hold escrow · deposit vault
Every held seat
parks value on Hedera.
The hold fee is a one-way x402 payment. The deposit is different — it sits in the HoldEscrow contract until the traveller books, passes, or the clock runs out. Deposits are short-lived and recycle constantly, so the vault is working capital, not idle TVL.
Total value locked
0 HBAR
across 0 live holds · 0 opened all-time
Locked now
0 HBAR
Active holds
0
Avg window
24h
Refunded
0 HBAR
Settled to sellers
0 HBAR
Fees paid · x402
0 HBAR
What's in the vaultevery row is one deposit
refreshing every 5s| Hold | Flight | Deposit | Fee | Status | Expires / tx |
|---|---|---|---|---|---|
| No deposits yet — hold a seat on step 02 and it shows up here. | |||||
At scaledrag the assumptions
Defaults are one mid-size OTA's daily volume. The deposit is never the platform's money — it is the traveller's, and it leaves the contract only through settle or refund.
Steady-state TVL
2,000HBAR
holds/day × deposit × window ÷ 24 — locked at any moment, recycling 365× a year
Deposit flow / yr
0.7M HBAR
Contract calls / day
10,000
At Hedera's fixed ~$0.0001 per call that is $365 of network fees a year — on a chain with variable gas, a $2 hold fee stops covering its own settlement the first time the network gets busy.
Why it settles on Hedera
Settlement cost stays flat
A hold earns the seller a fraction of an HBAR. Settlement has to cost a rounding error and keep costing one — a gas spike would make the whole product unsellable.
open() + refund() ≈ $0.0002 total
Finality inside the quote window
The seat is soft-locked for 90 seconds. The deposit has to be provably locked before that runs out, or the agent loses the seat it just paid a fee for.
~3s to finality
Refunds nobody has to babysit
After expiry anyone can call refund(), and a scheduled transaction can fire it on the deadline. No keeper bot, no seller cooperation, no stranded deposits.
refund() is permissionless after expiry
TVL that actually turns over
Deposits arrive and leave every day rather than sitting still. The same balance sheet gets reused hundreds of times a year, and each turn is two contract calls.
365 turns / year at a 24h window
The contractcontracts/src/HoldEscrow.sol
open(id, seller, expiresAt) payable
agent locks the deposit, window ≤ 7 days
settle(id)
payer only, before expiry → seller
refund(id)
payer any time
anyone once expired → payer
stats() → (locked, settled, refunded, opened)No owner, no pause, no upgrade path. The seller can never pull funds, and after the window ends the refund is callable by anyone — so a seller that goes offline cannot strand a traveller's deposit. That property is the whole reason a traveller lets an agent spend on their behalf.
cd contracts && npm install
cp .env.example .env ← funded ECDSA key
npm run deploy:hedera
# then in backend/seller/.env
HEDERA_ESCROW_ADDRESS=0x…
This page reads the address from the seller — deploy it and the badge above flips to settling on hedera-testnet with HashScan links on every row.