Security # What a relayer can and can’t do A service that pays your users’ fees sits between them and the chain. Here’s what it can do, what it can’t, and how to check it yourself. Check a relayer yourself Report a vulnerability Illustration: a signed transaction. The signature covers every field, so a relayer can’t change it, and the network refuses the same transaction a second time. 01 · Can and can’t ## The trust model Three things a relayer can’t do, and the one thing it can. - ### It can’t change the transaction Your user’s signature covers every field, including the relayer’s address. Any change breaks it, and the network refuses it. - ### It can’t send it twice Each signed transaction carries a number the network accepts only once. A copy is always refused. - ### It can’t touch any funds A relayer pays the fee. It has no authority over your users’ balances or yours. - ### It can delay or decline This is the real risk. That’s why the relayer is named before your user signs, and why you can check it on chain. 02 · Verify ## Check a relayer yourself Every CoRelayer relayer is listed on chain. How to verify a relayer → CoRelayer is built on MultiversX and is an independent project. - ### We name the relayer Your app gets the relayer’s address before your user signs anything. - ### You check the list Look that address up on the list in the contract, using MultiversX’s public API, not ours. The SDKs include this check; turn it on in one line. - ### Your user signs Once it checks out, your user signs. The signature covers the relayer’s address too. 03 · Who holds what ## Keys Key handling → - ### Your users’ keys We never hold your users’ keys or your funds. - ### Your sponsor key A sponsor key is shown once and lives on your server. - ### Our relayer keys Our relayer keys are kept encrypted on servers we run. 04 · Disclosure ## Report a vulnerability Found a problem? Email support@co-relayer.com . Our policy and security.txt say what to include. Email us - Disclosure policy → - /.well-known/security.txt Get started ## Start with the wallet you have Connect a MultiversX wallet and pay a plan in USDC. Buying your plan is already a gasless transaction. Get started See pricing Building an AI agent? Start here → Questions? support@co-relayer.com