Settle Canister

Pybara routes all payments through a settle canister — an Internet Computer smart contract whose code is permanently immutable and publicly verifiable.

What Is a Settle Canister?

On the Internet Computer, every canister has one or more “controllers” — principals that can upgrade code, change settings, or delete the canister.

A settle canister satisfies all three of these conditions:

Has 0 controllers, controls itself, or is controlled by another blackholed canister
Contains no code that would allow anyone to upgrade its WASM binary
Is open source with a reproducible build so anyone can verify point 2

Once blackholed, no one — not even Pybara — can change the code.

Source: IC docs

The Pybara Payment Splitter

Canister ID: c5fxy-6qaaa-aaaar-qcazq-cai
Status: Blackholed — controlled only by the CycleOps Balance Checker, itself blackholed

Every payment and donation goes through this canister. It:

Receives the buyer’s deposit in a subaccount of its own, derived from the payee’s account and a random per-order value. The deposit is therefore bound to whom it pays: no one can redirect it, and settle splits it only once.
Checks the deposit on the token’s ledger, then splits it: Pybara’s commission, out of which the network fees of both transfers are paid, to Pybara; the rest to the merchant’s or recipient’s account.
Forwards a log entry to Pybara’s records, retried until it is received.

Recurring donations work the same way, except that the tokens are pulled, under the allowance the donor approved, by Pybara’s subscription canister, the only one allowed to request them.

Each merchant’s own rate within those bounds is recorded by Pybara at registration, and a payment made at a different rate is detected.

If a Transfer Fails

Every way out for the funds settle holds works without a controller. A payout or commission transfer that fails is queued and retried automatically, and anyone can retry it at any time; the funds stay reserved in their deposit’s subaccount until then. Tokens sent to settle by mistake can be recovered only to a recovery address fixed in its code. The one case settle cannot release is an amount too small to pay its two transfer fees, which the checkout never lets a buyer send.

Trade-offs

✅ Guarantee	❌ Constraint
Code cannot be upgraded to steal funds	Cannot patch bugs after blackholing
Commission bounds are enforced on-chain	Cannot add features
Independently verifiable by anyone	New logic requires a new canister version

If a critical bug is found, a new canister version would be deployed and merchants migrated to it through a new plugin version release. The current canister keeps running alongside it, for the recurring donations already approved to it.

Verify It Yourself

Anyone can check that the canister is blackholed and runs exactly the published source code. Prerequisite: Docker Desktop, for step 3.

Check the controllers — on the IC Dashboard, Controllers must be cpbhu-5iaaa-aaaad-aalta-cai alone: the CycleOps Balance Checker, itself blackholed (0 controllers, open source, verifiable). A canister controlled solely by a blackholed canister is itself immutable.
Note the module hash — the Module hash on the same page. The canister’s full status, cycles and memory included, is public too: icp canister status c5fxy-6qaaa-aaaar-qcazq-cai -n ic.
Build from source and compare — the WASM is built deterministically via Docker, so the same source always produces the same binary:
Terminal window
```
git clone https://github.com/pybara/pybara-settle
cd pybara-settle
docker compose build base && docker compose run --rm --build wasm
```
If the printed hash matches the dashboard’s, the deployed canister is exactly this source code, byte for byte.
Check the code cannot change itself — a canister can still be changed by its own code, if it asks the Internet Computer to install new code or add a controller. The repository’s README shows how to confirm that settle never does: every canister it calls is a token ledger or Pybara’s records, with the methods it declares.