Work / NoxEscrow

NoxEscrow

Confidential milestone escrow; an AI arbiter inside an Intel TDX enclave settles disputes.

Sepolia testnet
Privacy
AI agents
Solidity
iExec Nox
ERC-7984

Live ↗Code ↗

ETH Sepolia.

// how it works

NoxEscrow · product replay

Escrow thatkeeps secrets.

Milestone payments encrypted onchain. Disputes judged inside an Intel TDX enclave.

ETH SepoliaERC-7984 cUSDCIntel TDX arbiter

01 · Draft

The client picksa template.

Two milestones, 1,750 cUSDC each. Requirements written once, encrypted before they leave the browser.

Deploy escrowWeb3 dApp Dev3 × · 5,000Contract Audit2 × · 3,500UI/UX Design2 × · 2,000

02 · Lock0cUSDC locked

✓Terms encrypted in the browser (AES-GCM)✓Escrow clone deployed (EIP-1167)✓Budget locked as a confidential token (ERC-7984)

initializeEscrow → ContractInitialized(client, freelancer, 2) NoxEscrowContract.sol:141

03 · Milestone 1 payout1,750 cUSDC0x3f9c…e21b

The parties see the amount.Everyone else seesan encrypted handle.

04 · Deliver

The freelancerdelivers.

✓audit-report.pdf encrypted with the escrow key✓Pinned to IPFS✓Submitted for review

submitDeliverable → DeliverableSubmitted(0, ⟨encrypted⟩) NoxEscrowContract.sol:166

05 · Try to break itThe freelancer tries to release their own payout while the client's review window is still open.ReviewWindowNotExpired()releaseMilestone → reverted NoxEscrowContract.sol:179

06 · Release

★★★★★

Five stars.Milestone 1 paid.

releaseMilestone → MilestoneApproved(0) NoxEscrowContract.sol:197

07 · Dispute

Milestone 2is contested.

raiseDispute → DisputeOpened(1, ⟨reqs⟩, ⟨deliverable⟩) NoxEscrowContract.sol:261

ClientThe PoC suite doesn't cover the oracle staleness path.FreelancerIt's covered in test 7, with remediation notes.

08 · Inside an Intel TDX enclaveThe arbiter decrypts both sides, treats the statements as untrusted evidence, and scores the work.0/ 100 complianceEVALUATINGPAY_FREELANCERRule: at least 90% of the core requirements met → pay the freelancer · enclave-script.js:619

Onchain, in order · NoxEscrowContract.sol

callinitializeEscrow(payouts, proofs, reqs, proofs):102emitContractInitialized(client, freelancer, 2):141callsubmitDeliverable(deliverableHash, proof):144emitDeliverableSubmitted(0, ⟨encrypted⟩):166callreleaseMilestone(…) from freelancer:169revertReviewWindowNotExpired():179callreleaseMilestone(5):169emitMilestoneApproved(0):197callraiseDispute():230emitDisputeOpened(1, ⟨reqs⟩, ⟨deliverable⟩):261callresolveDispute(true) from TEE arbiter:264emitDisputeResolved(1, true):285

NoxEscrow · product replay

Escrow thatkeeps secrets.

Milestone payments encrypted onchain. Disputes judged inside an Intel TDX enclave.

ETH SepoliaERC-7984 cUSDCIntel TDX arbiter

// proof

Tests

$ npx hardhat test

test cases: 18

Refuse paths (custom-error boundaries) and scripted multi-milestone scenarios. No stateful fuzzing or invariant suite.

Deployed

Sepolia testnet No mainnet deployment.

NoxEscrowFactory (proxy)0xE14B…3537 ↗verified
NoxEscrowReputation (proxy)0xC0eE…9632 ↗verified
cUSDC (ERC-7984 wrapper)0x8560…78db ↗unverified

Counted from NoxEscrow@651a042 on 2026-10-05. Addresses from dApp/src/contracts/addresses.json, each checked onchain; explorer verification checked 2026-10-05.

# NoxEscrow// the record

Milestone escrow where the money and the work stay private. Budgets are held as an ERC‑7984 confidential token, requirements and deliverables are encrypted, and disputes go to an AI arbiter running inside an Intel TDX enclave.

01
One escrow key per contract protects requirements, deliverables, chat and reviews.
02
The arbiter gets transient read access through the onchain ACL and returns PAY_FREELANCER or REFUND_CLIENT.
03
Prompt-injection defence: the parties' statements are sandboxed as untrusted evidence.
04
Reviews are double-blind, revealed only when both sides submit or after 14 days.

// what the contract refuses

AlreadySettled()The active milestone has already been settled.NoxEscrowContract.sol:154

// beat by beat

DraftClient
The client drafts an escrow from the app's Smart Contract Audit template: two milestones, 3,500 cUSDC.
LockClient
Terms are encrypted in the browser, an escrow clone is deployed and the budget is locked. Explorers only see encrypted handles.
- callinitializeEscrow(payouts, proofs, reqs, proofs)L102
- eventContractInitialized(client, freelancer, 2)L141
DeliverFreelancer
The freelancer submits the deliverable. It is encrypted client-side before it leaves the browser.
- callsubmitDeliverable(deliverableHash, proof)L144
- eventDeliverableSubmitted(0, ⟨encrypted⟩)L166
Break itFreelancer
The freelancer tries to release their own payout while the client's review window is still open. The contract refuses.
- callreleaseMilestone(…) from freelancerL169
- revertReviewWindowNotExpired()L179
ReleaseClient
The client reviews, rates five stars and releases milestone 1. Payout and reputation update onchain.
- callreleaseMilestone(5)L169
- eventMilestoneApproved(0)L197
DisputeClient
Milestone 2 is contested. Raising a dispute grants the TEE arbiter read access to the encrypted terms and work.
- callraiseDispute()L230
- eventDisputeOpened(1, ⟨reqs⟩, ⟨deliverable⟩)L261
VerdictTEE arbiter
Inside an Intel TDX enclave the AI arbiter decrypts both sides, scores compliance and the contract settles.
- callresolveDispute(true) from TEE arbiterL264
- eventDisputeResolved(1, true)L285