Yesterday a small open-source build got an update. ZeroPay, a self-hosted crypto payment gateway with zero fees, now accepts Monero (XMR). It already handled LTC, Tron, USDT TRC20 and DOGE. The key setup is the twist, so stick around for that part.
The builder is u/ze707ro, a 15-year-old prompt engineer working from Iran, and they shipped it on r/PromptEngineering. It’s TypeScript on Node.js, and the goal is simple. Anyone can take crypto payments on their own project without paying a middleman like CoinPayments. No monthly plan, no percentage skimmed off each order, and no third party sitting between you and your customers’ money.
One warning before anything else, and the author says it too. This is a beta. It has passed simulated tests only and hasn’t touched a real network yet. Nobody should run real money through it today. Think of it as a code review opportunity, not a drop-in checkout.
What’s new
The Monero update came from a suggestion in the previous thread, which is a nice sign of a builder who actually listens to feedback. It comes with a full payment and address tracking system. That means each order can get its own address, and the gateway watches for incoming funds and matches them to the right invoice. For a privacy coin like Monero, where you can’t just paste an address into a block explorer and see what happened, that tracking piece is the hard part, and it’s where most of the work went.
The twist
The twist is how it handles keys. ZeroPay never stores a private spend key. For Monero it works with the public spend key and the private view key.
Here is why that matters. The view key lets the gateway see incoming payments. It can’t sign a transaction or move funds. So if your web server gets hacked, the attacker can look at your payment history but can’t drain your wallet. Compare that with the usual lazy setup, where a full wallet seed sits in an environment file on the same box that serves your website. One leaked .env and the money is gone. Here, the worst case is a privacy leak, not theft.
A commenter pointed out that plenty of adult developers get this part wrong. That’s a fair point, and it’s the best reason to go read the code.
There’s a second layer too. The author built protection against flash tokens. Flash USDT is a fake-token trick on Tron. A naive payment checker only looks at the address and the first six decimals, so it can be fooled into thinking a payment landed. The balance looks right in a wallet UI for a while, the shop ships the product, and later the “payment” turns out to be worthless. ZeroPay checks for a valid contract, among other things. The repo explains the full approach.
Mini-workflow: how to look at it without getting burned
- 🔍 Open the ZeroPay repo (github.com/Z-E-7-0-7-R-O/ZeroPay) and read the security docs first. The Monero and anti-flash sections are written up in detail, and ten minutes there will tell you whether the rest is worth your time.
- 🧪 Run it locally in a test setup. Do not point it at a live wallet. A throwaway wallet with a dust amount is the most you should ever use while it’s in beta.
- 🔑 Check what it asks you for. It should need only public keys and API access, never anything that can spend. If a config field wants a seed phrase or a private spend key, stop right there.
- 🛠️ Try to break the flash-token check. Feed it a fake transfer from a look-alike contract and see what it does.
- 💬 If you find a bug or a weak spot, open an issue. That is exactly what the author is asking for, and clear reproduction steps are worth more than a vague “this looks wrong.”
Pro tips
- Treat “never stores a private key” as a claim to verify, not a promise. Search the code for where keys are read, stored or logged. Also check the logs and error handlers, since secrets love to leak through a careless console.log.
- Fake-token checks are only as good as their edge cases. Test odd decimal amounts, look-alike contracts and underpaid or overpaid invoices. Also try a payment that arrives twice, or one that lands after the invoice has expired.
- If you want to use it later, wait until it has real-network testing behind it and a few outside reviewers have signed off. Watch the issue tracker too. A healthy project shows bugs getting reported and fixed quickly.
Why it’s worth a look
A zero-fee, self-hosted payment gateway is useful to a lot of small projects, from indie tools to side shops and donation pages. A teenager building one with a sensible key model is a good reason to give the code a few minutes of review, and it costs you nothing.
Got payments or security experience? Go read the repo and drop your feedback in the original thread. Early projects like this get better fast when real reviewers show up. ☠
ZeroPay project Self-Hosted zero-fee crypto payment gateway with available currencies MoneroXMR-LTC-Tron-USDT TRC20-DOG – New update: Adding Monero XMR currency
by u/ze707ro in PromptEngineering