reply guys

1/4: The Foundation

You've asked about security. Let's get into the weeds. This is too important for a single post, so here’s a full thread on how Reply is built.

The entire security model rests on one core idea:

Public Accountability, Private Conversation.

The value transfer is public and verifiable on-chain.
The message content is private and off-chain.
This separation is everything. Here's the breakdown.

Building mini apps in Farcaster

Reply App - https://farcaster.xyz/miniapps/ZuqxLQnWC2Nh/reply

2/4: First, the most important question: Is my message content on the blockchain?

No. Never.

Your conversation is stored securely in the app's private backend. It's completely off-chain.

4/4: Finally, the money. Where does it go?

It's held in a verified smart contract on Base, acting as a neutral vault.

The "magic" of gasless payouts and automatic refunds is handled by an admin key that is controlled by backend. Let's be transparent about this: my backend uses this key to trigger the payout or refund on your behalf.

Crucially, this key's power is limited by the contract's code. It can ONLY execute the two intended functions: pay a completed exchange, or refund an expired one. It CANNOT drain the contract or redirect funds.

It's a deliberate design trade-off is made: a small degree of centralization to deliver a much better, decentralized user experience.

3/4: How is your identity and data handled?

Authentication is managed entirely by Farcaster's QuickAuth SDK.

For optional Telegram notifications, the app only stores your anonymous chat_id, never your username. This connection is secured by JWT to ensure notifications are sent only to you.

The principle is to store the absolute minimum data required for the app to function.