Every layer of Escrowr is designed around one principle: neither party should be able to lose funds even if the other acts in bad faith.
Each trade gets a freshly derived HD-wallet TRC20 address. USDT is verifiable on TronScan by anyone. Funds are never co-mingled across trades. The private key for each escrow address is held in the HSM — not accessible to any human operator.
PAN card verification, government-issued photo ID, and video-based liveness check (ISO 30107-3 Level 1). Crucially: the seller's bank account holder name must exactly match their KYC legal name — verified via penny-drop before any trade. This kills the mule-account attack vector.
Private keys never touch application memory in plaintext. All signing operations happen inside a Hardware Security Module. Hot wallet holds maximum 5,000 USDT. Amounts above that auto-sweep to cold storage requiring multi-signature authorization.
Real-time OFAC, UN consolidated, and India PMLA designated entity screening. Velocity limits per KYC tier. Rate deviation >2% auto-blocked. UPI ID reuse across multiple accounts flagged (mule pattern). All flags land in the admin compliance queue with risk scores.
Every state transition — trade creation, deposit confirmation, bank reveal, payment claim, release, dispute — is written append-only to the audit log with actor, timestamp, IP, and device fingerprint. Exported to cold storage daily. PMLA 5-year retention enforced.
No automated dispute resolution. Disputed trades freeze all funds. A compliance officer reviews chain proof, payment screenshots, KYC data, and chat logs. Decision is binding and logged. No algorithm decides fate of real money.
Trade room endpoints rate-limited per user session. KYC upload endpoints scan for malware before storage. File storage uses private signed URLs — proof screenshots are never publicly accessible.
Trade URLs contain only a random token — never account numbers, PAN, or trade amounts. Bank details are never embedded in page source — only fetched after on-chain confirmation via authenticated API.
Content-Security-Policy (CSP) header set to disallow inline scripts from untrusted sources. X-Frame-Options: DENY prevents clickjacking. Referrer policy: strict-origin-when-cross-origin. All external links have rel="noopener noreferrer". Chat input uses textContent (never innerHTML) to prevent XSS.
| Threat | Attack vector | Escrowr's defence | Residual risk |
|---|---|---|---|
| Buyer pays but seller disappears | Seller refuses to confirm after payment | Dispute freezes funds + admin review releases to buyer | Low |
| Seller deposits fake USDT | Send non-standard token to escrow address | Platform only accepts whitelisted USDT contract address on TRC20 | Negligible |
| Mule account bank settlement | Seller uses unrelated person's bank account | Bank account name must exactly match KYC legal name | Low |
| Buyer pays wrong amount | Send ₹1 as "test" or underpay | Amount-exact field required + mismatch flagged to admin | Medium |
| Replay attack on trade link | Reuse a completed trade URL | Each trade token single-use, expires on completion | None |
| XSS via chat input | Inject script via message field | textContent used (not innerHTML) — HTML never rendered | None |
| Clickjacking | Embed trade room in iframe | X-Frame-Options: DENY on all pages | None |
