Oneliq Documentation

The engineering reference for the unified stablecoin terminal on Arc. Oneliq puts Circle's stablecoin stack - Gateway, CCTP V2, Programmable Wallets, USDC, EURC - behind a single non-custodial UI on the Arc Layer 1. This guide covers every live product surface, the on-chain contract registry, the proxy API, and the security baseline.

Introduction

Oneliq is a unified stablecoin platform that simplifies how people use USDC across chains. Built on Circle's infrastructure and designed for the Arc Layer 1, Oneliq brings trading, cross-chain balance management, automation, and onboarding into one seamless experience. Six surfaces, one balance, zero custody:

Who is this for?

• Stablecoin holders tired of fragmenting USDC into seven balances across seven chains.
• Multi-chain treasurers who want one place to see, move, and automate USDC across the Circle ecosystem.
• Arc-native traders swapping USDC ⇄ EURC inside the L1 with sub-second finality and predictable USD-denominated gas.
• Agent operators who want sign-once / run-forever USDC plumbing - auto top-ups, scheduled payouts - across any of 8 Circle-supported chains.
• Builders using Oneliq as a reference implementation for Circle Gateway, CCTP V2, App Kit Swap, and Programmable Wallets integrations.

Design principles

• Custody never leaves you. Oneliq holds no funds and has no admin path that can pause your access. Every state-changing call is signed by your wallet against a third-party contract.
• No build pipeline. The frontend is plain HTML/CSS/vanilla JS plus ethers.js v6 - every served byte is reviewable, every CDN script is SRI-pinned.
• Strict CSP, locked CDNs. Every page ships with a Content-Security-Policy. The only third-party origins reachable are the RPCs, the Circle endpoints we explicitly trust, and Cloudflare's own cookieless analytics beacon.
• Reads through proxies. Reads to Circle's Gateway and IRIS APIs route through Cloudflare Pages Functions to keep the browser's connect-src tight and to dodge CORS quirks.

Architecture

Oneliq is a thin frontend over Circle's stablecoin stack and the Arc Layer 1. We deploy exactly two small contracts on Arc - OneliqRouter (the swap fee router) and OneliqCheckIn (Portal check-ins) - and neither can hold your balance. Everything that moves value is Circle's. What lives on our origin is static HTML, a few KB of shared JavaScript, a handful of stateless proxy routes, and two Cloudflare Workers.

# Oneliq layered architecture
┌─ UI Layer ────────────────────────────────────────────────────────────┐
│  index · trade · balance · agent · portal · history · dashboard       │
│   plain HTML + CSS + vanilla JS, no framework, no build step          │
└────────────────────────────────────────────────────────────────────────┘
                                  ↓
┌─ Shared JS modules (assets/) ─────────────────────────────────────────┐
│  arc-core.js       → chain registry, token registry, ABIs, RPC      │
│  arc-gateway.js    → Circle Gateway client (deposit, transfer, mint)│
│  arc-appkit.js     → Circle App Kit wallet picker (EIP-6963)        │
│  arc-ui.js / .css  → shared UI atoms (modal, toast, skeleton, nav)  │
└────────────────────────────────────────────────────────────────────────┘
                                  ↓
┌─ Cloudflare Pages Functions (proxies, agent, AI, Portal) ─────────────┐
│  /api/circle-proxy/*   → CCTP V2 IRIS attestation API                 │
│  /api/gateway-proxy/*  → Circle Gateway public REST API               │
│  /api/agent/*          → register / list / pause / revoke agents      │
│  /api/ai/*             → Oneliq AI chat on Workers AI                 │
│  /api/history/*        → per-wallet Trade / Balance receipts          │
│  /api/recipients/*     → saved payees for Batch Pay                   │
│  /api/metrics/*        → aggregated read-only telemetry rollup        │
│  /auth/*               → Portal check-in, points, streaks, leaderboard│
└────────────────────────────────────────────────────────────────────────┘
                                  ↓
┌─ Cloudflare Workers (scheduled) ──────────────────────────────────────┐
│  agent-cron       → scans rules, fires Programmable Wallet executions  │
│  kv-backup        → nightly KV snapshot of profiles and history        │
└────────────────────────────────────────────────────────────────────────┘
                                  ↓
┌─ External protocols (we don't operate any of these) ──────────────────┐
│  Arc L1                  → EVM execution + USDC native gas               │
│  Circle Gateway          → GatewayWallet / GatewayMinter + REST API      │
│  Circle CCTP V2          → TokenMessenger / MessageTransmitter + IRIS    │
│  Circle App Kit Swap     → same-chain USDC ⇄ EURC routing on Arc         │
│  Circle Programmable     → smart-account executor + Paymaster gas        │
│      Wallets               sponsorship for the agent                     │
└────────────────────────────────────────────────────────────────────────┘

What "non-custodial" means in practice

• Every state-changing user action is a transaction signed by your wallet - against Circle's Gateway, CCTP, or the Curve pool, or against one of our two published contracts.
• Oneliq has no privileged role on any Circle or Arc contract: no owner, no admin, no upgrade path.
• Of our own two, OneliqCheckIn is fully immutable - no owner, no admin, and it moves no funds. OneliqRouter does have an owner, deliberately limited to two things: changing the swap fee (hard-capped at 1% in the bytecode, currently 0.30%) and withdrawing the fees the router has collected. It cannot touch a user balance, because it only holds the USDC in flight inside the swap transaction itself. Read the verified source on the Arc explorer.
• The agent runner moves funds only along the rules you signed, via a Circle Programmable Wallet you authorized via EIP-2612 permit. You can pause or revoke any agent in one click - that yanks the permit and stops every future execution.
• The proxy routes (/api/*) only reformulate read requests to Circle's public APIs. They cannot move funds, sign messages, or hold custody.

Quick start

From a fresh browser to your first cross-chain USDC spend in five steps.

1. Install a wallet. MetaMask, Rabby, Coinbase Wallet, Frame, or any EIP-6963-compliant browser wallet. See Supported wallets.
2. Add Arc Testnet. Open oneliq.xyz/trade, click Connect, and approve the network prompt. Manual params are in the Network info table below.
3. Get testnet USDC. Use the Circle faucet on your address. Arc uses USDC as native gas, so one faucet drip covers both spending and gas fees. The same USDC works for Trade, Balance, and Agent.
4. Open Balance. Deposit USDC from any supported chain (Sepolia, Base, Fuji, Arbitrum, OP, Polygon, Unichain) into the Gateway. Your unified balance updates in seconds.
5. Spend from Balance. Pick a destination chain and recipient. Multi-source unified spend pulls from N chains in one signature and mints native USDC on the destination. Trade is the surface for swapping and bridging instead.

Wallet setup

Oneliq uses EIP-6963 for wallet discovery - the multi-injector standard that replaced the old window.ethereum singleton. Any wallet that announces itself via eip6963:announceProvider appears in our wallet picker, ranked by RDNS so the choice is deterministic when multiple wallets are installed.

Once connected, the session is held entirely in browser memory. There is no auth cookie, no JWT, no session token issued by Oneliq.

Adding Arc Testnet manually

If your wallet doesn't auto-prompt or you prefer to add the network by hand:

Get testnet USDC

Arc Testnet uses USDC as the native gas token. You need USDC for both transaction fees and for whatever you want to do with it (deposit, swap, agent funding). One faucet call covers both.

1. Visit faucet.circle.com.
2. Select Arc Testnet from the network dropdown.
3. Paste your wallet address - delivery is typically under 30 seconds.
4. Faucets are rate-limited per-address per-day. If you hit the limit, come back tomorrow or grab USDC on Sepolia / Base / Fuji and use Unified Balance to make it spendable on Arc.

Trade

The /trade page is the spend surface. It unifies same-chain swap (USDC ⇄ EURC on Arc via OneliqRouter into Circle's Curve pool) and cross-chain bridging (USDC anywhere via CCTP V2) into a single panel. Source picker shows your wallet balances plus your Circle Gateway pre-deposits, ranked so the path with the lowest friction floats to the top.

Same-chain swap (Arc internal)

USDC ⇄ EURC swaps on Arc route through our own OneliqRouter contract, which forwards the trade into Circle's Curve StableSwap pool and takes a transparent 0.30% on-chain protocol fee (hard-capped at 1%). Circle App Kit Swap remains integrated for quoting/routing. Quote latency is debounced at 150 ms on the source-amount input.

Cross-chain spend (CCTP V2)

1. Choose source chain and destination chain (any pair from the 8 supported).
2. Enter USDC amount and recipient address (defaults to your own).
3. Pick a finality mode - Fast (~20 s, small Circle fee) or Standard (13–19 min, zero fee).
4. Burn on source - calls TokenMessengerV2.depositForBurn(amount, destDomain, recipient, burnToken, ...).
5. Wait for Circle's IRIS attestation, then mint on destination - calls MessageTransmitterV2.receiveMessage(message, attestation). Oneliq submits the receive automatically when the attestation arrives.

Trade panel features

• Source picker. One dropdown - wallet on any chain or Circle Gateway pre-deposits - ranked by available balance.
• Slippage. Default 0.5%. Presets 0.1% / 0.5% / 1% / custom (hard cap 5%).
• Route box. Shows rate, price impact, network fee, min received, ETA.
• Resumability. A burn tx hash is the only thing needed to mint on the destination later. Close the tab mid-flight, return to /trade with the same wallet - the pending mint appears automatically.
• Park the output. When the swap or bridge lands plain USDC in your own wallet, the route offers an extra step that deposits it straight into your Unified Balance. It costs one more transaction and Circle needs finality before the funds count as spendable, so it saves a context switch rather than gas. Offered only when you are the recipient - deposit() credits the sender, so parking a third-party payment would credit the wrong person.
• Activity rail. Live tx ledger on the right - last 10 actions deep-linked to per-chain explorer.

Unified Balance

The /balance page is the centerpiece of Oneliq. It uses Circle Gateway V1 to give you a single USDC balance that's spendable on every supported chain - no bridge clicks, no chain switching, no wrapped tokens.

How it works

Each Gateway-supported chain has a GatewayWallet contract at the same deterministic address (CREATE2 with the same salt). You deposit USDC into the wallet on whichever chain you currently hold it. Circle's Gateway service issues attestations that authorize a fresh mint of native USDC on the destination chain - the USDC you spend is always native USDC, not a wrapped derivative.

Deposit flow

1. Select a source chain with a USDC balance (Sepolia, Base, Arbitrum, OP, Polygon Amoy, Fuji, Unichain).
2. Approve the GatewayWallet to pull USDC (one-time per chain per token).
3. Deposit - your USDC moves from your wallet into the GatewayWallet contract on that chain.
4. Done. Your unified balance updates in seconds (Fuji ~30s, Sepolia ~12-15 min). Spendable everywhere Gateway is supported.

Spend flow (mint on Arc)

1. Submit an EIP-712 signed burn intent to Circle's Gateway service via POST /v1/transfer.
2. Gateway validates available balance across all your deposits, signs an attestation.
3. Your wallet calls GatewayMinter.gatewayMint(attestation, signature) on the destination chain.
4. Native USDC appears on the destination, ready to spend or hold.

Spend: three modes

The ↗ Spend modal lets you choose how the source funds are allocated. You enter a recipient, an amount, and a destination chain; the mode decides where the USDC comes from.

In every mode, a partial-liquidity route that spans several chains is still a single EIP-712 signature: one BurnIntentSet → one attestation → one mint on the destination. No popup-per-chain.

Estimate before you sign

Before the wallet popup, Oneliq shows the route, the per-intent fee, and the recipient outcome via ARC.gateway.estimateSpend(). Cost is visible up front. When a spend can't be fully covered, the UI names why - insufficient balance, no viable route, or needs aggregation across sources - instead of a generic error.

⇉ Batch Pay

Batch Pay sends USDC to many recipients from one Unified Balance. Each recipient has its own address, amount, and destination chain. Oneliq runs a non-overlapping allocation across your balances so no chain's funds are double-spent, then groups recipients by destination chain: one signature per destination. Recipients that all land on the same chain settle in a single signature; a payout spanning K destination chains becomes K signatures, one click each. Built for payroll, contributor payouts, or fanning funds out to a set of wallets.

Rows can be typed one at a time or pasted in bulk - address, amount, chain per line, with the chain column optional. Everyone you successfully pay is remembered in a recipient book stored against your wallet address, so the list follows you to another browser or device instead of living in one browser's storage.

⤵ Consolidate

Consolidate is the mirror of Batch Pay. It sweeps your entire spendable balance from every chain except a chosen destination onto that one chain, in a single signature, minting back to your own wallet. It reuses the Auto-spend engine with the recipient set to you. Chains whose balance is too small to clear their per-intent fee floor are skipped automatically (and listed in the preview) rather than failing the whole sweep. Use it to tidy dust across chains or stage liquidity where you need it next.

If you close the tab mid-transfer

A forwarded spend is recorded locally the moment it is submitted, together with the attestation needed to finish it. Reconnect the same wallet and Oneliq re-checks the transfer with Gateway: already minted, it just clears the record; still pending, it waits for the forwarder and falls back to a self-mint if that fails. Terminal outcomes (failed or expired) are cleared rather than retried forever.

Withdrawals

Withdrawals are two-step. You initiate a withdrawal on the source chain, which queues it through Gateway's safety delay (~minutes on testnet). Then you finalize to receive USDC back in your wallet. The pending list shows everything in flight with countdown timers.

Direct deposits on Arc

Arc's USDC is the native gas token, which lives in the L1 ledger rather than in an ERC-20 wrapper. GatewayWallet.deposit relies on standard approve/transferFrom, which can only move ERC-20 balances, so direct deposits from Arc are disabled. To fund Arc, deposit from any other supported chain and let Gateway mint native USDC on Arc.

Oneliq AI PREVIEW

The /agent page is Oneliq AI: a chat assistant on the left, a config panel on the right. Describe what you want in plain language and the assistant fills in the rule for you. It also answers questions about your holdings and can prep a USDC ⇄ EURC swap right in the conversation. The AI never moves funds on its own - it prefills; you review and sign every action.

Under the chat is the same autopilot engine, in three modes: Auto Top-Up (keep a target wallet above a floor), Scheduled Send (recurring USDC transfers across chains and wallets, once/daily/weekly/monthly), and Recurring Buy (a USDC ⇄ EURC swap on a cadence, delivered to your own wallet). All three run on Circle Programmable Wallets with Circle Paymaster-sponsored gas - you sign once, the agent runs on its own, and you can pause or revoke at any moment.

Chat interface

The assistant is powered by Cloudflare Workers AI (served through /api/ai). Ask it to "top up my ops wallet whenever it drops below 50 USDC" or "send 100 USDC to this address every Monday" and it populates the config panel with the matching rule. Nothing is authorized until you confirm and sign - the chat is an input method, not an executor.

It also handles one-off actions without leaving the conversation. "Swap 5 EURC to USDC" renders a live quote card with a Confirm button; "send 20 USDC to 0x… on Base" renders a route and fee card for a cross-chain spend out of your Unified Balance. Both are still signed by your wallet. The agent itself only reads your unified balance - it cannot spend it, because a burn intent is signed for one fixed amount and there is nothing an unattended cron could reuse. When a rule's wallet-side funding looks thin, the pre-flight says how much is parked in Gateway and that you need to move it first.

How it works

1. You sign once. One EIP-712 typed signature defines the rule (floor, refill amount, daily cap, target chains). One EIP-2612 permit authorizes the agent's Circle Programmable Wallet to pull USDC from your wallet via transferFrom.
2. Agent watches. A Cloudflare cron Worker scans active rules every minute. When a target wallet drops below its floor (or a scheduled time arrives), the rule fires.
3. Funds move. The agent's smart account assembles a userOp - USDC pull, optional CCTP V2 burn-and-mint to the destination chain (~30s fast finality), final delivery to the target wallet. Gas is sponsored by Circle Paymaster, so the user pays nothing in their gas token.
4. Pause / resume / revoke. One-click in the agent drawer. Revoke yanks the permit; every future execution fails closed.

Safety rails

• Daily safety cap. Hard upper bound on USDC the agent can move in any rolling 24h window. The agent will not exceed it, ever.
• Auto-pause after failures. 5 consecutive execution failures (RPC outage, balance drained, etc.) auto-pause the agent. You're notified, fix the issue, resume manually.
• Revoke wipes future risk. Revoke removes the permit on-chain. The agent literally cannot pull from your wallet anymore - even if our server is compromised.
• No private keys held. The agent runs from a Circle Programmable Wallet (smart account); we never custody your EOA key. Your EOA signature is the only authorization.

Modes

Portal

The /portal page is the loyalty layer over every other surface. Checking in is a real transaction against OneliqCheckIn (0x368a0E854ec69EC10b50D20fCaFC1bAF8b7eff10) on Arc, not a database write - the contract is immutable and counts days in UTC, so your record is verifiable on the explorer independently of us.

• Star Points. A deterministic score computed from what you have actually done - check-ins, streak length, badges, and referrals. The same inputs always produce the same total, so the number can be recomputed from scratch and audited.
• Streaks. Recalculated from your full check-in history rather than incremented blindly, with a small freeze budget so one missed day does not wipe a long run. Days follow UTC to match the contract.
• Badges. Awarded for milestones across the app - first check-in, streak thresholds, social verification.
• Referrals. Invite links credited once the invited wallet actually checks in.
• Leaderboard. A live ranking built from every stored profile, refreshed as people check in.

Profiles, badges, and streak history live in Cloudflare KV keyed by wallet address. Nothing here touches your funds - check-in moves no USDC beyond the gas the transaction costs.

History

The /history page is your personal stablecoin operations explorer. Every transfer, swap, bridge, and agent execution renders as a clean receipt - title, source → destination chain tags, status pill, relative time, amount, tx hash linkable to the right chain explorer.

Tabs

• All - every event across all three surfaces, newest first.
• Trade - same-chain swaps and bridge originations.
• Balance - deposits, withdrawals, multi-source unified spends.
• Agent - every agent execution (succeeded, pending, failed) with run-ID for debugging.

Data sources

Trade and Balance events are recorded local-first in your browser's activity log (arc.trade.activity.v1) and also mirrored to /api/history/*, keyed by your wallet address, so the feed follows your wallet across browsers and devices. Agent events come from the backend /api/agent/* endpoints which only return rows where you're the rule owner (server-side auth).

Dashboard

The /dashboard page is your portfolio home - a read-only aggregator over everything a connected wallet holds. It shows your profile (deterministic avatar + address), total portfolio value with 24h change, a Holdings table (USDC / EURC / cirBTC with live price and value), an allocation donut, your unified USDC balance across Gateway chains, and a recent-activity feed mirrored from History.

It's a pure aggregator - no Gateway writes happen on this page. Prices come from CoinGecko (USDC pinned to $1) and every card deep-links to Balance, Trade, or History.

Arc L1

Arc is a purpose-built Layer 1 blockchain optimized for stablecoin-denominated finance. Three defining design choices set it apart from a generic EVM chain:

• USDC-denominated gas. Transaction fees are paid in USDC, so costs are predictable in USD terms regardless of any token's price action.
• Sub-second deterministic finality. No reorgs, no probabilistic finality. Once a transaction is finalized, it cannot revert.
• Opt-in privacy. Confidential transfers and selective disclosure for regulated counterparties (not yet integrated by Oneliq).

Arc is fully EVM-compatible: existing Solidity contracts, Hardhat / Foundry / Viem / ethers tooling all work without modification. Reference docs at docs.arc.network.

Circle Gateway

Circle Gateway is the protocol that powers Unified Balance. It replaces "I bridged my USDC to chain X and now I have to bridge it back" with "my USDC is already everywhere I need it."

The two on-chain contracts

• GatewayWallet at 0x0077777d7EBA4688BDeF3E311b846F25870A19B9 on every Gateway chain. You deposit USDC into this contract; balances are held per-chain but indexed globally by the Gateway service.
• GatewayMinter at 0x0022222ABE238Cc2C7Bb1f21003F0a260052475B on every Gateway chain. Anyone with a valid Circle-signed attestation can call gatewayMint to materialize USDC on the destination chain.

Both addresses are deterministic across chains (CREATE2 deploy with the same salt), which is why Unified Balance can address every chain uniformly without a per-chain registry.

Gateway vs. CCTP - when to use which

CCTP V2

Cross-Chain Transfer Protocol V2 is Circle's official bridge for native USDC. Unlike lock-and-mint bridges (which create wrapped tokens backed by frozen liquidity), CCTP burns native USDC on the source chain and mints native USDC on the destination - every USDC stays "real USDC" all the way through.

Why this matters

• No wrapped USDC variants. No USDC.e, no axlUSDC, no synthetic IOU.
• No bridge TVL to drain - there's no pool of locked tokens for an attacker to target.
• Issuer-attested. Only Circle's signed attestation can authorize the destination mint.

Finality modes

• Fast (V2-only) - Circle's enhanced attestation pipeline issues the attestation ahead of full source-chain finality for supported pairs. Small Circle fee. Typical end-to-end: ~20 seconds.
• Standard - Circle waits for source-chain finality (two beacon epochs on Ethereum, instant on Arc). Zero fee. Typical: 13–19 minutes when Sepolia is the source.

Programmable Wallets & Paymaster

Circle Programmable Wallets are smart-account wallets Circle issues on demand via REST API. Oneliq's Oneliq AI uses them as the executor account - every scheduled or threshold-triggered USDC move is a userOp signed by a Programmable Wallet under server-side custody, paid for by Circle Paymaster.

Why this is safe

• The executor wallet doesn't hold your funds. It only spends what you've explicitly permitted via EIP-2612 - and only along the rule you signed. No discretionary access.
• Permits are revocable. One on-chain call (the standard ERC-2612 path or our UI's Revoke button) zeroes the allowance. The executor cannot pull a single USDC unit afterward.
• Paymaster is gas-only. Circle Paymaster sponsors gas for the userOp; it doesn't sign or authorize value transfers. The agent's executor still has to satisfy your permit + rule.
• Daily cap is enforced server-side AND in the smart-account. Two layers of defense - even a backend bug can't exceed the on-chain limit you signed.

USDC as native gas

Most chains use a volatile native token for gas (ETH, MATIC, AVAX). Arc uses USDC. The practical impact:

• Gas costs are predictable in USD terms - a transfer that costs $0.001 today costs $0.001 tomorrow, regardless of any token's price action.
• You don't need to maintain a "gas reserve" in a separate token. The same USDC you spend with pays for the transaction.
• Internally, native USDC has 18 decimals (to match standard EVM gas math), distinct from the canonical 6-decimal Circle USDC. The frontend handles the conversion at the burn/mint boundary using a cctpDecimals hint on the token registry.

Implementation note

Arc's USDC lives at 0x3600000000000000000000000000000000000000 as a precompile-style ledger token, not a deployed ERC-20. Standard balanceOf/transfer/ approve all work, but the token cannot be deposited via transferFrom to any contract that wasn't designed for native gas - which is why Gateway deposits originate from other chains.

Network info - Arc Testnet

Supported chains

Oneliq surfaces eight testnets - Arc as the home chain plus seven external chains for Unified Balance, CCTP bridging, and the Oneliq AI.

Contract addresses

All contracts Oneliq interacts with on Arc Testnet (chain ID 5042002):

Tokens

Circle Gateway V1

Same deterministic addresses on every Gateway-supported chain.

Circle CCTP V2

Same addresses on every CCTP V2 chain.

OneliqRouter (Oneliq swap router → Circle Curve pool)

Used by Trade for same-chain USDC ⇄ EURC swaps. Forwards into Circle's Curve StableSwap pool and takes a 0.30% on-chain protocol fee (capped at 1%). Sourcify-verified.

OneliqCheckIn (Portal daily check-in)

Immutable, no owner and no upgrade path. Counts days in UTC. Sourcify-verified.

Arc-native

Oneliq deploys exactly two contracts - OneliqRouter and OneliqCheckIn - and both are published and verified. Neither can hold your balance: the router forwards a swap within a single transaction, and the check-in contract moves no funds at all. Every other contract above is operated by Circle or the Arc Foundation.

API endpoints

Oneliq exposes a handful of Cloudflare Pages Functions. Two are read-only proxies to Circle's public APIs; the others are the minimal backend the Oneliq AI needs (rule storage, cron triggers, execution log). None hold private keys, none custody funds.

/api/circle-proxy/*

Proxies Circle's IRIS attestation API for CCTP. Used by the Trade module to poll for attestations after a burn transaction.

# Fetch attestation by burn message hash
GET /api/circle-proxy/v2/messages/{sourceDomain}?transactionHash={txHash}
   ↓ proxies to https://iris-api-sandbox.circle.com/v2/messages/...

/api/gateway-proxy/*

Proxies Circle's Gateway public REST API. Used by Unified Balance to fetch balances and submit signed transfer intents.

# Read multi-chain balance
POST /api/gateway-proxy/v1/balances
     # body: { token, sources: [{ domain, depositor }] }

# Submit a signed burn-intent for cross-chain spend
POST /api/gateway-proxy/v1/transfer
     # body: signed EIP-712 BurnIntent

/api/agent/*

The agent backend. Reads are filtered by your connected-wallet signature; writes require an EIP-712 typed signature matching the rule payload.

# Register a new rule (Auto Top-Up or Scheduled Send)
POST /api/agent/register
     # body: { rule, eip712Signature, permitSignature }

# List agents owned by the connected wallet
GET  /api/agent/list?owner={address}

# Execution log for a single agent
GET  /api/agent/{id}/executions

# Pause / resume / revoke
POST /api/agent/{id}/pause
POST /api/agent/{id}/resume
POST /api/agent/{id}/revoke

/api/ai/*

The Oneliq AI chat. Runs on the Cloudflare Workers AI binding, so there is no third-party model provider and no model API key anywhere in the stack. It returns a draft action for the UI to prefill - it cannot sign, submit, or authorize anything.

/api/history/* and /api/recipients/*

Per-wallet storage, keyed by address and capped in size: the receipt feed behind History, and the recipient book behind Batch Pay. Both exist so the data follows your wallet across browsers instead of being trapped in one browser's local storage. Neither can move funds.

/auth/*

The Portal backend: check-in recording, Star Points, streaks, badges, referrals, and the leaderboard. A check-in is only credited after the on-chain transaction is verified against the OneliqCheckIn contract, so points cannot be minted by calling the API.

/api/metrics/*

Read-only telemetry rollup used by status.oneliq.xyz. Compute-on-write so a single /summary call doesn't trigger 273× KV reads. Headline counters are re-derived from Arc itself - router swaps and check-in totals read straight off-chain - rather than trusted from our own store.

Supported wallets

Any browser wallet announcing itself via EIP-6963 appears in the picker. Tested with:

• MetaMask - most common, widest compat.
• Rabby - recommended for active DeFi users (better tx simulation, native multi-chain UX).
• Coinbase Wallet - extension or injected.
• Frame - desktop-native, hardware-wallet friendly.
• Ledger / Trezor - through MetaMask, Rabby, or Frame.
• Brave Wallet - works via the standard injected provider.

Mobile wallets via WalletConnect / Reown AppKit are on the near-term roadmap (see Changelog).

Tech stack

Deliberately minimal. Every choice was made to maximize auditability and minimize attack surface.

Why no framework?

• Auditability. Every line shipped to your browser is in the repo as written, not generated by a bundler. You can diff the served HTML against the GitHub source byte-for-byte.
• SRI integrity. The only third-party script (ethers.js) is pinned by SHA-384. Any tamper at the CDN fails to load instead of executing.
• Performance. No runtime, no hydration. The Balance page is interactive in < 200 ms after first byte.
• Footprint. No node_modules, no supply-chain blast radius from npm install, no dependency CVEs.

Security

Oneliq takes a defense-in-depth approach. Highlights:

• Non-custodial. No user funds ever flow through Oneliq-controlled addresses. The agent executor is a Circle Programmable Wallet bound to permits you explicitly signed.
• Open source. The entire frontend is published. Verify the served build matches the committed source.
• Strict CSP. A Content-Security-Policy header constrains script, style, image, font, and connect origins per page. There is no 'unsafe-eval'.
• SRI on every CDN script. ethers.js (and any other CDN asset) carries a SHA-384 integrity hash; CDN tampering fails closed.
• Host security headers. HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - all set via Cloudflare Pages _headers.
• Cookieless analytics, nothing else. We run Cloudflare Web Analytics, which sets no cookie, writes nothing to your browser's storage, and builds no cross-site profile. It reports aggregate page views, referrer, country, and load timing. There are no marketing pixels, no ad networks, and no fingerprinting scripts. Apart from that beacon, every third-party origin reachable from a page is a chain RPC or a Circle API explicitly allowlisted in the CSP.
• Pre-flight checks. Every deploy runs scripts/preflight-check.sh - six gates covering CSP, SRI, link hygiene (rel=noopener), hardcoded secrets, .env leakage, and host headers.
• Agent safety rails. Daily cap (signed on-chain), revocable permit, auto-pause after 5 consecutive failures, two-layer cap enforcement (server + smart-account).
• The AI cannot act. Oneliq AI produces a draft the UI prefills; the signature always comes from your wallet. It has no key, no session, and no path to submit a transaction on its own.
• Internal surfaces are gated. The operator console sits behind credentials that fail closed - if the secret is unset the page returns an error rather than opening. Source, config, and internal files are 404'd at the edge even if a deploy uploads them by accident.

Found a vulnerability? Report it via SECURITY.md - bug-bounty rewards from $100 (low) to $50,000 (critical), depending on impact. Coordinated disclosure expected.

FAQ

When should I use Unified Balance vs. Trade (CCTP)?

Use Unified Balance when you want USDC ready to spend on multiple chains over time. Deposit once, spend many times - latency at spend is in the seconds. Use the Trade cross-chain mode (CCTP V2) for a one-shot move from chain A to chain B where you don't need to pre-fund.

Why is my CCTP bridge taking 13 minutes?

You're on Standard finality. Circle waits for source-chain finality before issuing the attestation - sub-second on Arc, but ~13 min on Ethereum Sepolia (two beacon-chain epochs). Switch to Fast finality for supported pairs to bring this down to ~20s for a small fee.

Can the agent drain my wallet?

No. The agent can only pull what your EIP-2612 permit explicitly authorizes - bounded by the daily cap you signed on-chain. Revoke the permit at any time and the agent literally cannot pull a single USDC unit. The executor's smart account holds no private keys you didn't authorize via signature.

Can the AI spend my money?

No. Oneliq AI reads and drafts; it never signs. When you ask for a swap, a payment, or an automation rule, it fills in a form and hands it back to you - your wallet raises the signature prompt and you can change or cancel anything before approving. It also cannot spend your Unified Balance even indirectly: a Gateway burn intent is signed for one fixed amount, so there is nothing an unattended process could re-use.

Where do agent rules live?

Rules and execution logs are stored in Cloudflare KV, keyed by your wallet address with the EIP-712 signature serving as ownership proof. We never see your private key - only your public address and the typed-data signature.

Does Oneliq have its own token?

No. Oneliq is a frontend, not a protocol. There is no ASWP token, no airdrop campaign, no governance token sale. Anyone telling you otherwise is running a scam.

When mainnet?

Arc mainnet is governed by the Arc Foundation; Oneliq deploys on mainnet shortly after Arc launches. See the homepage roadmap for current milestones.

Why don't you use a bigger frontend framework?

We optimized for auditability and minimum supply-chain risk. See Tech stack.

Changelog

v0.10.x - Public Beta on Arc Testnet

• 2026-08-10 - Surfaces that talk to each other. Trade can park a swap output straight into the Unified Balance; Batch Pay gains bulk paste and a per-wallet recipient book, and splits past Circle's 16-intent cap instead of refusing; the agent now reads your unified balance in its pre-flight.
• 2026-08-10 - Light theme across every page with a sun/moon switch, plus a new Oneliq wordmark for both themes.
• 2026-08-09 - Balance power-ups. ⇉ Batch Pay (pay N recipients, grouped by destination, one signature per chain) and ⤵ Consolidate (sweep every chain onto one in a single signature). Spend gains a Manual mode alongside Auto and Single, plus estimate-before-sign and three explicit partial-liquidity states.
• 2026-08-09 - Oneliq AI. The agent grows a chat layer: describe a rule in plain language, the assistant prefills the config, you sign. Powered by Cloudflare Workers AI.
• 2026-08-04 - Dashboard live - read-only portfolio view of everything your wallet holds on Arc, priced from CoinGecko.
• 2026-06-18 - Gasless mint default-on. Cross-chain spends route the destination mint through Circle's Forwarding Service, so recipients receive USDC without holding gas first.
• 2026-05-20 - Docs rewrite. Dropped Vault / Pools / Points sections (no longer being built). Added Trade, Agent, History, Create Token, Dashboard reference pages. Updated contract registry - USYC removed, App Kit fallback noted on the Uniswap V2 entry.
• 2026-05-18 - Trade declutter - removed App Kit ready pill, Gateway hint pill, Liquidity card. Quote latency cut via 150ms debounce + SDK prefetch.
• 2026-05-15 - Balance polish - circular chain logos, Unichain added to the chain registry, CCTP-domain subtext dropped.
• 2026-05-12 - History page launched. Receipt-feed aesthetic across Trade / Balance / Agent activity, segmented tabs, deep-link to chain explorer.
• 2026-05-08 - Agent v0.9 - auto-pause after 5 consecutive failures; admin diagnostic endpoint for failure log; Cloudflare cron rollout.
• 2026-05-04 - Real Unified Balance with multi-source spend; wallet picker (EIP-6963 + RDNS-based ranking).
• 2026-04-25 - Security baseline: CSP, SRI, host headers, vulnerability disclosure policy, pre-flight check script.
• 2026-04-20 - Initial homepage launch.

Upcoming

• Balance / Oneliq AI / Trade - UX deepening - continued polish across the live surfaces. Intent / approval / revoke flows, quote & route polish.
• WalletConnect / Reown AppKit - mobile wallet support.
• Circle Wallets onboarding - non-crypto-native users land directly on a Programmable Wallet.
• StableFX - RFQ-driven USDC ⇄ EURC ⇄ USDP PvP settlement via the Arc FxEscrow contract.
• Mainnet - shipping shortly after Arc Foundation launches Arc L1 mainnet.