Security, contracts and custody
Contracts
| Contract | Chain | Address |
|---|---|---|
| Xebra fee wrapper v2 | Stellar | CCPVTWII2TW6VVSVA4JQ2KFHICGBG4QVAHPIGUPSIW3E4VNPUI4Y2WQR |
| Xebra fee wrapper | Arc | 0x11b30470DAE40B2Fc27b7AA90dc58e6B4fE9f4c3 |
Both are open source: github.com/drydocs/xebra. Burning, attesting and minting are Circle's contracts and Circle's service.
Custody
- From Stellar, your USDC goes from your wallet to Circle inside the one transaction you sign. Xebra's contract takes its fee in the same transaction and never holds the principal.
- From Arc, Circle's contract burns from whoever calls it, so Xebra's contract on Arc holds the USDC for the length of that one transaction. It fails the transaction unless it burned exactly what it should and holds nothing beyond its own fees.
- Every transfer can be completed by anyone once Circle has attested it, so a transfer never depends on Xebra being online. See claim.
Limits and governance
- Each transfer through Xebra's contracts is capped at 100 USDC while they have had no external audit.
- The fee can never exceed 1%, and Circle's delivery fee can never exceed a set limit per chain or a tenth of the transfer. These ceilings are written into the contracts.
- A pauser can stop new transfers instantly. Every change that loosens anything (fees, limits, chains, keys) is announced on chain and takes effect only after 48 hours, during which the pauser can cancel it.
Audits
The contracts have not had an external audit. They are tested (unit, property and fork tests, and real transfers on testnet and mainnet), and limits are kept low until that changes.
Reporting a problem
Do not open a public issue for anything that could put funds at risk. Use GitHub's private vulnerability reporting on the repository, as described in its SECURITY.md.