Documentation
Don't trust us. Verify. This page states the exact rules the money follows, links the published code and tests that pin them, and tells you how to check everything yourself. Every section carries its real status; nothing is labeled trustless before you can verify it.
Campaigns, submissions, owner approvals, the payout engine, on-chain payment verification for pay-as-you-go, zero platform fees, and the published verification repository.
Platform view-tracking APIs (YouTube first), automatic on-chain payment detection, automated 72h pause enforcement, and the escrow program for locked campaigns. During the pilot, view counts are set by campaign owners from each post's public counter before they approve.
Every amount is an integer in micro-USDC (6 decimals). Floating point never touches money, and rounding always floors: never up, never in anyone's favor. The exact implementation is published in payments.ts.
| Views | Rate | Bounds | Clipper gets | Owner pays |
|---|---|---|---|---|
| 50,000 | $2.00/1K | none | $100.00 | $100.00 |
| 1,000 | $1.50/1K | min $2 | $0 (below min) | $0 |
| 10,000,000 | $1.50/1K | max $300 | $300.00 (capped) | $300.00 |
| 1 | $0.07/1K | none | $0.000070 exact | $0.000070 |
A locked campaign's vault is a state machine with exactly four operations. Anything not listed here is impossible. Not forbidden, impossible. The full specification is published in ESCROW_SPEC.md.
| Operation | Who | Rule |
|---|---|---|
| fund | Anyone | Deposit into the vault: owner tranches, creator-fee routing, community crowdfunding. Permissionless. |
| approve | Owner only | Reserve a payout for a specific clipper. Allowed only if amount ≤ balance − already reserved. |
| claim | The approved clipper only | Withdraw a reserved payout to their own wallet. Permissionless timing; no one can block it. |
| refund | Owner only | Reclaim leftovers: only after closing the campaign, only after 48h, and only balance − reserved. |
The accounting above is not a promise in a whitepaper. It runs in this app today and is published verbatim at github.com/Clippio/clippio-core, pinned by 20 automated tests:
- USD → micro-USDC conversion is exact, including classic float traps ($0.07/1K = exactly 70 micro).
- Rounding only ever floors; payouts and fees are never rounded up.
- Minimum thresholds zero out sub-minimum clips; per-post caps hold at any view count.
- Fee edges hold at 0% and 100%; batch fees never shortchange a clipper; payouts always arrive in full.
- Vault invariants survive 2,000 randomized operations (fund/approve/claim/refund in random order) without ever breaking balance ≥ reserved ≥ 0.
- Refund can never touch approved-but-unclaimed payouts, tested explicitly.
- Batch transfer transactions encode every amount correctly, verified byte-by-byte inside the built instructions.
Clippio is not in the payment path at all, not even as a transaction builder. When creating a campaign, the owner registers the wallet they will pay from. To pay approved clips, they use the payment sheet (each clipper's wallet and exact amount, with copy buttons and Solana Pay links), send the transfers from their own wallet app, and paste the transaction signature. Clippio then fetches the transaction from Solana and matches it:
Paid status is chain-derived. Every paid submission links its transaction; anyone can open it and check sender, recipient and amount. A pasted explorer link proves nothing by itself: a payment counts only when the on-chain transfer matches the approved payout, and only when it comes from the campaign's registered payment wallet. Transfers from any other wallet will not match, which is exactly what keeps the public payment record meaningful.
In build: automatic detection (watching the chain so owners don't need to paste anything) and automated enforcement of the 72h unpaid-approvals pause, which is currently platform policy applied during the pilot.
The vault rules in section 02 are final and their accounting is already implemented and tested (section 03). The on-chain Anchor program that enforces them is in development against the published specification. Until it ships, locked campaigns show vault: pending and pay-as-you-go is the live mode. We will not label anything "trustless" before you can verify it. Here is the exact path:
- 1P1: Guarded mainnet
Program ID published. Upgrade authority held by a time-locked multisig, publicly announced. Any upgrade is visible before it can activate, leaving time to claim and exit.
- 2P2: Soak & review
Weeks of live campaigns plus external review of the public source.
- 3P3: Renounce
Upgrade authority set to None, freezing the code forever, plus a verified build, so the deployed bytecode provably matches the public source.
| Pay-as-you-go (live) | Locked vault (after renounce) | |
|---|---|---|
| Can Clippio take the funds? | It never touches them: payments happen in the owner's own wallet app, wallet-to-wallet. Clippio only verifies them on-chain. | Impossible: no key exists, and no instruction routes funds to the platform. |
| Can the owner rug approved payouts? | They can refuse to pay; the campaign pauses and the record is public forever. | No. Refund cannot touch reserved funds. Enforced by code. |
| Can Clippio fake your views? | The owner approves against the same public post link you submitted. | Same; approvals are explicit and on-chain. |
| What you ultimately trust | The owner's public payment record. | The code, which you can verify yourself. |
Remaining risks, stated plainly: for locked campaigns, deposit and claim transactions will be prepared by our interface, so always check what your wallet shows before signing. That's what the simulation is for. Pay-as-you-go payments never involve our interface at all. And until the program's upgrade authority is renounced, upgrades are possible, which is exactly why they are time-locked and public.
Zero. Clippio charges no platform fees during launch: creating campaigns, joining, submitting and payouts are all free. Clippers receive 100% of what they earn; owners pay exactly the payouts, nothing more. The fee machinery exists in the published code, is tested at every edge, and is set to PLATFORM_FEE_BPS = 0. If fees are ever introduced, they will be a percentage added on top of payouts, never deducted from clippers, and announced here first.
Everything the money touches is published at github.com/Clippio/clippio-core under the MIT license, verbatim from what runs on clippio.fun:
| File | What it proves |
|---|---|
| payments.ts | The payout formula, the fee machinery at 0 bps, the vault accounting state machine, and the batch transfer builder. Integer BigInt math throughout. |
| payments.test.ts | The 20 tests from section 03. Run them yourself: npm install && npm test. |
| ESCROW_SPEC.md | The complete escrow program design: state, the six instructions, invariants, and the renounce path. |
What is intentionally not public: the web application's operational code and the fraud-detection heuristics. Publishing those would hand bot operators a manual for gaming view verification. The money paths above do not depend on them: no heuristic can move funds. When the escrow program reaches guarded mainnet (P1), its source and program ID will be published in the same repository.
Questions or holes in the logic? Reach us through the official Clippio X account. We want to hear them.