Gas2Free

The wallet owns the money

Each user gets their own contract at an address derived from their key. That contract holds the USDT, so paying out is a plain transfer() from its own balance.

Nobody ever calls approve(), and the payout path never uses transferFrom(). There is no allowance to steal.

The signature is the authority

The owner signs an EIP-712 message binding the exact call: receiver, amount, fee, deadline. Change one digit and the signature no longer matches.

A relayer submits it and pays the bandwidth and energy. The relayer cannot alter the payment.

The address exists before the contract

The factory derives wallet addresses with CREATE2, so an address can be handed out and funded while the contract is still undeployed.

Deployment happens later, at that exact address, with the balance intact.

Why the last 20 bytes matter

After checking the signature, the wallet calls itself with the signed calldata plus the signer's address glued onto the end.

Inside that call msg.sender is the wallet, which would fail every ownership check. So _msgSender() notices the self-call and reads the address back off the tail of the calldata instead. The owner check then passes, and the relayer's identity never enters the decision.

Reading the trace

Six stages run in order. Each shows the real comparison it performs. A stage that fails halts everything after it, and the relayer sees the revert reason the contract actually produces.

Note that a failure inside the payment surfaces to the relayer as META_TX_FAILED: the inner reason is swallowed by the low-level self-call.

Signature binding

The signed digest covers the whole calldata, hashed. Editing the receiver or the amount after signing changes the hash, so recovery returns a different address and the call reverts with BAD_SIGNATURE.

Replay

The digest includes the wallet's current nonce, which increments on every accepted message. Re-submitting a spent signature recovers the wrong address, because the digest it was signed over no longer matches.

Domain separation

The domain binds the wallet address and the chain id. A signature for one wallet is meaningless at another, and a signature made on a testnet cannot be replayed on mainnet.

Deadline

The expiry sits inside the signed calldata, so the relayer cannot extend it. A message held back until after expiry simply stops working.

Fee cap

The wallet is deployed with a hard maximum fee. A relayer that inflates its own fee beyond the cap gets FEE_TOO_HIGH, no matter what the owner signed.

Re-entrancy

The payout is wrapped in a lock, so a token that calls back into the wallet mid-transfer cannot start a second payment.

Why not the usual deploy command

TRON does not accept Ethereum-signed deployment transactions, so the ordinary Hardhat deploy path does not reach it. The deployment uses TronWeb against the compiled artifacts.

The exact sequence and the required evidence are documented in the companion deployment guide.

Cost, in one line

Il deployer paga i deploy, il relayer paga i pagamenti. Il costo dipende da risorse disponibili e parametri correnti della rete. Il firmatario off-chain non paga quella transazione.

Energy delegation can reduce TRX burned, but it does not guarantee free execution. Check the current estimate in TronLink before approving.