Skip to main content
Four kinds of contract sit behind the payment path: the test asset everything settles in, the x402 prerequisites Tokscale had to deploy, the upstream contracts it verifies without deploying, and GIWA’s own ecosystem contracts it only reads.

​
tUSD, the test payment asset

Tokscale Test USD (symbol tUSD) is the asset all x402 flows settle in.
  • ERC-20 with 6 decimals, mirroring USDC’s decimal shape.
  • An EIP-3009 subset: transferWithAuthorization, authorizationState, and the AuthorizationUsed event, which is the exact surface the x402 exact scheme needs. It deliberately implements neither EIP-2612, Permit2, nor upto.
  • A permissionless faucet: one call mints exactly 1,000,000 tUSD. A test convenience on a test asset.
  • An EIP-712 domain bound to the active chain ID and the deployed address, so the domain separator rebuilds if the chain ID ever changes. A signature from another chain fails, and tests prove it.
tUSD is a test-only token for x402 research on GIWA Sepolia, not a stablecoin. A generic tUSD transfer is never interpreted as a credit top-up: crediting requires a persisted intent plus the full reconciliation evidence chain described in x402 Payments on GIWA.

​
Why a shared chain ID cannot authorize a deployment

tUSD is created by a factory inside a single top-level transaction at a fixed CREATE2 salt, so its address is deterministic. The deploy path is deliberately local-only. It accepts only a freshly reset Anvil chain with chain ID 91342, the fixed genesis timestamp 1700000000, and Anvil’s standard prefunded deployer sentinel, and it rejects every chain that fails any part of that local-genesis invariant. The invariant exists precisely because public GIWA Sepolia shares chain ID 91342: a chain ID match alone must never authorize a deployment. The public Sepolia deployment is a separate and separately recorded act. The same reasoning governs the whole system rather than just deployments; see Network Separation.

​
Pinned upstream bytecode

Nothing upstream is trusted by name. Each external dependency is pinned to an immutable archive revision with its hash recorded, rebuilt independently under its own compiler boundary, then compared byte for byte against what is actually deployed or preinstalled on chain. Editing a recorded hash cannot bless a changed tree, and no part of the check contacts GIWA RPC or sends a transaction. That covers Uniswap Permit2 (whose observed preinstall runtime must match the rebuild), the x402 Upto proxy and the frozen Exact proxy artifact, EAS with OpenZeppelin, the unmodified giwa-io/dojang writer graph, the ERC-6492 UniversalSigValidator, and Multicall3. Each is rebuilt under the compiler version its upstream used, because a different version produces different bytecode from identical source. This is what makes the deployments checkable rather than merely asserted: a canonical CREATE2 address reproduced independently, plus a runtime code hash matching the pinned rebuild, binds the deployed code cryptographically to both its source and its address.

​
What is on GIWA Sepolia

Tokscale deployed tUSD and its factory, the x402 Upto and Exact Permit2 proxies, and the ERC-6492 validator. It verified without deploying: Permit2 and the Arachnid CREATE2 deployer as OP Stack preinstalls, Multicall3 at its canonical address, and the EAS predeploys the attestation path uses. Every address, with its deployment transaction and block, is listed once in The Public Chain. GIWA’s own Dojang contracts, DojangScroll 0xd5077b67…F17B9 and DojangAttesterBook 0xDA282E89…B28B6, are GIWA-operated ecosystem contracts rather than Tokscale deployments. Tokscale reads them, and mirrors their upstream source for local proofs only. See Dojang.

​
Evidence

Solidity is one of the three independent implementations that must reproduce the protocol vectors, alongside Rust and TypeScript: it recomputes the receipt digest, the merkle leaf and root, and the summary commitment on-chain, then compares them against the other two. An offline suite also covers the tUSD surface, the EIP-3009 authorization flow with its expiry and replay errors, and cross-chain signature rejection. The offline suites, including the upstream hash checks and every local contract test, run under one target:
The tUSD deployment is re-checked against public GIWA Sepolia by a read-only target that sends no transaction:

​
Next steps