Glossary

Terms used across this site. Linked from other pages when a term first appears.

A

AnteHandler — the Cosmos SDK middleware that runs before every transaction. In BabyChain it checks signature, nonce, gas, and the per-chain minimum fee.

API key (api_key) — the bearer credential a merchant uses to call pay/api. Returned once at merchant creation. Argon2id-hashed at rest.

B

2BABY — the native token of BabyChain. 1,000,000,000 hard cap. a2baby is the 1e18 subunit used in EVM math.

Block time — target interval between blocks. ~1.2s locally, ~5s on a public multi-validator set is the planned next step.

Blockscout — the block explorer used in the local stack. Not part of the gateway.

C

Chain ID — babychain_2027-1 (Cosmos) / 2027 (EVM). Used in EIP-155 signing and in eth_chainId.

CometBFT — the consensus engine. PoA locally (single validator key). The validator set is a config artifact in genesis.json.

Confirmation — a block built on top of the block containing a transaction. The default confirmation threshold for sweep is 12.

D

Deposit address — a unique, un-reused address derived for each invoice via m/44''/60''/0''/0/<index>.

DERIVATION — the BIP-44 HD path used for deposit addresses. See Deposit address derivation.

DEV ONLY — a comment marker used in the codebase to mark code paths that are safe in dev but unsafe in any deployed environment.

E

EIP-681 — the Ethereum URI scheme used in QR codes (ethereum:<addr>@<chainId>?value=<wei>).

EIP-1559 — the fee market mechanism. Base fee + priority fee.

EVM — the Ethereum Virtual Machine as implemented in cosmos/evm v0.7.0.

G

Gateway — the network-access layer. Three components: OpenResty proxy, indexer, read API.

GAS_FUNDER_PRIVATE_KEY — the EOA that tops up the sweep wallet when its gas reserve is low.

H

HD path — hierarchical deterministic derivation path. We use m/44''/60''/0''/0/<index>.

HMAC — Hash-based Message Authentication Code. Used for webhook signing and api_key validation.

HSM / KMS — Hardware Security Module / Key Management Service. The production home for PAY_MNEMONIC, PAY_SECRET_KEY, and GAS_FUNDER_PRIVATE_KEY. Never use env vars for these in any deployed environment.

I

Idempotency — the property that re-running a request with the same key returns the same result. Required for POST /v1/invoices.

IBC — Inter-Blockchain Communication. The Cosmos SDK''s cross-chain protocol. Not used by BabyFX Pay in v1.

Indexer — the gateway component that polls the chain and writes to Postgres. Polls every 1.5s.

L

Local dev stack — the configuration described on this site. Not safe for any deployed environment.

Lookup token (lookup_token) — the bearer credential for reading an invoice without logging in. 128 bits, returned once at invoice creation.

M

Mnemonic — the 12/24-word seed phrase from which every deposit address is derived. Critical secret in dev (env), must be in an HSM in prod.

Merchant — an account on pay/api. Identified by an integer id and authenticated by an api_key.

P

Pay / pay/ — the application-layer service: invoice API, settlement, webhooks, sweep.

PoA — Proof of Authority. Single-validator consensus. Used in dev. Not used in testnet or mainnet.

Precompile — native Go code that the EVM can call like a contract. BabyChain exposes precompiles for bank, staking, gov, IBC, and distribution.

R

RPC proxy — the OpenResty component in gateway/. Rate limits, batch-caps, and debug-blocks before forwarding to the chain.

S

Settlement — the process of matching on-chain payments to pending invoices. Runs in pay/settlement.

SyncDB — the Postgres database shared by the gateway and Pay. Holds blocks, transactions, invoices, merchants, and webhook deliveries.

Sweep — the act of moving confirmed invoice funds from the deposit address to the merchant''s settlement address. Runs in pay/sweep.

T

Threat model — the executable enumeration of assets, actors, threats, and mitigations. See Threat model.

Token bucket — the rate-limiting algorithm. Configurable rate and burst.

Trust boundary — a place where the system changes who is trusted. There are five in BabyFX Pay: public internet, gateway, application, core, data plane.

V

Validator — a signing key that participates in CometBFT consensus. Local dev has exactly one.

W

Webhook — an HTTP POST from pay/webhooks to a merchant''s webhook_url. HMAC-SHA256 signed.

Webhook secret (webhook_secret) — the per-merchant key used to sign webhooks. Returned once at creation. AES-256-GCM-encrypted at rest.