# Contracts & trust

Inspect the collection contract, cryptographic boundary and execution limits.

Cleard provider API · 1.4.0 · Base Sepolia test USDC.

## Pinned Base Sepolia contracts

| Contract | Address |
| --- | --- |
| USDC MerchantReserveV4 (reserve or direct wallet) | [0x8825DBEd4B7E48c2A38Ae8D3136E1E12A5147Bbc](https://sepolia.basescan.org/address/0x8825DBEd4B7E48c2A38Ae8D3136E1E12A5147Bbc) |
| USDC MerchantReserveV3 | [0x6baBBCBCC6517E1b2C6872Ec01f323b98D91eC9d](https://sepolia.basescan.org/address/0x6baBBCBCC6517E1b2C6872Ec01f323b98D91eC9d) |
| Circle test USDC, six decimals | [0x036CbD53842c5426634e7929541eC2318f3dCF7e](https://sepolia.basescan.org/address/0x036CbD53842c5426634e7929541eC2318f3dCF7e) |
| BLISK verifier | [0xfd36CFa899719Ac07b904F0e0fFA7a1E3e724651](https://sepolia.basescan.org/address/0xfd36CFa899719Ac07b904F0e0fFA7a1E3e724651) |

routing-usdc-trust.json pins the USDC V3 contract addresses, runtime hashes, token implementation, decimals and record public key. routing-wallet-trust.json separately pins V4. The browser checks the program’s published pins. In contracts, abi and pins, the historical key MerchantReserveV2 identifies the selected V3 or V4 contract and MockToken identifies the program’s token, USDC for circle-usdc. These compatibility keys are retained for existing clients. Never mix deployment configurations.

## What BLISK verifies

The enrolled signer policy is Guard AND (Adjudicator A OR Adjudicator B). A satisfying coalition creates an aggregate signature verified against one root key. The root is enrolled upfront. The service verifies the designated reviewer’s Ed25519 decision offchain, then the BLISK coalition signs the exact refund action. The contract verifies BLISK, not the reviewer’s Ed25519 signature. This keeps the signer-policy verification boundary compact while other execution checks remain explicit.

The reserve separately checks chain, contract, merchant, purchase, token, beneficiary, policy version, amount caps, expiry, decision continuity, execution replay and available funds. BLISK does not replace commercial records, evidence evaluation, accounting or funding.

## Trust and finality

Cleard operates the registrar, record keys and all Guard/A/B BLISK signer processes for this testnet service. V3 and V4 verify the actual routed payment. Process separation does not create independent organizational custody. Merchant and buyer control their existing wallets; the provider’s designated reviewer controls its decision key.

Two canonical L2 confirmations are required. They are not L1 economic finality. Changed bytecode or confirmed block hashes halt execution for operator inspection. The verifier remains unaudited; use test assets only.

## Terms used in these docs

| Term | Meaning |
| --- | --- |
| Program | Scoped integration records and credentials, bound to one deployment and reviewer. |
| Registrar | Merchant-authorized service address that registers purchases within enrolled limits. |
| Designated reviewer | Decision authority whose Ed25519 public key is fixed in the program. |
| Wallet link | Secret capability to one record; it does not replace wallet signatures. |
| Record key | Cleard public key used to verify signed commitments and notifications. |
| Commitment | Signed purchase terms, parties, beneficiary and collection source. |
| Beneficiary | The fixed refund recipient accepted before payment. |
| Approved | Amount awarded by the named reviewer. |
| Paid | Cumulative amount established by confirmed refund receipts. |
| Outstanding | Approved minus paid; an unpaid obligation. |
| Collection source | The accepted reserve or merchant wallet from which refunds can be collected. |
| USDC | Circle’s valueless six-decimal test token on Base Sepolia; it is not redeemable mainnet USDC. |