AsterRail: an escrow payment rail for freelance work

Freelancers who work for overseas clients lose money and time on every payout, and neither side can trust the other on delivery. AsterRail is an escrow payment rail: the client locks the agreed amount in a Soroban smart contract on Stellar, the freelancer delivers, and the contract releases the funds — settling in seconds, for a fraction of a cent, with a cryptographically verifiable receipt. This paper covers the problem, the design, the contract, the security model, the business model, and the roadmap.

The monetizable pain in freelancing is the payment rail. A freelancer billing an overseas client loses 5–7% plus a poor FX spread to PayPal, Wise or banks, waits 3–5 days, and risks account freezes in “high-risk” regions. Centralized freelance platforms add 10–20% on top just to hold the money — and they own the escrow that is supposed to protect both sides.

Trust is also one-sided: the freelancer works without knowing they’ll be paid; the client pays without knowing they’ll get delivery. Discovery (new builders buried by search) is a real but secondary problem.

AsterRail replaces the intermediary with a Soroban smart contract. On a deal, the client locks the agreed amount in escrow; on delivery they release it and the contract itself pays the freelancer. Settlement is near-instant, network fees are about $0.00001, and no one ever holds the funds in between.

Deals settle in USDC (stable value) or native XLM, and every deal produces an invoice and a paid receipt carrying the on-chain transaction hash — a proof of payment no Web2 tool can forge. A swipe-based discovery layer helps the two sides find each other, but the rail is the product.

• Lock. The client locks the budget in the escrow contract (init), signed in their own wallet.
• Deliver. The freelancer does the work. The funds sit in the contract — not with AsterRail, not with the client.
• Release. The client confirms delivery (release); the contract pays the freelancer and the invoice becomes a verifiable paid receipt. A client can instead refund before delivery.

Two doors lead into the same rail: a direct deal for a freelancer you already know (works at zero liquidity), or post a job and match by skill fit.

The chain is the source of truth only for money and escrow state. Everything else — profiles, jobs, matching, invoice metadata — is off-chain, because putting it on-chain would be costly, slow, un-queryable and bad for privacy.

• Contract — Rust + soroban-sdk. One deployed instance holds many deals, each keyed by a deal id.
• Backend — Go + PostgreSQL: profiles, jobs, matching, and mirrored deal/invoice metadata. It never holds private keys.
• Frontend — Next.js: the user’s wallet signs every transaction in the browser, and the UI reads authoritative deal state from the chain.

The contract is a minimal, auditable state machine. Each deal moves Funded → Released or Funded → Refunded, and funds may leave the contract exactly once. Key properties:

• Multi-deal, isolated. Deals are keyed by id; settling one can never touch another’s funds.
• Client-authorized. Only the deal’s client can release or refund it (require_auth).
• Upgrade-only admin. The admin can ship a new contract build to fix or extend the protocol, but never holds custody of funds. Stricter upgrade governance (timelock / multisig) is on the roadmap.
• Guarded. Re-init, non-positive amounts, and double-settle are all rejected; amounts are exact i128 units.

The contract is token-agnostic (any SEP-41 token). Deals settle in native XLM or USDC, chosen per deal; both use 7 decimals on Stellar. USDC removes exchange-rate risk between lock and release. Because USDC is a classic asset, a freelancer enables USDC payouts once (a trustline) before receiving it — a one-tap step in their profile.

The escrow holds real money, so the contract is treated as the crown jewel: minimal surface, immutable per-deal isolation, an upgrade-only admin (never custody of funds), and a third-party audit on the roadmap.

• Signed API. State-changing calls require a wallet-signature session and must belong to the acting party; unsigned or forged calls are rejected.
• Verified receipts. A paid receipt is only stamped after the backend confirms the release transaction succeeded on-chain.
• Chain-authoritative UI. The app reads deal state from the contract, not just the database mirror.

A 1% protocol fee is taken inside the contract on release — trustless, and charged only when a deal completes (refunds are free). That is 20× cheaper than Fiverr (20%), 10× cheaper than Upwork (10%), and well under PayPal (5–7%); it is sustainable because Stellar network fees are negligible. Future revenue: premium tiers for agencies, an arbiter-fee share, and anchor/FX revenue-share.

Beachhead: Web3 builders who already hold wallets — zero onboarding friction, and “why blockchain” answers itself. TAM: every cross-border freelancer, including Web2 workers who feel the payment pain most but don’t have a wallet — unlocked later by “invisible crypto” (passkey smart accounts + anchor cash-out to local currency), where they never see the words “blockchain” or “USDC”.

The core payment rail — dual-token settlement, invoicing, wallet-signature security, multi-wallet support, and direct deals — is built and independently verified on-chain. Next comes richer product UX, on-chain-anchored job posts, in-app messaging, and progress pipelines; then milestone escrow, a staked-arbiter dispute path, on-chain reputation, AI matching, and onboarding for non-crypto freelancers. The full, living plan lives on the roadmap page.

AsterRail is live on Stellar mainnet with a working escrow protocol whose lock-and-release flow is verified on-chain. Next on the path is a third-party security audit— see the roadmap for the full plan.