Rules you can read.
Proof you can check.
A guide to donation campaigns, shared money pools and public receipts. Check the terms, then inspect the Testnet evidence.
Choose the right flow.
Donation campaigns · D4
Each campaign has its own escrow, locked recipients, a 0 to 10% creator share, three approvers, and funding/review deadlines. After funding closes, two wallets approve the same proof before the deadline. After quorum, anyone can release to the fixed recipients. If timely approval is incomplete, each donor claims their own full contribution back.
Explore campaigns →Disaster Vault · D3
A shared relief pool with three fixed signer wallets. Payouts need two approvals, then wait 20 ledgers. Execution rechecks a rolling 24-hour limit of 20% of the current balance. Pause and unpause need quorum. Contributions remain open while paused.
View Disaster Vault and public proof →Arisan Rooms
Members fund N × their share upfront for N rounds. The draw uses participant commitments and reveals, then a finalization call pays the selected eligible member. A host still starts a full room. This is a rotating pool, with no interest or yield.
View Arisan Rooms →D4 donation campaigns do not use D3's 20-ledger wait or spending cap. Wallet approvals and public receipts do not prove real-world delivery.
What Salapi solves
In an informal arisan or paluwagan, one person commonly holds the pot and runs the process. Salapi puts the pool rules and accounting in Soroban contracts instead. Contributions, payouts, and draws leave public Stellar receipts that anyone can inspect.
The app shows familiar peso or rupiah amounts. The server validates the input and converts it once to an integer stroop amount before sending it to Stellar; no floating-point money value is passed to a contract.
How it works
- The PWA collects a user-friendly amount and action.
- Server actions resolve the wallet, validate the request, and build the transaction.
- Soroban RPC submits the signed transaction to Stellar Testnet.
- The UI returns a receipt link so the result can be checked independently.
The web layer uses @stellar/stellar-sdk 15.1.0 and the contracts use Soroban SDK 22. The current test asset is native XLM through its Stellar Asset Contract; it has no real-world value.
Testnet contracts
These are recorded Salapi Testnet contract deployments. Historical single-admin Disaster evidence is separate from the D3 deployment. Arisan has separate demo- and long-cadence deployments compiled from the same source.
Contract addresses and source packages
CBC6BTKW5VA6Y2XH6WP4IEPWDZ7TBPYSIIOZQMTEH62N62NFT4F4VYDDCDDINUQXTF6SHZN2ZJ36IT7P4YOJ3OZN3H6LTYHVCQ35YYO7YTAWM4G3CCKQ3UVBZ75KSZDO6IPA5U6PFARJG4PLRGN2SAIW5RAGQ6K4B7ZDWBUZCCXNSK6IGPSB4QGUSNB2EFZWYV53NKVX5AV3XSJANCDDD7TULGQSY37XCBQBUAOP3T235Q2U63XNC2NQVNAOXQL2KHWALO6FTIOJS46NTKIZJ5WICDFIM3DPANUDSZJUMVFYOGCMMWUS545KDIZQIHBZWMWCA4THFKCPVB6NCAYJ7G3CPT5LYKV2P5E4GL7TNVDQKMMW6SA4WA4QYQZKCNLK45GE4VULCCN2O4Z6CSUVF74DWZBJJ526IMEXVRCYKY74PM5BDKA22WWTOW5WHZDYCC6D7P35SVCNZLOKTHKDNH4S2ZELYHBP5UO3IWADFORKEF7BCSBY37FUThe configured D3 address comes from the same setting used by application transactions. Transparency checks its on-chain configuration before enabling actions.
Full deploy, initialization, and flow transaction hashes are in thedeployment evidence log.
Public evidence
Start with the live app, then open the transparency page or a Stellar Expert link to verify the underlying network activity.
- Open the application
- Open transparency
- Week 1 Deliverable 1 pull request
- Week 1 D1 report
- Example 6.50 PHP Testnet contribution
- Week 2 D2 commit-reveal report
- D3 controls, acceptance tests, and deployment status
- D3 implementation PR #10
- D4 donation campaigns
- D4 release/refund evidence and security self-review
- D4 implementation PR #11
- D4 browser acceptance archive PR #13
- Archived campaign #5 payout: 0.05 + 0.95 Testnet XLM
- D2 normal round: three reveals
- D2 timeout round: one non-revealer
- D2 no-reveal liveness fallback
Current status and boundaries
- Stellar Testnet only. No real donations, fiat payments or mainnet funds.
- The milestone reports above archive D1 integer amount handling and D2 participant commit-reveal acceptance. Historical acceptance does not verify every current session.
- D3 implements fixed 2-of-3 approvals, a 20-ledger payout timelock, a rolling 24-hour cap, and quorum-controlled pause/unpause. Live cutover and evidence status are tracked in the D3 report.
- D4 escrows each campaign separately, fixes its three approvers and creator share at creation, requires two approvals of the same proof, and supports full donor-claimed refunds if review expires incomplete. The Testnet asset is fixed at deployment. D4 has no D3 spending cap or 20-ledger wait.
- Independent audit, independent signer custody, and fiat anchor integration remain outside this Testnet implementation.
- Current wallets are managed by Salapi. Three distinct signer wallets do not establish three independent organizations or independent key custody.
- Smart Savings is coming soon in this product experience. Its Testnet contract source remains listed as technical reference.
Security assumptions, custody trade-offs, and the mainnet checklist are documented in the repository's security policy.