Implementation Status¶
This whitepaper describes a complete architecture. Not all of it is built. This page is the honest map of what runs today, what is specified and designed, and what is deferred, so that nothing below reads as a claim it is not.
Implemented runs in the live demo · Designed specified, interface-complete, not all wired · Planned on the roadmap, not started
The live demo¶
A working demonstration runs on Base Sepolia (a public test network) at dapp.sbxaura.com. It uses test tokens and sponsored gas; no real money is involved. It exists to prove the core flows end to end for an investor and partner audience, not to hold customer funds.
| Property | Value |
|---|---|
| Network | Base Sepolia (chain ID 84532) |
| Account standard | ERC-4337 v0.7 (EntryPoint 0x0000000071727De22E5E9d8BAf0edAc6f37da032) |
| Signer | Privy embedded wallet |
| Bundling | Self-bundled, the app calls EntryPoint.handleOps directly |
| Currencies | Test USDC / EURC / GBPT |
Contract kernel¶
| Component | Status | Notes |
|---|---|---|
AuraAccount (ERC-4337 + ERC-7579) |
Implemented | Holds funds; delegates policy to modules |
AuraAccountFactory (CREATE2) |
Implemented | Deterministic, counterfactual addresses |
AuraSecurityManager (hook) |
Implemented | The authentication ladder, enforced in the execution phase |
AuraPayeeRegistry |
Implemented | Per-account trust state; names never on-chain |
| Owner / co-sign validators | Implemented | Signature verification |
AuraPaymaster |
Designed | Verifying paymaster + budgets + breaker; demo falls back to a per-account gas deposit |
AuraPasskeyValidator (WebAuthn P-256) |
Designed | Passkey as an independent second factor |
AuraSessionKeyValidator |
Designed | Scoped, expiring, capped keys, the Tier-0 path |
AuraRecoveryModule |
Designed | Timelocked owner rotation; guardian verifier behind a stable interface |
AuraComplianceRegistry |
Planned | Attestation check now; ZK verifier slot for Phase 4 |
Services & intelligence¶
| Component | Status | Notes |
|---|---|---|
| Relayer / self-bundling | Implemented | Untrusted by design, submits, never authorises |
| AURA Guard, format, network detection, checksum | Implemented | Deterministic; EVM + Tron (base58check) + Solana |
| AURA Guard, sanctions / risk band | Designed | Provider-backed; fails closed |
| Indexer, ledger, statements, date-range reconciliation | Implemented | Rebuilt from chain; binary-search block resolution |
| Second-factor co-signature service | Designed | Releases a co-signature; never triggers execution |
| AI Concierge / Navigator | Planned | Read-only; holds no signing key |
What must be true before real money¶
Real deployment is gated on the checklist in the threat model: an external audit of the full suite, invariant and fuzz tests for all seven contract invariants, fork tests against real Base token contracts, the escape hatch tested end-to-end with every AURA service offline, paymaster abuse testing, a decided-and-modelled recovery scheme, an incident-response runbook, and a live bug bounty before mainnet.
Not for real funds
The contracts are unaudited. The demo is testnet only. Do not send mainnet assets to any address derived from this system.