Quarrystone Payments
Merchant payments and subscriptions on Sui.
Merchants accept payments in stablecoins through shared invoice objects. Subscriptions are pre-authorised with capability objects that let a merchant pull bounded amounts per period.
- Ecosystem
- Sui
- Category
- Payments
- Languages
- Move (Sui)
- Launched
- Feb 2026
Grade A · Moderate risk
Sound posture; some improvements recommended.
+0.9 since Feb 2026 · +0.9 since Jul 2026
Quantix Protocol Research · as of 24 Oct 2026 · About this data
Risk Index
How the score is built
| Component | Weight | Value | Points | Gap |
|---|---|---|---|---|
| Code Security | 30% | 84 | 25.2 | −4.8 |
| Operational Security | 20% | 80 | 16.0 | −4.0 |
| Governance Risk | 15% | 82 | 12.3 | −2.7 |
| Economic Security | 15% | 84 | 12.6 | −2.4 |
| Infrastructure Resilience | 10% | 78 | 7.8 | −2.2 |
| Transparency | 10% | 80 | 8.0 | −2.0 |
| Quantix Risk Index | 100% | 81.9 | −18.1 |
| Component | Quarrystone Payments |
|---|---|
| Code | 84 |
| Operational | 80 |
| Governance | 82 |
| Economic | 84 |
| Infrastructure | 78 |
| Transparency | 80 |
Grade scale
- AAA90–100
- AA85–89.9
- A80–84.9
- BBB75–79.9
- BB70–74.9
- B65–69.9
- CCC60–64.9
- CC55–59.9
- C50–54.9
- D0–49.9
Score history
9 monthly snapshots
| Period | Quantix Risk Index |
|---|---|
| Feb ’26 | 81.0 |
| Mar ’26 | 81.0 |
| Apr ’26 | 81.0 |
| May ’26 | 81.0 |
| Jun ’26 | 81.0 |
| Jul ’26 | 81.0 |
| Aug ’26 | 81.9 |
| Sep ’26 | 81.9 |
| Oct ’26 | 81.9 |
11 Aug 2026
Upgrade
Subscription caps hardened
Per-period caps enforced inside the capability.
- Code Security+3
Risk factors
MediumCode SecurityProfile analysis
Missing version gating
After an upgrade, old package functions may still mutate shared objects unless versions are checked.
LowInfrastructure ResilienceProfile analysis
Shared-object contention
High-volume merchants share invoice objects, which can delay settlement under load.
Recommendations
Code Security: 84 → 89
Version-gate shared objects
Store a version field and reject calls from older packages.
+1.5
→ 83.4
Infrastructure Resilience: 78 → 84
Per-merchant invoice objects
Shard invoices to reduce contention.
+0.6
→ 82.5
Analysis
Contract, governance and operations
Contract analysis
- Source
- Verified
- Upgradeability
- Package UpgradeCap held by a multisig
- Administrative control
- Merchant registry admin (multisig)
- Enforced delay
- None identified
- External dependencies
- Stablecoin issuers; Merchant integrations
- PassSource published. Move packages published.
- PassPull-payment limits. Subscriptions bounded per period by capability objects.
- CautionVersion checks. Shared objects do not yet check package version after upgrades.
Governance exposure
Low
Package upgrades and registry admin through a multisig.
Operational resilience
Strong
Merchants manage their own capabilities; revocation is immediate.
Monitoring
Monitoring history
- 2 Sept 2026InformationalPackage upgraded to version 4 with approved digestProxy Upgrade · subscription moduleResolved
Research assessment
No Quantix assessment of Quarrystone Payments has been published. Its security findings are represented by the contract-analysis signals above: 0 failed and 1 cautionary.
Research
Relevant research
Architecture
System components
- invoice module
- Shared invoice objects and settlement
- subscription module
- Pull-payment capabilities with limits
- merchant registry
- Merchant identity and fee settings
Turn risk factors into a remediation plan.
A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.