Who Builds PayMoney

PayMoney is designed and built by Visoft, a cryptographic engineering firm. This page exists so that a design which is published but not yet running can be weighed against work that already is.

The firm

Small on purpose: two to five senior engineers per engagement and one point of technical accountability. Remote-first, operating since December 2022, registered in the EU. Founder and technical lead Paweł Nowak — cryptography researcher and software architect — runs each engagement end to end: specification, implementation, security review, deployment.

The work is proof systems, on-chain verification, low-level Rust and smart contracts. That is a narrow speciality, and it happens to be the exact speciality this design needs.

Why it bears on this design

The hard part of the vault is not the escrow. Escrow on Ethereum is well-trodden. The hard part is verifying a bank's TLS attestation inside a proof over a 31-bit field — a circuit for which, as the risks page says plainly, there is no existing implementation to borrow from.

Deciding whether that is achievable means asking who is attempting it. The relevant history is below, with the repository for each claim, so none of it has to be taken on trust.

Work already shipped

• The first on-chain Stwo STARK verifier on Solana, for Cartridge — cartridge-gg/solana-verifier. The same prover family this design settles with.
• The first Cairo-native recursive STARK verifier for Starknet, for Herodotus — HerodotusDev/integrity, running in production at integrityverifier.com and externally audited by zkSecurity. To be exact about what that audit covers: it examined Herodotus' verifier. Nothing on this site has been audited.
• An EVM verifier for Circle STARK with the Stwo prover — neotheprogramist/stwo-sol-verifier. PayMoney settles on Ethereum L1, so this is the same target.
• Privacy pools for Starknet — EkuboProtocol/privacy-pools, owned end to end including every circuit, and Aletheia for the Starknet Foundation and Cartridge: identity Merkle inclusion and association-set membership proofs. That is the shape of the unlinkability this design claims.
• A ZK-TLS notarisation prototype, for Keyring Network — neotheprogramist/zk-tlsn-example: TLS session proofs and circuits for compliance attestation. The same TLS Notary shape How it works describes.
• A multi-client RPC compliance testing framework for Starknet — neotheprogramist/starknet-hive, covering Pathfinder, Juno, Papyrus and Madara.
• Consensus research for Cardano Partner Chains, with Input Output Global: Jolteon under adversarial and fault conditions — safety, liveness, partition recovery, equivocation.

How the work is done

• Property-based and invariant testing — proptest, kani, miri, loom — rather than line coverage. A settlement rule is decided by its corner cases, and a coverage percentage says nothing about those.
• Formal models in TLA+ and cryptographic proofs in Lean 4 for anything touching concurrency or money, so a reviewer gets a model to argue with rather than only code to read.
• Architecture Decision Records in the repository, numbered, so a later reader gets the reasoning behind a choice and not a guess at it.

These are the practices the rest of this site's claims rest on. They are not a substitute for the audit and the running system that do not yet exist.

Naming a builder does not create an operator

Visoft builds this protocol and cannot run it. The settlement contract holds no administrative authority, so we can no more move your funds, reverse your trade or unfreeze your account than a stranger could. That is a property of the contract rather than a promise from us, which is the only reason it is worth anything.

It cuts the other way too: the same property that stops us reaching your funds stops us fixing your mistake. The risks page states that without softening it.

Contact

linkedin.com/in/neotheprogramist · github.com/neotheprogramist

For anything about PayMoney itself, the contact page reaches the same place.