Contract

NayroInvoiceDesk

One small contract and the cell it creates per invoice. No owner, no admin, no fee, no pause and no upgrade path.

Where it is

Network
Robinhood Chain (4663)
NayroInvoiceDesk
Not deployed yet
Cell code hash
0x9c17e144d0e271f463f7e0b58aa65aee808cd7b0652bebd13d4963d06d803da0
Machine-readable
/contracts.json (address and ABI)

Live totals

Not deployed yet, so there is nothing to count.

What it can do

  • cellOf(payout, controller, ref): the deposit address of an invoice. A view; works before anything is on chain.
  • collect(terms, assets): creates the NayroInvoiceCell at that address if needed and moves its whole balance of each listed asset to the payout. Anyone may call it.
  • collectMany(list, assets): the same for up to 32 invoices in one transaction. This links them to each other in public.
  • redirect(terms, to, assets, deadline, signature): moves the balance to another address with the controller's EIP-712 signature (EOA or a smart wallet that answers EIP-1271).
  • close(terms, deadline, signature): marks the invoice closed with the controller's signature. Funds that still arrive stay collectable by the payout.

Rules it keeps

  • The desk has no payable function and never holds ETH or tokens. Every move goes from a cell straight to its destination in the same call.
  • A cell answers only its desk. Its balance can go to the payout baked into its address, or elsewhere only with the controller's signature.
  • Signatures are bound to this chain, this desk, the cell, the destination, the asset list, a nonce and a deadline. Each works once. High-s signatures are refused.
  • Tokens that return nothing from transfer are accepted; tokens that return false are refused. For tokens that take a fee, the event records what was moved and what arrived.
  • Re-entry into the desk during a move is refused.

Risks

  • The desk contract is new and has had no outside review. Try a small invoice first.
  • Tokens that can block addresses can freeze a cell's balance. Stock tokens and some dollar tokens on this chain have that power.
  • A payout that is a contract refusing ETH makes collect fail; a controller can redirect instead.

Check a deployment yourself

The repository rebuilds the bytecode and compares it, byte for byte, with what runs at the address, including its creation transaction:

cd contracts && ./setup.sh && forge build --force && cd ..
npm run contracts:artifacts -- --check
npm run verify-deployment -- --desk <address> --desk-tx <creation tx>

Solidity 0.8.28, optimizer 200 runs, EVM paris, no metadata hash. The desk takes no constructor arguments.