1. Security Philosophy
Security at Baxis is rooted in non-custodial design principles. Funds deposited into an escrow vault are held strictly by immutable smart contract bytecode on the Base blockchain—never in centralized corporate bank accounts or hot wallets.
Baxis core engineers never have access to user private keys, seed phrases, or unapproved token withdrawal methods. All fund releases require explicit client authorization, auto-release inspection timelock completion, or arbitrator dispute resolution.
2. Authentication Infrastructure
User accounts and workspace access are managed securely via Supabase Auth using encrypted JWT (JSON Web Tokens) with auto-refresh rotation.
When connecting an EVM wallet (e.g., MetaMask), public addresses are cryptographically verified to ensure that only authorized wallet owners can initiate deposit parameters or release funds on-chain.
3. Smart Contract Security
The core BaxisEscrow.sol contract is authored in Solidity v0.8.28 and incorporates battle-tested OpenZeppelin security modules:
ReentrancyGuard
Protects token transfers (`ERC-20`/USDC) against malicious recursive calling attack vectors.
Pausable Pattern
Provides emergency circuit breaker mechanisms to pause new escrow creation during network upgrades.
Ownable2Step
Enforces a secure 2-step pending/confirmation process for administrative ownership updates.
Fee Cap Safeguard
Hard-coded 10.0% maximum platform fee cap (`MAX_FEE_BPS = 1000`) preventing arbitrary fee manipulation.
4. Escrow & Timelock Protection
To prevent client ghosting, every Baxis vault incorporates an automated inspection timelock window (`MIN_INSPECTION_WINDOW` = 24 hours to `MAX_INSPECTION_WINDOW` = 90 days).
Once a freelancer submits deliverables via submitWork, the inspection clock initiates. If the client does not explicitly release funds or open a dispute before expiry, the freelancer can invoke claimInspectionPayout to trigger automated settlement.
5. Database Security & Row Level Security (RLS)
Off-chain metadata stored in our Supabase PostgreSQL database is strictly governed by **Row Level Security (RLS)** policies.
Administrator privileges (e.g., dispute arbitrator roles) are stored in an isolated `user_roles` table protected by `SECURITY DEFINER` database functions, preventing users from altering their own access permissions.
6. Private Evidence Storage
Dispute evidence files (PNG, JPG, PDF) are stored in private Supabase Storage buckets (`dispute-evidence`). Uploaded assets are strictly inaccessible to the open web and are rendered exclusively via short-lived signed URLs generated for agreement participants and arbitrators.
7. User Account Security Best Practices
- Verify Smart Contract Addresses: Always confirm you are interacting with the official Baxis contract address on BaseScan (`0xebc5942d0053B1acEfF18B01086272667209Df5b`).
- Review Inspection Timelocks: Verify the auto-release timelock duration before depositing funds into a vault.
- Document Deliverables On-Chain: Upload project files and proof links directly inside the Baxis workspace to maintain an accurate evidence trail.
8. Responsible Vulnerability Disclosure
We welcome vulnerability reports from security researchers. If you discover a vulnerability, please report it privately to security@baxis.io or olusegunblossom307@gmail.com with reproduction steps. Reports are acknowledged within 12 hours.
9. Independent Smart Contract Audit Transparency
Baxis is currently operating in public beta phase on Base Mainnet. An independent third-party audit is currently in progress rather than complete.
The current codebase has undergone extensive internal static analysis and testing. Full independent security audits with top-tier Web3 audit firms will be commissioned prior to broader production adoption and multi-chain expansion.
10. Security Roadmap
- Completed: OpenZeppelin v5 contract implementation, Base Mainnet deployment, Supabase RLS policies, private evidence vault storage.
- In Progress: Third-party security audit & automated static code analysis monitoring.
- Planned: Formal public bug bounty launch & tiered panel arbitration network.