Plug360 is USDC escrow on Arc for small deals between people who know each other, with a mutual friend (the "plug") as referee. Informal deals today run on trust, so one side pays first and hopes; Plug360 locks the buyer's USDC in a contract until the job is done, and the plug can settle a dispute only by refunding the buyer or paying the seller, never by taking the money.
| App | plug360.xyz |
| Mainnet contract | 0xd173909Bc98DAf021669c56e5613Cd531903B0de (verified) |
| Security model | contracts/SECURITY.md |
| Operations | contracts/OPERATIONS.md |
- The seller (or buyer) writes the job, sets a price and names a plug. The terms travel in a single link.
- The seller signs the terms, then the plug accepts. Signing is free and nothing moves yet.
- The buyer pays from the same link. The USDC sits in
DealEscrowwhile the work is done. - The buyer releases the money, or opens a dispute before the money-back window closes. The plug rules within 7 days; if they stay silent, anyone can trigger a full refund.
Platform fee is zero. The plug fee is set per deal, capped at 5% of the price and split evenly between buyer and seller.
Plug360 is built on Circle's stack end to end: the money is USDC, the settlement layer is Arc, and people who have never used crypto get a Circle wallet from a Google sign-in. A buyer in Lagos can pay a seller they know without installing a wallet app, buying a separate gas token, or writing down a seed phrase.
| Circle product | How Plug360 uses it | Status |
|---|---|---|
| Arc | Settlement layer for every deal. Gas is paid in USDC, so a deal needs no second token | Mainnet and testnet |
| USDC (native on Arc) | The only asset the escrow holds. Prices, plug fees, refunds and payouts are all USDC | Mainnet and testnet |
| User-Controlled Wallets | Google sign-in creates a smart contract wallet per person (@circle-fin/w3s-pw-web-sdk in the app, @circle-fin/user-controlled-wallets on the server). Plug360 holds the API key but cannot move funds: every signature and payment is approved by the person with their PIN in Circle's window |
Mainnet and testnet |
| Gas Station | Pays network fees for those smart wallets, including their one-time activation | Mainnet and testnet |
| Faucet | Test USDC for trying Plug360 on Arc testnet | Testnet |
People who bring their own wallet (MetaMask, Rabby and others) are covered by Plug360's own gas sponsor (services/sponsor), which tops up gas only for calls the contract would accept.
| Audit | Not audited. Internal review only: Slither with no medium or high findings, invariant and mutation testing (SECURITY.md) |
| Limits | 100 USDC per deal (lower per plug level), 2,500 USDC owed by the contract in total |
| Mainnet | Live since 15 October 2026. Every money path run once with real USDC; 20 of 20 receipts succeeded and the escrow ended owing nothing |
| Ownership | Single owner key for launch week; moving to a multisig is the next operations task |
| Network | DealEscrow | Deploy block | Source |
|---|---|---|---|
| Arc mainnet (5042) | 0xd173909Bc98DAf021669c56e5613Cd531903B0de |
26,019,786 | Sourcify |
| Arc testnet (5042002) | 0x3df58eFFC292D5043075d71e6705dF6b7348171D |
66,562,861 | Sourcify |
Both use Arc's native USDC (0x3600000000000000000000000000000000000000). Addresses and deploy blocks are committed in contracts/deployments/; check the address before you pay.
Paths: canary is a 1 USDC deal the seller sends back; P1 the seller refunds; P2 the buyer disputes and the plug refunds the buyer; P3 the plug rejects the dispute and the seller is paid; P4 the buyer signs an early release that someone else relays; P5 a deal with no money-back window pays out at once. Re-check it any time with script/check-proofs.sh. The testnet run is in 5042002-proofs.json.
| Path | Step | Transaction | Result |
|---|---|---|---|
| setup | buyer approves escrow | 0x9b324acf... | ok |
| canary | buyer pays | 0x60958251... | ok |
| canary | seller sends it back | 0xe9596ccc... | ok |
| P1 | buyer pays | 0xd5a3468b... | ok |
| P1 | seller sends it back | 0x4de21a9e... | ok |
| P2 | buyer pays | 0xaf6bdb3e... | ok |
| P2 | buyer disputes | 0x3f2fb627... | ok |
| P2 | plug rules for the buyer | 0xd26a8421... | ok |
| P3 | buyer pays | 0x39ae3da9... | ok |
| P3 | buyer disputes | 0x79ee3a23... | ok |
| P3 | plug rejects the dispute | 0x05287a46... | ok |
| P3 | payout | 0x1524d2b9... | ok |
| P3 | seller returns the payout (capital reuse) | 0xbc6a6803... | ok |
| P4 | buyer pays | 0x9d35c4e9... | ok |
| P4 | signed release, relayed | 0xe8ddd2f1... | ok |
| P4 | payout | 0x6c7829ba... | ok |
| P4 | seller returns the payout (capital reuse) | 0x0bb7ac57... | ok |
| P5 | buyer pays | 0x40144465... | ok |
| P5 | payout | 0x37588f6f... | ok |
| P5 | seller returns the payout (capital reuse) | 0x54101948... | ok |
| Component | Role |
|---|---|
contracts/ |
DealEscrow (Foundry): holds funded deals and pays only the addresses fixed at funding. Unit, fuzz, invariant and Arc fork tests; deploy, admin and proof scripts |
apps/web/ |
The deal room (Next.js): create, sign, pay, dispute and settle from a phone. Shows a live naira equivalent next to USDC prices |
services/wallets/ |
Google sign-in through Circle user-controlled wallets, so people without a wallet app can take part |
services/sponsor/ |
Gas sponsor: deploys smart wallets from their signatures and covers gas for the party who must act, after checking the call on-chain |
services/keeper/ |
Pays out finished deals, refunds buyers when a plug misses the 7-day deadline, retries parked payouts, alerts on solvency and owner actions |
packages/shared/ |
ABI, chain config, EIP-712 types and funding rules shared by the app and services |
packages/testkit/ |
Test helpers: local chain, contract deployment, an RPC proxy that behaves like Arc |
Key design choices, in short: the plug can only choose between two fixed destinations, so a referee can never become a custodian; deal terms are signed EIP-712 data carried in the link, so there is no server database of deals; and a silent plug defaults to a refund, so the worst case for a buyer is waiting 7 days. The full trust model and threat analysis is in contracts/SECURITY.md.
Every push runs a local gate (scripts/hooks/pre-push): forge fmt --check, the Foundry unit, fuzz and invariant suites, Slither (fails on any medium or high finding), the Arc fork tests, and typecheck plus tests for every TypeScript package. The contract suite includes 9 invariant tests over 10 money and state rules: the balance always covers what the contract owes, the total held is exact, payout legs sum to what was escrowed, and the parties fixed at funding never change (SECURITY.md). GitHub Actions runs the contract build and tests on pushes to main (contracts.yml).
cd contracts && make test # unit, fuzz and invariant tests
pnpm -r typecheck && pnpm -r test # TypeScript packages and the web appRequires Node 22+, pnpm and Foundry.
git clone https://github.com/Majormaxx/plug360 && cd plug360
git submodule update --init --recursive
pnpm install
pnpm build
cp apps/web/.env.example apps/web/.env.local # defaults to Arc testnet
pnpm --filter @plug360/web dev # http://localhost:3000The app runs on Arc testnet with no configuration. Google sign-in, gas sponsorship and the keeper need the optional values described in apps/web/.env.example and services/keeper/.env.example. Get test USDC from faucet.circle.com.
Keys, deployment steps, owner actions, monitoring and incident playbooks: contracts/OPERATIONS.md.
Apache-2.0. See LICENSE and NOTICE. Arc is a trademark of Circle Internet Group, Inc. and/or its affiliates; this project is built on Arc and is not affiliated with or endorsed by Circle.