Sitebound Built on Whitechain Whitechain Whitechain Whitechain
Live on Whitechain Whitechain Sepolia

Addressless checkout.

3-D Secure-style USDT payments on WhitechainWhitechain A hacked page can't redirect the money.

How it works Rules you can check Try it Roadmap FAQ

Why we are building it

We are killing the checkout address.

A soulbound token stays with one wallet. A Sitebound payment stays with one site. Five reasons, one idea: the page never tells anyone where the money goes.

01

No address on the page

A classic checkout shows an address, and a hacked script can swap it. Sitebound's page holds none.

A classic crypto checkout

Buyer copies it. 12 USDT lands at the attacker.

One wrong paste is final. Source

With Sitebound

Only the registered wallet is paid

The browser names the site, not your page.

02

A 3-D Secure-style confirmation

Like the check on a card payment, your browser asks you to confirm the site and the amount with Touch ID.

The browser names the site. The contract pays only the wallet registered for that site.

It keeps happening: what compromised web code has cost

Check Sitebound yourself

How it works

Register your site once, paste one tag, and every payment goes to the wallet your site registered.

In order: your browser creates a wallet. You add a TXT record named _sitebound.0xmujahid.xyz with the value sitebound= followed by your wallet, and the relayer checks it and registers 0xmujahid.xyz to that wallet on Whitechain. You paste the tag <sitebound-pay amount="12.00" order="A123">, which holds no address. When a buyer pays, a frame on another origin shows the site name the browser reports. Touch ID signs the payment with a passkey, the contract checks that signature on chain and pays only the wallet registered for that site. The buyer has no gas to pay, only a 0.01 USDT fee, and the relayer pays the gas.

Rules you can check

Nobody owns the contract or can upgrade it.

The source is verified on Sourcify and the Whitechain explorer, and your own browser can check that the deployed code is that source.

Built on

Whitechain
Network
Whitechain Sepolia testnet

  • 138

    tests pass

    forge test, measured 7 Nov

  • Exact

    match

    Sourcify, verified source

  • 0

    upgrade paths

    No contract owner, no proxy

  • 1

    payment = 1 registered wallet

    Pays only the site's wallet

Check it yourself

Live check, in your browser

Waiting
Code on chain, keccak256
not read yet
Expected, published
not read yet
Runtime code length
not read yet
Constructor values in the code
not read yet

Waiting to run

Your browser reads the code from the network, hashes it, and compares it with verify/expected.json.

Try it on a real site

Buy the builder a coffee for 3 test USDT on their portfolio, 0xmujahid.xyz.

  • No address on the page.
  • Touch ID confirms the site and amount.
  • Only that site's registered wallet is paid.

First time? Link a wallet holding test USDT, once.

Buy a coffee on 0xmujahid.xyz
An illustration of the real checkout, on test USDT.

What is live, and what is not built yet

No dates and no promises. Live means running on Whitechain Sepolia testnet today.

Now

Live on testnet
  • Addressless paymentThe contract pays the wallet registered for the site.
  • Touch ID confirmationA passkey signs the site and the amount.
  • Gasless for buyersA relayer pays gas. Buyers pay USDT and a 0.01 fee.
  • DNS TXT onboardingYour payout wallet is created in your browser.
  • Refunds and splitsMerchant-funded refunds, and payouts split across up to 5 wallets.
  • Optional quotesYour server signs the amount, so a page cannot change it.

Verified source. It matches on Sourcify and the Whitechain explorer. Check the live code

Next

Planned, not built
  • Public API for adding sitesToday only our admin script does it.
  • Team payout walletSeveral owners, passkey-bound. Needs a new contract; today one browser key.
  • More than one DNS checkerThe contract supports it. Today there is one.
  • Safari and Firefox testingOnly Chrome is measured so far.

Planned, not built. Order and timing are not fixed.

Later

Planned, not built
  • Audit, then mainnetA professional audit first, then real USDT.
  • Pay from any chainNeeds a route into Whitechain; we found none yet.
  • Shop pluginsReady-made server code for common store platforms.
  • Overlay detectionWarn when a page draws over the payment window.
  • On-chain DNSSEC proofReplaces the trusted DNS checker.

Planned, not built. Depends on the steps before it.

Questions, answered plainly

Where something is not built or not proven, we say so.

What is not built yetCheck the contract

What is Sitebound?

Checkout for USDT with no payout address on the page. The buyer confirms the site and the amount with Touch ID, like 3-D Secure for cards, and a contract pays the wallet registered for that site.

Do I need a crypto wallet, or to know crypto?

Site owners: no. Setup creates the payout wallet in your browser, so back it up, because it lives only there. Buyers link a wallet that holds USDT once, then pay with Touch ID.

Do my buyers need gas?

No. Buyers pay in USDT only, never WBT for gas. A relayer pays the gas and takes a 0.01 USDT fee.

Who gets the money?

Only the wallet, or the split of wallets, registered on-chain for that site's domain. The pay() call has no payee field, so a page cannot name another wallet.

Can a hacked page steal the payment?

It cannot redirect the money. It can still show a wrong amount, and a fake lookalike site can fool a buyer, so check the site and the amount in the confirmation. A site that signs quotes closes the amount gap.

What stops someone registering my domain?

A DNS TXT record that only the domain's owner can add. One trusted checker, our relayer, reads it today, and that is a real trust assumption. A change to an existing site's payout waits 1 hour, and its owner can freeze it.

Is it real money?

No. It runs on Whitechain Sepolia testnet with test USDT that has no value. It is not audited, so do not use it for real funds.

Why Whitechain?

Stablecoin payments settle in one transaction, and its USDT supports permit, which lets a relayer pay the gas. The chain's P-256 precompile also lets the contract verify Touch ID signatures itself.

Is it open source?

The contract's source is verified on Sourcify and the Whitechain explorer, so you can read exactly what runs. Verify us checks the live code in your browser.