This was a testnet run.
We were on both sides: our own domain, two of our own wallets, and a price of 1 test USDC. No real money moved. What it shows is the mechanism working against the live .xyz registry, which is the part that is hardest to fake.
Timeline
The deal took 20 hours and 36 minutes, most of it waiting for the move to start. From the registry update to the payout took 1 hour and 33 seconds, almost all of it the challenge window. Times are UTC in October 2026, from Arbiscan's block times and the registry's own record.
| Time (UTC) | What happened |
|---|---|
| 18 Oct, 19:22:49 | The buyer locks 1 USDC.The buyer only signed: their wallet held no ETH, and the relayer paid the gas. Terms: yescrow.xyz, the buyer's registrar Porkbun (IANA 1861), a 10-day transfer window and a 1-hour challenge window.0xc7d2…8777 |
| 18 Oct, 19:23:25 | The seller accepts.yescrow attached a registry proof that the domain was at Spaceship (IANA 3862) at 19:23:23.0x8c5e…a585 |
| 19 Oct, about 14:46 | The move starts.The seller unlocked the domain at Spaceship, and the buyer requested the transfer at Porkbun with the transfer code. The registry showed “pending transfer”.Off-chain |
| 19 Oct, 14:58:04 | The registry records the move to Porkbun.Its record shows a “transfer” event at this time.Registry record |
| 19 Oct, 14:58:20 | The proof passes.The registry showed Porkbun (IANA 1861) at 14:58:18. The contract checked the proof, and the challenge window started.0xc945…543f |
| 19 Oct, 15:58:37 | The seller is paid.The buyer didn't challenge, so the contract paid the seller 0.99 USDC and took the 0.01 USDC fee (1%).0x6847…f09a |
The challenge window was 1 hour because the testnet allows short windows. On real deals it defaults to 72 hours, with a 24-hour minimum, so the buyer has time to check their account.
What decided the payout
Two proofs of the registry's public record. Together they show the domain left Spaceship and arrived at Porkbun after the deal started.
- The source is the registry, not either side. The .xyz registry (CentralNic) publishes each domain's record over RDAP, the successor to WHOIS. The record names the registrar by its IANA ID, which changes when the domain moves.
- The proof shows the record is genuine. A zkTLS proof, signed by Reclaim's attestor, shows the record came from
rdap.centralnic.comover HTTPS, and when. Neither side can edit it, and the contract checks it on-chain. - Anyone can push it through. Anyone may submit the proof, and anyone may pay the seller once the challenge window ends. yescrow's service does both automatically. It checks the registry every 10 minutes; this time it caught the move 16 seconds after the registry recorded it.
| Check | When the seller accepts | After the move |
|---|---|---|
| Domain | yescrow.xyz | yescrow.xyz |
| Registrar | Not the buyer's (Spaceship, 3862) | The buyer's (Porkbun, 1861) |
| Fetched | After the deal was proposed | After the seller accepted |
| Expiry | At least 30 days away | At least 30 days away |
| Status | No pending transfer, pending delete, hold or redemption | The same |
Old data fails. In an earlier test, the registry served a cached record from before the deal, and the contract rejected the proof.
What yescrow can't do with your money
Nobody, including yescrow, can take or redirect money locked in a deal, and yescrow can't freeze it. The contract has no owner, so no key exists that could.
- No admin powers. The contract has no owner, pause, upgrade, proxy or recovery function. Every setting, including the 1% fee, is fixed when it is deployed.
- Fixed payees. Money can only go to the deal's buyer and seller, the fee address, a referrer if the deal names one, or Kleros's arbitration fees. Anyone can trigger a payout once its conditions are met, but no one can change where the money goes.
- The relayer only pays gas. It submits what the parties signed. Its key can't move funds.
- The money doesn't depend on yescrow staying online. If this website and the API went offline, the deal would stay in the contract. Either side could still concede or sign a settlement, and after the transfer window anyone could refund the buyer.
- The code that holds the money is public. Both contracts are verified as an exact match to their source on Arbiscan and Sourcify. Links are below.
Every way a deal can end
Each ending is written into the contract, and most have already run on the testnet.
| If | Then |
|---|---|
| The registry shows the move and the buyer doesn't challenge | The seller is paid when the challenge window ends.This deal. |
| The seller never moves the domain | The buyer gets the full price back after the transfer window.Run on testnet: 0xbc35…9afd |
| The seller backs out | The buyer is refunded at once.Run on testnet: 0x75c6…0656 |
| The domain isn't in the buyer's account | The buyer challenges during the challenge window, and Kleros jurors decide: pay the seller, refund the buyer, or split 50/50.Run on a separate test deployment: the juror ruled that the seller delivered, and the ruling paid the seller. 0x789b…d758 |
| The domain moved but no proof passes | The seller opens a dispute before the transfer deadline, and Kleros jurors decide.Run on testnet as Kleros case #189, then settled by both sides: 0x4219…222f, 0xa4bc…74a2 |
| One side won't pay the arbitration fee | The side that paid wins by default.Run on testnet, where the seller paid and was paid: 0xc637…9d3b |
Until a ruling, either side can concede, or both can sign a settlement.
What this run doesn't prove yet
- Testnet only. Arbitrum Sepolia with Circle's test USDC. No stranger has trusted yescrow with real money yet.
- We were on both sides. We controlled both wallets and both registrar accounts.
- No external audit yet. The contract has unit, fuzz, invariant and fork tests, a 95% coverage gate and a Slither scan. An external audit comes before mainnet.
- The registry shows the registrar, not the account. A seller could move the domain into their own Porkbun account and every check would pass. The challenge window covers this: the buyer checks their account and challenges if the domain isn't there.
- A same-registrar push is weaker. It never shows in the registry record, so its proof is a nameserver change plus the buyer's own check, with a challenge window of at least 72 hours. This deal was a move to another registrar.
- The proof relies on Reclaim's attestor. If it signed a false record, the contract would accept it. The buyer's challenge is the backstop.
- Circle can freeze USDC at any address, including the escrow, as with every USDC contract.
- Payment doesn't end every risk. A transfer dispute can be filed up to 12 months after a sale, and UDRP cases and court orders can take a domain back.
Before mainnet on Arbitrum One: the external audit, and Kleros approving the contract for its mainnet court.
Check it yourself
Every claim above can be checked on sources yescrow doesn't control.
| What | Where |
|---|---|
| Escrow contract 0xaF44…7D46 | Source on Arbiscan · Sourcify |
| Proof verifier 0x64b0…cA30 | Source on Arbiscan · Sourcify |
| This deal | Deal page, every step linked to Arbiscan |
| yescrow.xyz in the .xyz registry | Registry record (RDAP) |
| Registrar IDs: 1861 Porkbun, 3862 Spaceship | IANA registrar list |
| The rules Kleros jurors apply | Juror policy on IPFS |
The contracts and the deal are on Arbitrum Sepolia, the testnet. Checked on 21 Oct 2026.