Self-hosted Crypto Payment

Add self-custodied crypto payment checkout to a Next.js + Supabase app. Accepts ETH, BTC, SOL, USDC, USDT and 25+ coins across 9 chains. No payment processor...

Key points to review before installing: - This is true self-custody: CRYPTO_MASTER_MNEMONIC controls all derived deposit wallets. If compromised you lose funds. Use a secure secrets manager (Vercel/AWS/etc.), not a checked-in .env file. Prefer a dedicated hot wallet with minimal funds for day-to-day payments; consider a multisig or sweep strategy for long-term storage. - The skill's registry metadata omitted required env vars. Do not trust the registry summary — follow SKILL.md and the code which require CRYPTO_MASTER_MNEMONIC and CRON_SECRET. - Ensure CRON_SECRET is strong and stored in hosting cron config so the cron request includes Authorization: Bearer <CRON_SECRET>. Confirm timingSafeEqual usage is actually comparing fixed-length buffers (the code does this), but test cron auth in a staging environment. - The skill assumes you have a working server-side Supabase service client helper; verify your service role keys and RLS policies are correct and no mnemonic or private keys are exposed to client bundles. Do not import crypto-wallets.ts into client code. - Audit the copied server files (resources/*.ts) yourself before deploying, and test on testnets first. Verify the RPC endpoints hard-coded in the code are acceptable for your needs (they are public RPC endpoints) and consider replacing with paid/private RPC providers if you need higher reliability. - Consider operational risks: address reuse prevention, DB backups, expiry windows, edge cases for token decimals and chain reorganizations, and legal/compliance implications of accepting crypto in your jurisdiction. - If you want stronger assurance, ask the publisher for provenance (homepage, source repo) and a security review; lack of a homepage/source in the registry metadata reduces traceability.

Type: OpenClaw Skill Name: self-hosted-crypto Version: 1.0.1 The skill bundle provides a comprehensive and well-documented implementation for a self-hosted crypto payment gateway using HD wallet derivation (EVM, BTC, SOL). While it handles a highly sensitive secret (CRYPTO_MASTER_MNEMONIC), the code follows security best practices, such as performing all derivation server-side, using timing-safe comparisons for authentication (timingSafeEqual in check-crypto-payments-route.ts), and implementing database-level protections like Row Level Security (RLS) and unique constraints to prevent address reuse. The external network calls are limited to standard public blockchain RPCs and price APIs (CoinGecko, Mempool.space), and the documentation includes explicit security advisories regarding mnemonic management.