ArcFX is non-custodial by design. We never hold your funds, never store your private keys, and every transaction is verifiable on-chain. Here is exactly how it works.
ArcFX is a frontend interface that connects your wallet directly to two smart contracts on Arc. There is no ArcFX server involved in transaction execution. When you make a payment, the flow is:
Your wallet → ArcFXPayments.sol → Recipient wallet
The smart contract deducts 0.15% to the treasury address and forwards the remainder to the recipient — all in one atomic transaction. If any step fails, the entire transaction reverts. You cannot lose funds to a partial execution.
For batch transfers via Multisender: Your wallet → ArcFXMultisender.sol → Up to 500 recipient wallets
Executed in a single on-chain transaction. The contract validates all recipients before execution begins.
ArcFX keeps your in-app data — your address book, saved invoice details and logo, and any scheduled payouts — entirely in your browser's localStorage; it never leaves your device, and invoice PDFs and receipts are generated client-side. The one exception: if you create a developer API key, we store the email address you provide and the request IP for that issuance, solely to issue the key and prevent abuse. We don't collect personal data beyond that.
The only data ArcFX reads from external sources is your on-chain transaction history, fetched directly from Arc Testnet RPC and ArcScan. This is public blockchain data, the same data available to anyone with your wallet address.
ArcFX does not use cookies, tracking pixels, or analytics beyond what is strictly necessary for the application to function. There is no advertising, no user profiling, and no data sold to third parties.
Our contracts are open source — browse the contract code at github.com/Qazza1/arcfx-contracts. We encourage security researchers to review the code. Responsible disclosure of any vulnerabilities should be sent to security@arcfx.app.
Security testing to date. Ahead of the formal audit, we run our own testing as part of development: static analysis with Slither (Trail of Bits) and property/fuzz testing with Foundry. Findings from this internal review — including checked ERC-20 return values, a Checks-Effects-Interactions ordering pass, and a pinned compiler version — have been remediated in source and are slated to ship in the audited contracts deployed for mainnet. The current Testnet contracts are an earlier build; this internal testing is not a substitute for the independent third-party audit below.
A formal audit from a reputable security firm is planned prior to Arc Mainnet launch. Audit reports will be published publicly.