receivable.eth

Demo

About

An invoice is a promise that pays in ninety days. A small business that needs the cash today can sell it, but factoring is expensive for one structural reason: the buyer cannot cheaply answer three questions. Is the invoice real? Will the customer pay? Has it already been sold to someone else? Every lender re-underwrites from scratch, and prices the uncertainty in. receivable.eth removes the uncertainty without publishing the invoice. A business connects its accounting system. A Chainlink CRE Confidential Workflow pulls the invoice inside an AWS Nitro enclave, where the OAuth token, the full invoice, the customer identity and the debtor's payment history are decrypted and scored. None of it leaves. Exactly seven fields cross the enclave boundary — a business label, an invoice label, a keccak256 fingerprint of the document, the face value, the due date, a risk score and a discount rate — and the DON signs that report before anything is written on-chain. The signed report mints inv-1042.acme.receivable.eth on ENSv2. A permissioned resolver decides who may write each record, so a business cannot name an invoice that was never verified. The name becomes the invoice's public identity: anyone can resolve it and read the score, the fingerprint and the terms, without ever seeing the document itself. Before it can be financed, the fingerprint is registered on a Hedera Consensus Service topic. That topic is the double-financing registry — an invoice already claimed there is rejected, so the same receivable cannot be sold twice across the market. The financed position is then issued as an ERC-1400/1410 partitioned security through Hedera's Asset Tokenization Studio, so investors hold a transfer-restricted instrument rather than a bare ERC-20. Investors buy units at a discount — $0.968 per dollar of face value on the demo invoice — and the purchase moves USDC from the investor to the business in a single transaction. The market never custodies the cash. When the customer settles, holders redeem at par. The privacy is the whole point. The lender gets a verified, uniquely-registered, priced claim. The business's customer list, payment history and invoice terms never leave the enclave.

How it's made

Monorepo on pnpm 9 + turbo, Node 20, Foundry for Solidity, vitest for TypeScript. Four packages typecheck and lint clean; 31 vitest tests and 32 Foundry tests pass. Chainlink CRE — the pricing workflow is a Confidential Workflow, not a normal one. It uses cre.handlerInTee against @chainlink/cre-sdk 1.20.1, so the handler body executes inside an AWS Nitro enclave in us-west-2. rt.getSecret() decrypts the accounting-system OAuth token in-enclave, so it is never in node memory, and rt.usingTheDons() has the DON sign the seven-field report on the way out. This is the piece that makes the product possible at all: without a TEE you either publish the invoice on-chain or you ask the lender to trust an off-chain operator. ENSv2 (namechain) on Sepolia — names are minted into a PermissionedRegistry; each business gets its own UserRegistry deployed as a proxy through VerifiableFactory, and records are written through a PermissionedResolver. Authorization is Enhanced Access Control, where roles are packed as nybbles inside a uint256. Building against it surfaced two real bugs in our role library: ALL_ROLES had been written as type(uint256).max, which sets every bit rather than every nybble, and ROLE_RENEW as 1 << 4 instead of 1 << 16 (nybble 4). Both are fixed with regression tests. All eight ENSv2 beta addresses in contracts/sepolia/deployments/sepolia.json were verified live on-chain rather than copied out of docs. Hedera — two roles. HCS is the double-financing registry: the invoice fingerprint is submitted to a topic, and a duplicate is a hard rejection, not a warning. HTS is reached through the 0x167 precompile, which returns response codes instead of reverting, so every call site checks explicitly for 22 (SUCCESS); the test mock also has to treat 0 as success, because vm.etch copies contract code but not storage. The security itself is ERC-1400/1410 via Asset Tokenization Studio, with _DEFAULT_PARTITION = bytes32(uint256(1)). Frontend — Next.js 15 App Router, Tailwind, viem + wagmi v2. We dropped wagmi's connector packages entirely: @coinbase/wallet-sdk drags in @x402/* and broke next build. Instead the app does raw EIP-6963 provider discovery, which is smaller and works with whatever wallet the browser announces. Adapter service — Hono + Zod, with a file-backed state store that writes to a temp file and renames, so a crash mid-pipeline can't leave a half-written cursor. Every stage is idempotent (hasCompleted / completeStage), so a re-run resumes instead of double-registering an invoice. Hacky bit worth mentioning: the demo seed generates due dates relative to boot and refuses to start if the seed is stale. An earlier version had every dueDate hardcoded in 2025, which silently made the entire market $0.00 financeable — everything "worked", it just quietly showed nothing.