Duly

Pay-by-link invoicing for freelancers and small businesses. A client pays with whatever token they hold, on whatever chain. The business receives USDC on NEAR, without a wallet app and without buying NEAR for gas. The payment itself closes the invoice on-chain, and in that same step the contract moves the tax share and any subcontractor's share into their own balances.

• Hosted: https://duly.swiftbotlab.workers.dev (test mode with worthless test money: https://duly.swiftbotlab.workers.dev/test/app). The home page and every invoice page read without JavaScript.
• Live on NEAR mainnet: contract dulypay.near, code hash 7jt6GbQnA7VyUGs65Azim73ypuZbBZa2GSKfXHkMQqvj. A real 1.00 USDC payment from Base (0x0429a3f1…) closed its invoice on-chain in the contract (GceCNYM3…) 31.8 seconds after the Base block: no server decides that an invoice is paid. All transactions below.
• Track: Real-World Money (realworld). Built at NEAR HACKATHON.
• Demo video (2:17, narrated): docs/duly-demo.mp4: the 1.00 USDC payment from Base closing its invoice on mainnet, then test mode with a tax share and a subcontractor share split in one transaction, the CSV, and the verifier.

Important
The contract is not audited. Sponsored live invoices run from 0.50 to 25 USDC on purpose. An upgrade key is kept on the contract account during the hackathon, so "no admin" is not claimed. See SECURITY.md.

The problem

A freelancer whose client holds USDT on Tron and who wants USDC has three bad choices: ask the client to bridge, take the wrong token, or wait for a wire. When the money does arrive, three chores remain: working out which invoice it paid, remembering that part of it belongs to the tax office or a subcontractor, and giving the accountant something they can read.

What Duly does

1. You create an invoice and share a link.
2. Your client pays with any major token on any major chain, from a wallet or an exchange.
3. NEAR Intents converts the payment to USDC. The USDC reaches our contract with the invoice number attached, so the payment itself marks the invoice paid.
4. In that same step, your set-asides move into separate balances: for example 20% for tax and 10% to a subcontractor. That money leaves your spending balance before you could spend it by accident.
5. You download a CSV your accountant can open.

For a bookkeeper

CSV columns: Invoice number, Client, Issued, Due, Status, Currency, Invoice total, Tax included, Discount given, Received, Date received, Set aside, Kept in balance, Refunded, Extra paid by client, Shown to client in, Exchange rate, Total in that currency, Paid from, Transaction link.

Proof on NEAR mainnet

Real money on 2026-11-01. Amounts were kept tiny and all of it was ours. Contract dulypay.near, code hash 7jt6GbQnA7VyUGs65Azim73ypuZbBZa2GSKfXHkMQqvj: the SHA-256 of the wasm built in CI from commit 43cc462 with cargo-near 0.22.0 and Rust 1.95.0. The contract code at the tip of this repository is the same; only the repository URL in contract/Cargo.toml has changed since, so the deployed wasm's NEP-330 metadata (contract_source_metadata) still names the old host, github.com/swiftbotlab/duly.

The merchant account was created by the relayer, holds 1 yoctoNEAR (10^-24 NEAR) and never bought gas. Every transaction of the run, including registration, the tax share, the three invoices and the deployment, is listed in evidence/mainnet.md. The 15 that carry the claims (11 on NEAR, 4 on Base) are in evidence/mainnet.js as data, which the verifier below re-checks. The 0.0024 USDC gaps are the NEAR Intents withdrawal fee.

Check it without trusting us (Node 22, no keys, about 15 seconds):

node scripts/verify-mainnet.mjs

See: 25 PASS lines ending in All 25 checks passed. It asks public NEAR archival RPCs and Base RPCs, not our server, for: the code hash; that the merchant holds no NEAR; that the agent's key is limited to two methods; every transaction's signer, status and inner method; the invoice_payment event with closed: true and the set-aside inside the settlement receipt; each USDC transfer on Base; today's invoice state; the 31.8 s; and that the contract holds at least what it owes. nearblocks.io and basescan.org block some automated readers; the same transactions are on api.nearblocks.io (JSON) and Blockscout.

Try it

No account, wallet, passkey or funds are needed for A, C and D.

A. Click through it in a browser, on testnet (about two minutes).

Test mode uses the real contract on NEAR testnet with worthless test USDC. Only the cross-chain conversion is simulated, because NEAR Intents has no testnet.

B. Pay a real invoice with about 10 cents (mainnet, optional). Invoice [1-4](https://duly.swiftbotlab.workers.dev/i/1-4) is open for 0.10 USDC, due 2026-11-30.

The page checks the 1Click quote's signature and every signed field before it shows an address. The first payment closes the invoice; anything paid after that is recorded as extra and stays refundable.

C. See a paid invoice. Open https://duly.swiftbotlab.workers.dev/i/1-3. See: a PAID stamp, 1.00 USDC received, 0.20 set aside, and links to the settlement on NEAR and the payment on Base. Or ask the chain:

curl -s https://free.rpc.fastnear.com -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"query","params":{"request_type":"call_function","finality":"final","account_id":"dulypay.near","method_name":"get_invoice","args_base64":"eyJpZCI6IjEtMyJ9"}}' \
  | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const i=JSON.parse(Buffer.from(JSON.parse(s).result.result).toString());console.log(i.status,"paid",i.paid,"set aside",i.set_aside)})'

See: paid paid 1000000 set aside 200000, which is 1.00 USDC received and 0.20 set aside in the same step.

D. Run the whole loop from a terminal (about one minute).

node scripts/demo-testnet.mjs

See: real NEAR testnet transactions, each printed with an explorer link, ending in All checks passed. It creates a merchant with no wallet and no NEAR, sets a 20% tax jar and a 10% subcontractor share, issues a 100 USDC invoice, pays 40 then 60, checks that the closing payment of 60 was split in its own transaction (12 to the tax jar, 6 to the subcontractor), that the tax jar then holds 20 and the merchant 70, and that the invoice records 30 set aside, refunds an overpayment, attempts to drain the relayer (refused) and prints the CSV row.

Reproduce everything from a clean clone

One command runs every test and check. It needs Node 22 or later, Rust through rustup (rust-toolchain.toml picks the version) and internet access. There is no install step: the JS has no dependencies.

git clone https://code.swiftbotlab.workers.dev/duly.git && cd duly
npm run reproduce            # or, with Node only and no Rust: npm run reproduce -- --quick

It ends with a summary, one line per step, and exits non-zero if anything failed. scripts/positive-controls.sh --network --rust adds two tampered-evidence controls for the verifier and one for the contract. To build the contract wasm: cd contract && cargo near build non-reproducible-wasm --locked (needs cargo-near 0.22.0).

Where the guarantees are in the code

What is real and what is not

How NEAR is used

Architecture

flowchart LR
  C[Client wallet, any chain] -->|deposit address| I[NEAR Intents 1Click]
  I -->|USDC, ft_transfer_call, msg = invoice id| K[Duly contract]
  K --> B[Merchant balance]
  K --> T[Tax jar]
  K --> S[Subcontractor balance]
  M[Merchant browser] -->|signed delegate action| R[Relayer, Cloudflare Worker]
  R -->|pays gas| K
  M -->|ciphertext| D[(Encrypted documents)]
  C -->|reads invoice, verifies quote| K

• contract/: Rust settlement contract. See SECURITY.md for who can do what.
• worker/: relayer, encrypted document store, payment notices, the collections agent, and the server-rendered home and invoice pages.
• web/: the app, with no build step.
• evidence/: the mainnet and testnet runs, with every transaction.
• mock-usdc/: a worthless test token, used on testnet only.

Collections agent

The agent is plain rules on a timer, with no language model. It works from public chain state, so it never sees client names. node scripts/demo-agent.mjs (about three minutes) shows it on testnet: a merchant sets limits on-chain (at most 3% off, sweep to one named account, keep 2 USDC) and then asks for 10% in the agent's off-chain rule; an invoice goes overdue and the agent offers 3%, because the contract's cap wins; after the client pays, it sweeps the balance down to the floor.

What it costs to run

Measured on mainnet: an invoice costs the relayer about 0.0063 NEAR, roughly $0.03, and the merchant nothing. Duly charges no fee today. A 0.1% fee would cover that on any invoice above about $30.

Limits

• The contract is unaudited. Sponsored live invoices run from 0.50 to 25 USDC for now: the app refuses less, because NEAR Intents will not convert much less than 0.15 USDC on some routes and 0.50 clears every route we offer. The public samples 1-1 (0.25) and 1-4 (0.10) were issued by script below that floor on purpose, so anyone can try a real payment for cents. A payment that small converts only where the route minimum is lower, so 1-4 takes USDC on Arbitrum, Optimism, Polygon, Gnosis or NEAR, and not on Base or Ethereum; the headline Base payment is invoice 1-3, 1.00 USDC.
• An upgrade key is kept on the contract account during the hackathon, so "no admin" is not claimed. The agent account also has a full-access key, kept offline; the Worker holds only the function-call key.
• Passkey sign-up was tested in Chrome with a virtual authenticator that supports PRF, not on a physical phone.
• The wasm is built with non-reproducible-wasm, so the code hash is not claimed to be rebuildable byte for byte on another machine. The deployed contract's contract_source_metadata link still points at the old source host; it changes with the next deploy.
• A failed payout returns to the merchant's account on NEAR Intents, and moving it from there needs custom tooling. See SECURITY.md.
• A refund comes out of the merchant's available balance. A share already paid to a subcontractor is not pulled back.
• Duly stops at USDC. Getting to a bank account means withdrawing to an exchange or off-ramp the business already uses.
• A client's refund address is typed or taken from their wallet. If they pay from an exchange, it must be an address they control.
• The relayer's key is a full-access key, because NEP-366 wrappers cannot be sent with a function-call key. Its balance is kept small and its daily spend is capped.

AI tools

The code, tests, scripts and docs were written with Claude Code (Anthropic's coding assistant) under our direction. The product, the contract design, the security limits and every mainnet run are ours, and the claims rest on checks anyone can run: npm run reproduce (109 JS and 74 contract tests) and node scripts/verify-mainnet.mjs (25 checks against public RPCs). Duly calls no AI model at runtime; the collections agent is plain rules on a timer.

Libraries

Prior work and disclosures

• Baseline (Q-001, Q-002, Q-005): none of this code predates the hackathon. The first commit is 772037c on 2026-11-01 at 12:05 UTC, and every commit since is part of the submission. There is no earlier product on another chain. The files in web/vendor are unmodified releases of the third-party libraries above; nothing else is reused.
• Second project (Q-015): this team's second project is near-toll-audit. The two are independent and share no code.

License

MIT. See LICENSE.