The treasury behind Sheliak’s scan-to-pay.
Sulafat receives stablecoin payments for merchants, holds them safely and pays them out. It is built to be boring with money: keys never leave a dedicated signer, nothing moves without a policy decision, and anything it cannot account for stops it taking new payments.
From a scan at the counter to a merchant’s settled balance.
An address for every order
Each order gets its own deposit address on the chain the payer chose, so every payment matches its order without memos or guesswork.
Counted only when final
Chains are read through independent providers that must agree, and a payment counts only once the network has made it final.
Checked before it’s theirs
Each deposit’s payer and sender are checked against the US sanctions list before the money is treated as the merchant’s.
Gathered into its own wallets
Received funds move from deposit addresses into the treasury’s wallets. The treasury pays the network fees, so payers send only the stablecoin.
Settlements and refunds
Merchants are settled and payers refunded under a signed policy and, where the policy says so, two people’s approval.
Books that check themselves
A double-entry ledger and a tamper-evident audit chain, reconciled against the chains around the clock.
In through one address, out only to the merchant or back to the payer.
Larger sums sit in the warm and cold tiers, where moving them needs more approvers. Most of the money sits where moving it is slowest.
Refunds go back to the original payer only.
Every movement is checked against the signed policy before the signer will touch it.
Eight steps, and the money is only the merchant’s once it is final and screened.
Order
A cashier, web or Android, or the merchant’s own backend creates an order at the merchant gateway: an asset, an amount, an expiry.
Deposit address
The treasury leases one of its addresses to that order alone. A released address waits at least an hour before anyone else gets it.
Payment
The payer scans the code and pays from Sheliak or any wallet. The cashier shows the payment as soon as it is seen.
Seen, then confirmed
Seen at the chain’s tip, then held until the network’s confirmations. Two independent providers must agree on every credit.
Ethereum 64 blocksBase 60BNB Chain 60TRON 19Solana finalizedBooked
The credit is posted to the ledger and attributed to its order. A payment after expiry is marked late; the wrong asset is marked unexpected.
Screened
Payer and sender are checked against the sanctions list. A match is held as high risk; anything else waits for a person to clear it.
Swept
A cleared deposit moves to the hot wallet: in one batch through the EIP-7702 sweeper contract where one is registered, otherwise one address at a time.
Settled or refunded
The merchant asks for a settlement in their portal; it is approved and paid under the policy. A refund goes back only to the original payer.
For a day after confirmation every transaction is checked again. If a chain reorganisation takes it away, the credit is reversed; if it merely moves to another block, it is recognised as the same credit and never booked twice.
No single person, process or mistake can move money on its own.
Every transfer needs a policy decision the signer can check, and anything unexplained stops the treasury taking payments.
- Key ceremony
- The mainnet seed is made once, by the owner, on the server. An encrypted escrow copy goes offline under a key only the owner holds.
- No developer or chat ever sees a mainnet key.
- Signer
- A separate service holds the keys and signs only a transaction that exactly matches a signed authorization: sender, recipient, asset, amount and network.
- A bug or a compromise elsewhere cannot make it sign something else.
- Policy
- Signed, versioned rules: our wallets, counterparties, limits per transfer and per day, approvers per kind of movement, delays for the cold tier.
- Changing the rules itself takes two administrators.
- Wallet tiers
- Deposit addresses, then hot, warm and cold, each with stricter approvals, plus a gas wallet that pays fees.
- Most of the money sits where moving it is slowest.
- Approvals and freeze
- Payouts wait for their approvers. Any operator can freeze a network, or everything; unfreezing takes two people.
- One person can stop money; nobody can release it alone.
- Screening
- Payer and sender checked against the OFAC sanctions list, refreshed daily; every other deposit held for a person’s review.
- High-risk money is never swept, settled or refunded.
- Two providers
- On mainnet each chain is read through two independent RPC providers that must agree.
- One provider’s error or lie cannot invent a deposit.
- Reconciliation
- The ledger is compared with what is on chain; a shortfall seen twice in a row stops new payments.
- Money that left unbooked is caught within minutes.
- Audit chain
- Every sign-in, approval, payout and decision is appended to a hash-chained log, verified every five minutes against an external checkpoint.
- Edits or deletions in the database are detected.
- Hidden treasury
- The treasury servers have no public ports. They talk over private XMTP chat, outbound only, and staff come in over SSH.
- Nothing on the internet can reach the treasury directly.
A treasury that keeps the keys, and a gateway that is the only public door.
The two talk only through private, end-to-end encrypted XMTP chat between their sidecars. Mainnet and testnet each run their own pair.
Treasury
No public portssigner· holds the keys; signs only authorized transactionsapi· addresses, watchers, screening, sweeps, ledger, reconciliationconsole· for staff, through an SSH tunnelxmtp· the private API, outbound onlynotify· the alert and business chats
Reads the blockchains through two providers that must agree.
Merchant gateway
The only public doorhttps· the public frontmerchant· merchant API, cashier API, merchant portal, operator pagexmtp· its link to the treasury
Serves the web cashier, the Android app and merchants’ own backends over HTTPS.
One stablecoin on each of five chains.
| Chain | Mainnet | Testnet | Final after |
|---|---|---|---|
| Ethereum | USDC | Sepolia, USDC | 64 blocks |
| Base | USDC | Base Sepolia, USDC | 60 blocks |
| BNB Chain | USDT | BSC testnet, USDT | 60 blocks |
| TRON | USDT (TRC-20) | Nile, USDT | 19 blocks |
| Solana | USDC (SPL) | Devnet, USDC | finalized |
Two installations that never mix
Each server records at install whether it is mainnet or testnet, and refuses to be reinstalled as the other. A mainnet signer refuses testnet keys and networks, and the reverse.
Matched to the right Sheliak
Mainnet talks to Sheliak’s production chat network and the mainnet app; testnet to the development network and the testnet app.
A console, and two chats in the Sheliak wallet.
Most days there is nothing to do but clear deposits and approve payouts.
The console
- Home
- Taking payments or not, and every health check
- Deposits and screening
- Clearing or flagging what waits for review
- Approvals and payouts
- Settlements and refunds waiting for approvers
- Policy
- Proposing and approving a new version of the rules
- Reconciliation
- The ledger against the chains
- Wallets
- Balances per tier and network, gas, TRON energy
- Freeze
- Stopping a network, or everything, at once
- Audit
- The audit chain, verified on demand
Alerts arrive when a service is down, a health check fails, reconciliation breaks, gas runs low or a server is short of memory or disk: once when it has lasted, again when it clears. Business messages report payments, reviews, settlements and approvals, and a summary after midnight UTC.
Mainnet today so far, 2026-11-05 (UTC, until 14:20)
| Count | Amount | |
|---|---|---|
| Payments | 12 | 1,840 USDC (Base) |
| Settlements paid | 1 | 1,200 USDC (Base) |
| Sweeps | 2 | Base 2 |
Waiting now
- 1 deposit for screening review
- 0 approvals
Example message; the numbers are made up.
Live on mainnet, with a full testnet beside it.
Mainnet since 2026
Treasury and merchant gateway, under policy version 1, with interim sanctions screening and two providers per chain. Web cashiers and the Android cashier app for both mainnet and testnet.
Review findings closed
An external static review of the code on 2026-11-03 and three follow-up rounds. Every finding is fixed, tested and deployed; the latest round found nothing new.
Sign in with Sheliak
Staff and merchants binding their Sheliak wallet to their account and confirming sign-ins in the wallet. A KYT provider will replace the interim manual screening.