Skip to main content
Ctrl+ArcZ is a security layer for USDC payments on Arc. It ships as a TypeScript SDK (@ctrl-arcz/sdk), a set of smart contracts, and reference apps. It protects both sides of a payment: the recipient you send to, and you when you pay.

​
The problem

The most effective attack on stablecoin users is not a smart-contract exploit. It is address poisoning. An attacker seeds your transaction history with a lookalike address, one that shares the same first and last visible characters as someone you actually pay, by sending you a zero-value or dust “bait” transfer. Later you copy the wrong address from your own history and send real funds to it, on purpose. The folk defense, “send $1 first and wait for it to arrive,” is broken: it is slow, it teaches nothing when the lookalike happens to be a live address, and it does nothing about who can see your wallet when you pay. Ctrl+ArcZ replaces the ritual with four layers that actually hold.

​
The four layers

  1. Firewall (refuse to send). A pre-send scan that refuses a lookalike or a zero-value-bait recipient before any funds move. This is the real defense against poisoning, because in a poisoning attack you send to the wrong address deliberately, so only refusing to send helps. Fail-closed by default.
  2. Protected transfer (code-gated claim). Escrowed transfers the recipient claims with a short code, with sender cancel and automatic refund of an expired, unclaimed send. A genuinely mistaken send stays recoverable.
  3. Clean history. Verified recipients and code-claimed settlement keep your activity spam-free and feed known-good addresses back into the firewall, so a lookalike of someone you have paid is caught too.
  4. Payer-side shield (Private Pay). Pay a merchant from a disposable, policy-bound address that stores no payer identity, with every spend authorized by an enclave co-signer that vetoes a drainer, a lookalike, or an over-policy spend. The same box in PULL mode is a subscription with a per-pull cap instead of an infinite approval, and a stealth address makes it unattributable.

​
Start here

Quickstart

Send a protected USDC transfer with the firewall on, end to end, in a few lines.

SDK API reference

Every exported function, its parameters, and its return shape.

Private Pay

Pay from a fresh, single-use address guarded by a co-signer that vetoes bad spends.

The firewall

Run the pre-send poisoning scan, and decide what warnings and blocks do.

Payer-side shield

The mental model behind disposable accounts, the co-signer veto, and the one-way valve.

Subscriptions

Recurring spending with a per-pull cap, an interval and an expiry on chain. The replacement for an infinite approval.

Bridge USDC

CCTP and Gateway from the user’s own wallet. Non-custodial, no relayer, no server.

​
Why Arc

Ctrl+ArcZ is built for Arc because Arc is what makes it practical:
  • USDC is the gas token. Ephemeral payment addresses need no separate gas funding, the detail that kills this design on other chains.
  • Sub-second finality. The create-fund-pay chain finishes in one breath, so a private checkout feels instant.
  • Circle tooling built in. CCTP and Gateway move USDC in and out; Arc Privacy Sector (APS) is the roadmap for confidential balances.

​
Install

Then jump to Installation for client setup, or the quickstart to send your first protected transfer.