Security

What a relayer can and can’t do

A service that pays your users’ fees sits between them and the chain. Here’s what it can do, what it can’t, and how to check it yourself.

01 · Can and can’t

The trust model

Three things a relayer can’t do, and the one thing it can.

It can’t change the transaction
Your user’s signature covers every field, including the relayer’s address. Any change breaks it, and the network refuses it.
It can’t send it twice
Each signed transaction carries a number the network accepts only once. A copy is always refused.
It can’t touch any funds
A relayer pays the fee. It has no authority over your users’ balances or yours.
It can delay or decline
This is the real risk. That’s why the relayer is named before your user signs, and why you can check it on chain.

02 · Verify

Every CoRelayer relayer is listed on chain.

CoRelayer is built on MultiversX and is an independent project.

We name the relayer
Your app gets the relayer’s address before your user signs anything.
You check the list
Look that address up on the list in the contract, using MultiversX’s public API, not ours. The SDKs include this check; turn it on in one line.
Your user signs
Once it checks out, your user signs. The signature covers the relayer’s address too.