Settle Canister

Pybara routes all payments through a settle canister — an Internet Computer smart contract whose code is permanently immutable and publicly verifiable.

What Is a Settle Canister?

On the Internet Computer, every canister has one or more “controllers” — principals that can upgrade code, change settings, or delete the canister.

A settle canister satisfies all three of these conditions :

1. Has 0 controllers, controls itself, or is controlled by another blackholed canister
2. Contains no code that would allow anyone to upgrade its WASM binary
3. Is open source with a reproducible build so anyone can verify point 2

Once blackholed, no one — not even Pybara — can change the code.

Source: IC docs

The Pybara Payment Splitter

Canister ID: c5fxy-6qaaa-aaaar-qcazq-cai
Status: Active — blackholing planned after final audit

Every payment and donation goes through this canister. It:

1. Receives tokens from the buyer (ICRC-1 transfer)
2. Splits the amount: (100% − commission%) to the merchant, commission% to Pybara
3. Forwards a log entry to the admin canister (fire-and-forget with retry)

The commission rate is locked per merchant at registration time and cannot be changed unilaterally.

Verify the Canister Status

Open the IC Dashboard and confirm:

• Controllers = cpbhu-5iaaa-aaaad-aalta-cai — the CycleOps Balance Checker, itself blackholed (0 controllers, open source, verifiable)

This satisfies the blackhole definition: a canister controlled solely by another blackholed canister is itself immutable. It also keeps automated cycle top-ups running — essential for a permanent canister with no human controller.

Reproducible Builds

Anyone can verify that the deployed canister matches the published source code.

The WASM is built deterministically via Docker — the same source always produces the same binary.

Prerequisites: Docker Desktop

1. Get the on-chain module hash — note the Module hash from the IC Dashboard above.

2. Build from source and get the local hash:

   git clone https://github.com/pybara/pybara-settle
   cd pybara-settle
   docker compose build base && docker compose run --rm --build wasm

3. Compare — if the printed hash matches the dashboard, the deployed canister is exactly this source code, byte for byte.

Trade-offs

✅ Guarantee	❌ Constraint
Code cannot be upgraded to steal funds	Cannot patch bugs after blackholing
Commission bounds are enforced on-chain	Cannot add features
Independently verifiable by anyone	New logic requires a new canister version

If a critical bug is found after blackholing, a new canister version would be deployed and merchants migrated to it through a new plugin version release.

Next Steps

• Security Overview
• Responsible Disclosure