Skip to content
Undo
Join

Security

Your money can only go two places.

Back to you, or to the merchant you paid. Every rule that decides which is on-chain.

Non-custodial by construction.

When your agent pays, the USDC moves from your wallet into Coinbase Commerce Payments escrow on Base, a contract reviewed in six audits by Coinbase Protocol Security and Cantina. Undo’s own contract is the only operator of that payment. It can capture to the merchant or return to you, and nothing else.

Your single signature covers the amount, the merchant, the fee and Undo’s terms: the request, the delivery deadline and the dispute deadline. None of them can be changed after you sign.

Roles, and their limits.

Owner
Configures fees and roles, behind a two-step transfer and a delay. Cannot move a payment.
Guardian
Can pause new purchases. Cannot pause a refund, and cannot move money.
Relayer
Marks deliveries and sends automatic refunds. Refunds only go to the payer.
Arbiter
Decides contested cases only, splitting the amount between payer and merchant.

What no key can do.

  • Send your payment to anyone other than you or the merchant you paid.
  • Charge more than the amount and fee you signed for.
  • Change the dispute window after you sign.
  • Stop a refund, even while the system is paused.

If Undo disappeared tomorrow, you could still reclaim an unsettled payment directly from Coinbase’s escrow after it expires.

The web app.

This site never asks for a private key. It reads public data, asks your wallet for an address, and asks for a signature only when you join as a merchant or answer a case.

Contracts.

Report a problem.

Found a vulnerability? Write to the address in our repository’s security policy. Please give us a reasonable time to fix it before you disclose it.