Non-custodial stablecoin payments, escrow & double-entry ledger
Settlora
A stablecoin payment gateway where merchants price in USD or INR and get paid in USDC directly to their own wallet, with milestone escrow and a bank-grade double-entry ledger.
My role: Design and full-stack development: smart contracts, ledger, NestJS API, indexing workers and web portal
- Solidity
- Foundry
- NestJS
- Next.js 16
- Double-entry ledger

Overview
Settlora removes the custody, compliance and volatility problems that stop businesses accepting crypto. Smart contracts route each payment peer-to-peer straight to the merchant's wallet, never holding funds, while an immutable double-entry ledger keeps the internal books balanced to the exact integer minor unit. It was built in six phases and runs on testnets (Base Sepolia, Polygon Amoy and a local Anvil chain) without real funds.
The challenge
Accepting stablecoins should be cheaper and faster than cards for global e-commerce and B2B, but most gateways hold customer funds, which creates custody risk and regulatory burden, and their accounting rarely matches what actually happened on-chain. Price volatility, chain reorganisations and floating-point rounding make it worse.
Settlora set out to let merchants price in USD or INR, get paid in USDC directly to their own wallet with no intermediary account, run staged B2B payments through escrow, and still have books that a finance team can audit to the last minor unit.
How it works
- 1Invoice in USD / INR
- 2Locked USDC quote
- 3Wallet pays via router
- 4Merchant wallet settled
- 5Reorg-safe confirmation
- 6Ledger + signed webhook
Architecture
Two Solidity 0.8.24 contracts built on OpenZeppelin v5 sit at the core. PaymentRouter atomically splits each payment into the merchant's net settlement and a basis-point platform fee and never retains a balance. MilestoneEscrow supports staged releases, arbiter dispute splits in basis points and mutual EIP-712 cancellations. Foundry runs 29 tests with 100% line coverage, 256 fuzz runs and 8,192 invariant calls, and Slither reports no high or medium issues.
The ledger package implements a full chart of accounts across assets, liabilities, equity, revenue and expenses. Every amount is an integer in minor units (bigint in TypeScript, NUMERIC(38,0) in PostgreSQL), journal entries are append-only, and debits must equal credits at every transaction boundary. Worker services built on Viem crawl blocks for router and escrow events with a persistent cursor, wait for confirmation depth, roll back tentative state if a reorg is detected, then post to the ledger and send HMAC-SHA256 signed webhooks with exponential retries.
A NestJS 10 API with Prisma and OpenAPI documentation serves a Next.js 16 portal. Hosted checkout locks a quote for 30 minutes and supports wallet payments with EIP-2612 permits, EIP-681 QR codes, network selection and ERC-4337 paymaster sponsorship. Merchants get sales KPIs, an invoice generator, a payments explorer and a live journal stream; the escrow manager builds agreements and triggers releases; and the admin engine runs daily ledger-to-chain reconciliation, KYB approvals, OFAC sanctions screening and an emergency freeze.
What I built
Smart contracts that never hold funds
PaymentRouter (Solidity 0.8.24, OpenZeppelin v5) splits each payment atomically into the merchant settlement and a basis-point fee, keeping a zero-balance invariant.
Milestone escrow for B2B
Staged releases, arbiter dispute resolution in basis points, and mutual cancellations signed off-chain with EIP-712.
Verified, not assumed
29/29 Foundry tests with 100% line coverage, 256 fuzz runs and 8,192 invariant calls, plus clean Slither static analysis (no high or medium findings).
Double-entry ledger
A balanced chart of accounts with integer minor units everywhere (bigint in TypeScript, NUMERIC(38,0) in PostgreSQL) and append-only journal entries checked at every transaction boundary.
Reorg-safe indexing and webhooks
A block crawler with a persistent cursor, a confirmation worker that detects chain reorganisations and rolls back tentative state, and HMAC-SHA256 signed webhooks with retry backoff.
Checkout, dashboard and compliance
Hosted checkout with a 30-minute quote, EIP-681 QR codes, EIP-2612 permits and ERC-4337 paymaster support; a merchant dashboard with a live journal; and an admin portal for reconciliation, KYB and sanctions screening.
Engineering decisions
- Never take custody: the router forwards funds in the same transaction, so there is no platform balance to hack or regulate.
- Store money as integers in minor units end to end, so no floating-point rounding can unbalance the books.
- Treat blocks as tentative until confirmed and roll back on reorgs before posting to the ledger.
- Reconcile the ledger against the blockchain every day and keep a circuit breaker to freeze the platform in an emergency.
Results
- Smart contracts at 100% line coverage with 8,192 invariant calls and a clean Slither report.
- Books balanced to the integer minor unit, reconciled daily against the blockchain.
- Reorg-resilient settlement with signed, retried merchant webhooks.
- 29/29 Foundry tests and 25/25 Vitest integration tests passing.
Stack
- Smart contracts
- Solidity 0.8.24, OpenZeppelin v5, Foundry (Forge, Anvil, Cast), Slither
- Backend
- NestJS 10, TypeScript, Prisma, Swagger / OpenAPI 3.0, EIP-712 signing
- Ledger
- Immutable double-entry ledger, bigint minor units, ACID SQL transactions
- Workers
- Viem, Node.js worker threads, reorg rollback engine, HMAC-SHA256 webhooks
- Frontend
- Next.js 16 (Turbopack), React 19, Tailwind CSS v4, Viem
- Data & standards
- PostgreSQL 16 (Neon), EIP-712, EIP-2612, ERC-4337, OFAC screening; 25/25 Vitest integration tests
Related services
Need something like this?
I can build a version of this for your product, your data and your stack.
Start a project