Pact

The problem

Why this needed to exist

The solution

How it works

Implemented

What’s actually built

• The Seal is a signature

  Each party calls nimiq.sign() over a canonical digest of the terms. The server verifies the signature and derives the signer’s address from the public key — it never accepts an address a client claims.

• The brand mark is the fingerprint

  The ring around every agreement renders the digest: each of its 32 hex characters becomes one tick. Two people can compare seals across two phones, and a changed agreement visibly changes shape.

• Payments carry the agreement on-chain

  NIM payments go out with data = PACT:<id>:<milestone>, so the payment’s purpose is written into the Nimiq ledger itself. USDT settles as an ERC-20 transfer on the chosen chain.

• Confirmed means the network said so

  A wallet returns a transaction reference, recorded as sent. The server reads the network and confirms only if the transaction exists, succeeded, went to the agreed recipient for the agreed amount with this agreement’s memo.

• Renegotiation that re-seals

  Either side can propose changes to a sealed pact. Accepting them moves the fingerprint and clears both signatures, so it cannot return to sealed until both people sign what it now says.

• Public records, by consent

  A published agreement gets a link anyone can open to check the terms, fingerprint and signatures — without delivery notes, transaction references or full wallet addresses.

• Campaigns

  A brand posts a brief with a fixed reward and a number of spots. Taking one up creates an ordinary Pact. Spots are claimed atomically, one per person, and return if an agreement is declined.

• Issues, not verdicts

  Either side can raise one of four real problems in their own words. It records a disagreement; it does not adjudicate one, and it moves no money.

Interface

Screens from the real product

My role

What I did

Decisions

Technical and design choices

1. 01

   No escrow, and say so

   The Mini Apps framework gives an app no way to hold or conditionally release funds. Pact never claims to: payments go wallet to wallet, and a build-time honesty check fails if words like "escrow" or "guarantee payment" appear in user-facing copy without a negation.

2. 02

   One redaction boundary

   Everything a non-participant can see passes through a single function that builds a separate record type field by field, so a column added later cannot publish itself. A test greps the serialised payload for wallet addresses.

3. 03

   Allowlists for visibility

   Visibility checks are written as "is SHAREABLE or PUBLIC", never "is not PRIVATE", so a row from before the column existed withholds instead of publishing. This was a real bug caught in testing.

4. 04

   Reputation is a view, not a table

   Trust metrics are a database view over what actually happened, and always show the denominator — "4 of 5 delivered on time", never a bare 80%.

Trade-offs

Challenges along the way

1. 01

   A provider that resolves with errors

   The Nimiq provider resolves with an error object instead of throwing. A call site that forgets to check would report a payment as sent when it was not, so every provider call goes through one unwrap() function.

2. 02

   Money without floats

   USDT has 6 decimals, not 18, and gas is paid in the chain’s native token. Amounts are minor-unit strings end to end, and milestone splits always sum back to the total.

3. 03

   Judges on laptops

   Wallet features only work inside Nimiq Pay. Outside it, the app detects the missing provider and offers a complete demo instead of failing.

Results

What can be checked

• Cycle II special reward

  One of five extra picks chosen from 207 submissions to the Nimiq Mini Apps Competition, Cycle II — a $100 reward.

• Competition submission

  Listed in the official Nimiq Mini Apps Competition Cycle II submissions.

  miniappscompetition.com (opens in a new tab)

• Tests

  135 tests run without a test framework — Node executes the TypeScript directly — covering signature replay, digest stability, milestone arithmetic and redaction.

  Repository (opens in a new tab)

Lessons

What I took away

• When a product cannot do something users expect — like hold funds — the strongest design move is to state it plainly on the screen where they would assume it.
• Making the security property visible (the Seal) did more for trust than any copy could.

What’s next

Planned — not built