reorganised before finality. These rules are judgement calls and may be wrong for a given network. A webhook of payment.confirmed means the rule was met, not that reversal is impossible.

4. Stablecoin issuer risk

• Blocklisting and pausing. The issuer of USDC or EURC can block specific addresses and pause transfers. A blocked vault, payout wallet or invoice address cannot receive or sweep funds, and Plinth cannot change that.
• Value and redemption. USDC and EURC are claims on a third party. It can lose its peg, and redemption depends on the issuer and on the law where you are.
• Wrong token. Only the official contract of the token a payment was created in counts as a payment on each network. Other tokens sent to a deposit address are not swept and may be recoverable only by the vault owner using a rescue function.

5. Wallet and key security

• The vault owner key is the only key that can move your funds. If it is lost, nobody can recover your funds. If it is stolen, the thief can withdraw them.
• A multisig owner reduces both risks. The vault's delay applies only to forwarding rules: the owner key can always withdraw at once, so the delay is not a defence against a stolen owner key.
• Customers can lose funds by sending to the wrong network, the wrong address or a lookalike site. Funds sent to an address on a chain where it does not exist can be unrecoverable.
• Signing a message you do not understand can authorise a payment. Read what your wallet displays before you sign.
• Smart-contract wallets are not supported on the gasless path.
• Payout wallet (direct payouts). A payout wallet is controlled directly by its key. Anyone who controls it, or who tricks the account into confirming a change, can take what arrives there. Changes need a signature from the new wallet and a fresh sign-in (and, where enabled, a confirmation link sent to your email), and they wait out a cooldown, but treat the wallet as a hot destination.
• Compromised Plinth backend. An attacker who controls the backend cannot move funds already sitting in your vault or redirect funds sent to a payment address that has already been issued. They could, however, give customers new checkout addresses that pay the attacker, and a customer cannot check an address by looking at it. Verify what you fulfil against your own records and signed webhooks, and keep the unaudited status of this software in mind.

6. Operational and infrastructure risk

• The gateway relies on RPC providers whose answers it trusts. A faulty provider could delay or mislead detection.
• A single relayer signer per network limits throughput, and its gas budget and safeguards can pause settlement. Paused settlement leaves funds at the invoice address, where they remain sweepable later.
• Native-currency transfers sent directly to a deposit address on Arc are not detected from events and show up only through reconciliation.
• There is no service-level agreement, and the status page does not yet publish an incident history.

7. Legal and regulatory risk

The rules for accepting digital assets differ by country and change. Plinth holds no licence, registration or certification, and it does not verify customers' identities or screen for sanctions. You are responsible for whether your use of the service is lawful, and for your taxes and records. [Operator to add jurisdiction-specific disclosures.]

8. No guarantees

Everything here describes risks known at the date above. Other risks exist. If you do not understand these risks, do not use the service for real value.