Your money moves only when you say so.
The rules that protect your money are enforced by smart contracts on Whitechain, not by promises in our database.
Money rules, enforced on-chain
Exact amounts only
Shops sign merchant, amount, order id and deadline (EIP-712). The payment router settles only that, once.
No replays
USDT authorizations carry single-use nonces, so a payment can never be submitted twice.
No front-running
Payments use receiveWithAuthorization: only the WhitePay router can execute them.
Safe refunds
Only the shop's payout wallet can refund, only to the original payer, never more than was paid.
Your keys
Never leave the phone
AES-GCM encrypted with a passkey (fingerprint or Face ID) or a PBKDF2-hardened PIN with lockout.
Unlock once per session
Stays unlocked for 15 idle minutes in that tab only, and locks when you close it.
MetaMask too
External wallets still approve every signature, with WhitePay's PIN or fingerprint check in front.
Web layer
Strict CSP
A fresh nonce on every request with 'strict-dynamic', no framing, and HSTS preload.
CSRF and abuse
JSON-only writes, cross-site origins refused, per-IP rate limits and body-size caps.
Signed webhooks
EIP-191 signatures with a 5-minute replay window, sent only to public HTTPS hosts.
Pinned SDK
Immutable versioned files with Subresource Integrity. Network data is never inserted as HTML.
A test suite anyone can run.
28 live checks covering CSP nonces, clickjacking, CSRF, oversized bodies, forged orders, SSRF, forged and replayed webhooks, price tampering and SDK integrity.
✔ CSP with per-request nonce + strict-dynamic
✔ CSRF: cross-site POST /api/pay blocked (403)
✔ SSRF: webhook to cloud metadata refused
✔ forged order signature rejected
✔ store: replayed webhook rejected (401)
✔ SDK matches the pinned SRI hash
28 passed, 0 failed