A. Two-step happy path
Status: ReleasedThe payer creates it, deposits with a second signature, then releases. Escrow #0003
Everything here is enforced by the Sisonke contract on Stellar. The app only offers what the contract accepts, and the contract refuses the rest, even if someone skips the app entirely.
Status: Awaiting deposit — not fundedStatus: FundedStatus: ReleasedorStatus: Refunded
With an arbiter: Funded → In dispute → Released, Refunded or Split. Unfunded escrows can be Cancelled.
Status only moves forward. Released, Refunded, Split and Cancelled are final.
Who can do what
One signature, from one specific person.
Nobody else’s signature counts. Not a stranger’s, not ours.
| Action | Who signs | Allowed when | Money moves | Status after |
|---|---|---|---|---|
| Create | Payer | Amount above zero, recipient isn’t the payer, deadline in the future and within 365 days | Nothing yet | Status: Awaiting deposit — not funded |
| Deposit | Payer | Awaiting deposit, before the deadline, not paused | Payer to contract | Status: Funded |
| Cancel | Payer | Awaiting deposit, any time | Nothing | Status: Cancelled |
| Release | Payer only | Funded or in dispute | Contract to recipient, full amount | Status: Released |
| Refund | Recipient only | Funded or in dispute | Contract to payer, full amount | Status: Refunded |
| Reclaim | Payer only | Funded, deadline passed, no dispute | Contract to payer, full amount | Status: Refunded |
| Dispute | Payer or recipient | Funded, before the deadline, arbiter named | Nothing | Status: In dispute |
| Resolve | Arbiter only | In dispute | Split as the arbiter decides | Status: ReleasedStatus: RefundedStatus: Split |
| View | Anyone | Always | Nothing | No change |
What the contract refuses
The transaction fails and the money stays exactly where it was.
- A release signed by anyone except the payer.
- A refund signed by anyone except the recipient.
- A second deposit into an escrow that’s already funded.
- Any release, refund or reclaim once it’s Released or Refunded.
- A release or refund before anything is deposited.
- A reclaim before the deadline, or a deposit after it.
- An escrow for zero USDC, or one where you pay yourself.
- A dispute on an escrow with no arbiter, or after the deadline.
- A decision by anyone except the escrow’s arbiter, or before a dispute.
No back door
No admin function can move, freeze or redirect money in an escrow. The code can be upgraded only after a public notice period of 1 hour, and every page warns you while an upgrade is pending, so you can settle first. The website holds no keys. If it disappeared tomorrow, every escrow would still work from Stellar Lab.
Status follows the chain
The app changes status only after Stellar confirms. If a transaction fails, the escrow stays exactly as it was and the app says why.
Why the payer can reclaim
It’s the one time someone can send money to themselves. Without it, money would be stuck forever if the recipient vanished. It only works after the deadline both people saw at the start, if no dispute was opened before it.
Proof on Stellar Testnet
Seven scenarios, run end to end on the live contract. Every hash opens on Stellar Expert, the refused ones too: they were sent on-chain and failed there.
B. Recipient refund
Status: RefundedCreated and funded in one signature. The recipient sends it back. Escrow #0004
C. Unauthorized
Status: ReleasedSix calls by the wrong signer, all refused with the money untouched. Then the payer releases. Escrow #0005
- Create and deposit (arbiter)Succeeded: Fundedbb2b…3abd
- Release #5 by recipientRefused: Not yours to sign (auth error)2c18…3a13
- Release #5 by strangerRefused: Not yours to sign (auth error)0881…30b5
- Refund #5 by payerRefused: Not yours to sign (auth error)9d74…37cc
- Decide #5 by strangerRefused: Not yours to sign (auth error)fc77…bc4a
- Reclaim #5 by recipientRefused: Not yours to sign (auth error)9fdf…e343
- Pause the contract by strangerRefused: Not yours to sign (auth error)add4…1f16
- Check #5: status and the contract’s USDCSucceeded: Still Funded, funds unchangedRead, no transaction
- Release #5 by payerSucceeded: Released633d…f134
D. Duplicates
3 refusedThe same release, refund and deposit sent a second time. Escrow #0003, #0004
E. Dispute and split
Status: SplitThe recipient opens a dispute. The payer can’t reclaim, and the arbiter splits it 0.6 / 0.4. Escrow #0001
- Create and deposit (arbiter, 90s)Succeeded: Funded703a…69d6
- Open a dispute on #1Succeeded: Disputed88d4…a8e3
- Decide #1 by strangerRefused: Not yours to sign (auth error)20fb…9644
- Reclaim #1 after deadlineRefused: Already moved on (error #101 InvalidStatus)5a43…f06f
- Decide #1 (0.6 / 0.4)Succeeded: Splite29d…a96b
F. Deadline reclaim
Status: RefundedThe payer tries to take it back early, then does after the deadline. Escrow #0002
G. Cancel
Status: CancelledCancelled before any deposit. A deposit after that is refused. Escrow #0006
About this contract
Read live from the contract on Stellar Testnet. The admin can pause new escrows and deposits, and can upgrade the code only after the public notice period below. It can’t move, freeze or redirect an escrow.
- Contract
- CB65…K7MGExplorer
- Version
- Admin
- Upgrade notice period
- Upgrades
- Escrows created
- Locked in escrows
- Contract’s USDC balance
Code hash (wasm), as deployed99693d7da2c0ebb52043e97ca8342590b296b5aa83f6d682d345c3d627a34aadCheck it yourself: the output must equal the hash above, or the one in the latest upgrade event.
stellar contract fetch --id CB65NNEWX53VH7GFZYCIAKIUZIRTS645YVWXSUZCC2VCFB6NFOX7K7MG --network testnet | shasum -a 256