Escrow contract

All robopay users share one escrow contract per network. It is deployed once, verified, and its source is readable on Basescan.

Network	Address
Base mainnet	`0x7c41381C461AA546B8953d35d5bF61321AA251Ed`
Base Sepolia	`0x11860A5EAF6DF1E95e34B07628C4924Ef127d9C9`

USDC token addresses used by robopay:

Network	USDC
Base mainnet	`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`
Base Sepolia	`0x036CbD53842c5426634e7929541eC2318f3dCF7e`

Functions

open(payee, token, amount, deadline, terms, nonce) returns (bytes32 id): Lock amount of token for payee until deadline. The token must be on the allowlist. The id is a hash of the chain, contract, payer, and every argument, so no one can claim an id before you.
release(id, payerSig, payeeSig): Pay the payee. Both signatures must be valid EIP-712 signatures over the escrow’s contents. Smart contract wallets are supported through EIP-1271.
refund(id): After the deadline, return the funds to the payer. Callable by anyone; funds can only go to the payer.
releaseDigest(id) view: The exact digest both parties sign.
escrows(id) view: Payer, state, payee, token, amount, deadline, and terms of an escrow.

Signed message

Release(bytes32 id, address payee, address token, uint256 amount,
        uint256 deadline, bytes32 terms)

Domain: name RobopayEscrow, version 1, the chain id, and the contract address. A signature is therefore valid for one escrow, on one contract, on one network.

Events

Opened(id, payer, payee, token, amount, deadline, terms), Released(id, payee, amount), Refunded(id, payer, amount).

Admin role

The deployer holds an admin role with one power: adding or removing tokens from the allowlist. It cannot move, freeze, or redirect escrowed funds, and it cannot block releases or refunds of existing escrows. The role is permanent in this version.