Quorum402

Demo

About

x402 turns HTTP 402 into a real payment handshake, but every scheme it defines ("exact", "upto", "batch-settlement", and the newly merged "auth-capture") describes one payer settling one request. None of them can express "I'll pay if enough others do." quorum402 proposes and implements that missing shape as a scheme named "quorum": N distinct payers, one resource, an all-or-nothing outcome, and a refund path when the crowd doesn't show up. The same mechanism covers minimum-participant offers (a trip that runs at 20 travellers), tiered group buying (the price falls as the pool fills), and all-or-nothing crowdfunding. Both halves of that promise run end to end on Hedera testnet: a crowd that arrives, meets the threshold and releases the money to the seller, and a crowd that doesn't, where every payer takes their own money back with their own key and the coordinator cannot stop them. The contract is deployed with no admin key, and the coordinator and subgraph are both public. The whole exchange can be replayed from a clean clone without asking us for anything.

How it's made

**Stack.** Solidity (QuorumPools.sol, one contract holding many pools) on Hedera testnet; Hardhat 3 with viem and the node:test runner; TypeScript end to end; @hiero-ledger/sdk for the native Hedera side; an Express resource server that issues the 402 challenge and acts as each pool's coordinator; a subgraph for pool state; a browser demo that drives real payments from funded testnet wallets; GitHub Actions gating build, solhint, ESLint, tsc and the full test suite on every pull request and on main. **Hedera + x402.** Payments settle through the Blocky402 facilitator, which we verified live against its capability endpoint before designing anything — it advertises `exact` on `hedera:testnet` and, notably, `exact` on every network it serves and nothing else. That empirical check decided the architecture: `quorum` composes over `exact` rather than over auth-capture, which has no Hedera binding. The buyer builds a TransferTransaction whose transaction id belongs to the facilitator, signs it, and hands over a partially signed blob; the facilitator countersigns, submits and sponsors the gas. The buyer never touches the contract on the happy path. **What only the network could tell us.** The contract was first written believing Hedera's EVM denominates value in weibars at 1 tinybar = 1e10. It does not: inside the EVM, `address(this).balance` and `call{value:}` are tinybars, and the 18-decimal weibars are what the JSON-RPC relay presents to Ethereum tooling. The local test suite could not have caught it (it defined its own copy of the constant and checked it against the contract's, so it proved the two agreed with each other and nothing whatever about Hedera). One real payout on testnet caught it in a single run, and the ADRs and specs record the correction rather than hiding it. **The Graph.** A subgraph indexes the pool lifecycle from Hedera testnet: pool created, deposit recorded, threshold met, expired, released. It serves the fill state a buyer actually decides on. It is not decoration: a threshold buy where the seat count is stale is a threshold buy that takes money on a false premise, so a stale read blocks the commit rather than rendering an old number. The Graph's decentralized network does not serve Hedera and Hedera's own hosted service is unavailable, so indexing this contract meant running the indexer: stock graphprotocol/graph-node:v0.35.1, no fork and no patch, deployed with IPFS and Postgres and pointed at the public Hashio relay. Live indexed data, no fixtures. **Verifiable without us.** QuorumPools is at 0.0.10409980 on Hedera testnet with no admin key (https://hashscan.io/testnet/contract/0.0.10409980); `npm run check:deployment` reads the runtime bytecode back off the mirror node and hashes it against what this tree compiles to, and `npm run check:payout` opens a pool, settles a real x402 payment into it, meets the threshold, releases, and confirms on the mirror node that the recipient was credited to the tinybar. The coordinator and the subgraph (https://quorum402-subgraph.fly.dev/subgraphs/name/quorum402) both answer without a wallet or a clone, and the README transcribes a full run from the wire and points at the exact contracts and lines behind each integration.