[PLATFORM] XMRMatters P2P Exchange: 15 Days on Mainnet and Architecture Overview

their previous threads in here are full or very concerning red flags, their reddit thread got tagged as misleading:
https://redlib.catsarch.com/r/Monero/comments/1uexajc/p2p_exchange_dex_esrow_xmrmatters_is_officially/

too shady, wouldnt use, wouldnt recommend:

@SpinningCat You're making some pretty loud assumptions here, which is interesting considering you clearly skimmed right past the architecture breakdown in the original post.

I understand the project is closed-source, meaning you can't just go audit the repository yourself to see what's under the hood. But since you're already drawing conclusions, would you like me to provide the deeper architectural overview and the 'about' file?

It expands on the engineering logic I mentioned above, specifically how we manage the fail-closed financial backend, the loopback boundaries, and the strict zero-retention setup.
I am completely open to analytical, technical critiques regarding the custodial model, as long as they are grounded in the actual specs rather than blind dismissals.

We all only live this life once, so there's no point in wasting time on negativity when we could be having a genuinely constructive debate. Let me know if you want to read through the deeper documentation, and we can have a real discussion about the engineering.

You're making some pretty loud assumptions here,

• your uppercases tags are loud af
• you reposting a thread for it every 2 weeks is loud af
• you viewbotting your thread is loud af

considering you clearly skimmed right past the architecture breakdown in the original post.

yup, we already had enough back and fourth already on why your architectural design is doing more harm than anything already, including the fundamental design of your service being centralized which will always be the case
and not decentralized = desensitizing people to using centralized services (creating more harm than anything)

I understand the project is closed-source

we went through that already, even in the case you would open-source, it wouldnt fix the fundamental design flaw of your project being centralized regardless

so gonna repost this yet again, because everytime you're making a new thread, context is lost, from a different service with similar fundamental flaw as your service:
https://redlib.catsarch.com/r/Monero/comments/1ty3cvf/new_whale_on_btcxmr_atomic_swap/

meaning you can't just go audit the repository yourself to see what's under the hood.

i wouldnt know how to audit the repository myself anyways but again, not like it would matter as just explained above, since you can just serve literally whatever code on your server's end to the users

would you like me to provide the deeper architectural overview and the 'about' file?

no thanks, not a decentralized architecture so not interested to read some LLM written README.mdfor it in the first place

It expands on the engineering logic I mentioned above, specifically how we manage the fail-closed financial backend, the loopback boundaries, and the strict zero-retention setup.

I am completely open to analytical, technical critiques regarding the custodial model, as long as they are grounded in the actual specs rather than blind dismissals.

you mean expecting your userbase to work for you for free? while still being on an outdated architectural design by being centralized....
like when mentioned to you that using your service, users would still have to learn how to use PGP/GPG on top of literally whatever encryption you're serving them
and that would already be a harder step for the users you claim you want to onboard
("because using an app is too hard for everyday joes and janes but learning to use PGP/GPG isnt")

/facepalm

We all only live this life once

right, so what's the point in wasting this precious time alive by building centralized services that are flawed by design rather than focusing on this very precious time to build tech that actually matters, despite your name "xmrmatters", the design of your service dont and should be deprecated already for something worthy of this space:

• opensource
• decentralized

if it's not, it's waste of time, you only live once tho, gotta scam (or worse) as much people as possible with design like yours i guess

so there's no point in wasting time on negativity when we could be having a genuinely constructive debate.

you're wasting my time every 2 weeks

Let me know if you want to read through the deeper documentation, and we can have a real discussion about the engineering.

no thanks, seems like you just gonna post a new thread every 2 weeks
so just gonna post a PSA thing on your thread every 2 weeks, that's pretty much it

@SpinningCat Let's break this down analytically, because you are arguing against a platform you just admitted you don't even understand.

First, you literally stated: "i wouldnt know how to audit the repository myself anyways." That tells me everything I need to know about the depth of your critique. You are aggressively criticizing architectural design choices while admitting you lack the technical literacy to audit the code you are demanding be open-sourced.

Second, your claim that users have to "learn how to use PGP/GPG" proves exactly why you need to read the documentation before attacking a project. Users do not touch PGP. The platform automatically encrypts trade chats at rest using a server-side public key. It is entirely invisible and zero-friction for the user, designed solely to protect their data in the event of a server breach. If you hadn't dismissed the documentation, you would know this instead of inventing flaws to be angry about.

Regarding centralization: Yes, XMRMatters is a custodial escrow platform.
I have been 100% transparent about that. Atomic swaps and pure DEXs are fantastic, but they fundamentally struggle with dispute resolution, cash-by-mail, and broad fiat liquidity.

Custodial P2P platforms serve a crucial, practical role in real-world fiat onboarding.
Acknowledging that reality doesn't "desensitize" anyone; it provides a necessary bridge for Monero adoption.

I post updates because I am actively shipping code, pushing daily stability patches, and maintaining a 99.8% uptime platform, not "viewbotting." And to be clear, my use of that term was about operational autonomy, running an independent, self-hosted infrastructure isolated from corporations. Rather than on-chain network consensus.

If you want to spend your one life copy-pasting an uninformed PSA every two weeks on a project you refuse to research, feel free. It just gives the thread more engagement.

I am going to keep building.

Users do not touch PGP. The platform automatically encrypts trade chats at rest using a server-side public key.

not good enough, trusting the platform does the encryption is just wrong, and claiming that users should trust you on that is massive honeypot redflag

users would still have to touch PGP to do it on top of your thing, like, you're serving them a condom that might have been pierced with a needle beforehand, they would have to use their own trusted condom on top of it u know

common sense

Regarding centralization: Yes, XMRMatters is a custodial escrow platform.

alright so you can fuck off then, literal coinbase wannabe out here stg

Custodial P2P platforms serve a crucial, practical role in real-world fiat onboarding.

you're literally lying tho, this is pure corporate speak for "you should use our service, trust"
thinking people are literal retards that using a DEX is too complex for them

"Why You Lying"

We gon' play with them pistols
We smoking dank in my liver
We get shit wet like the river
We get shit wet like the river
I'm with the shit like Austin Rivers

On my side, its getting wicked, nigga slide
Momma told that boy to shake the city, so he ridin
On that Mac it be a titty, show no pity when we divin'
Roll yo body in the gang and before he hit it why you hidin?
OG Nine we dropping bags, no I don't bitch why you lying?
And this collar, popping tags, spent 5 racks on my designer
And put 15 up on yo ass boy, that's yo ass after we find him
Make shit sizzle off the drip and no lil rizzle on my timing
Them fuck nigga that gon' hate me, let em hate me that's they problem
I'm fucking on a cougar and lil' jat its his momma
You know them K's they go through big but them AR's they bout that drama
I fuck with Don that boy my ace, you know, my spade all I do call 'em

Lil' Fleezy die down, oh it's the right time, oh she'll drop that strap on anybody right now
OD my lifeline
And let Lil Leak out
Glock with a dick its tryna' piss, don't let him peak out
He drove a stolen through them yellow lines a street now
They know G-Nine a whole a felon where the G9
They know lil OD got 2 7 40 piece now
I bought my momma a new house I got the leash now
I told em rack em up
Nigga run up on Nine watch how I back em up
Black as fuck, yeah I know my skin tone but I'm gon' wack wassup
These diamonds dancing, yeah you see G-Nine, that boy be shining hard
My pistol with me, whatever you think it is boy, that ain't what it was

On my side, its getting wicked, nigga slide
Momma told that boy to shake the city, so he ridin
On that Mac it be a titty, show no pity when we divin'
Roll yo body in the gang and before he hit it why you hidin?
OG Nine we dropping bags, no I don't bitch why you lying?
And this collar, popping tags, spent 5 racks on my designer
And put 15 up on yo ass boy, that's yo ass after we find him
Make shit sizzle off the drip and no lil rizzle on my timing
Them fuck nigga that gon' hate me, let em hate me that's they problem
I'm fucking on a cougar and lil' jat its his momma
You know them K's they go through big but them AR's they bout that drama
I fuck with Don that boy my ace, you know, my spade all I do call 'em

Oh you know spacesticks
I'm playing trunk, you on some Donald Trump slave shit
I call my cook, he cook shit up, that boy go crazy
I set the path, you niggas follow, walk the pavement
I say this path is how the fuck G-Nine made it
We on that streetlight, we the ones who fucking claim it
Fall out squeek, that's on she squeek that's on my baby
More straps than the army and the Navy
They better come with a lil' army, get cremated
My momma said Jacquavius baby you famous
I got a brother named Lil Block, boy he gon swang it
And J-Beezy he gon shit we call him anus
How Huncho he swing that stick, he ain't gotta aim it
Nigga slidin' in my city for a payment
Make your boy vacant, make him rearrange his stay-in
I'm tired of fakers, why the fuck these niggas faking?

On my side, its getting wicked, nigga slide
Momma told that boy to shake the city, so he ridin
On that Mac it be a titty, show no pity when we divin'
Roll yo body in the gang and before he hit it why you hidin?
OG Nine we dropping bags, no I don't bitch why you lying?
And this collar, popping tags, spent 5 racks on my designer
And put 15 up on yo ass boy, that's yo ass after we find him
Make shit sizzle off the drip and no lil rizzle on my timing
Them fuck nigga that gon' hate me, let em hate me that's they problem
I'm fucking on a cougar and lil' jat its his momma
You know them K's they go through big but them AR's they bout that drama
I fuck with Don that boy my ace, you know, my spade all I do call 'em

@SpinningCat Pivoting to lyric walls suggests an absence of technical arguments, so let's stick to objective engineering and market realities.

Server-side PGP encryption is standard defense-in-depth for database hardening to ensure historical logs aren't exposed in plaintext during a compromise. It is an infrastructure security layer, not a replacement for client-side privacy, and it doesn't stop users from encrypting messages locally with their own keys.

Regarding escrow, while atomic swaps excel at crypto-to-crypto trades, they cannot arbitrate real-world fiat disputes like cash-by-mail theft or bank reversals. Platform-managed escrow is a practical necessity to mitigate fraud during fiat onboarding, which is the exact operational model that sustained platforms like LocalMonero for years.

Furthermore, the platform is completely self-hosted.
My earlier references to architecture were about this operational autonomy and total isolation from corporate cloud infrastructure, rather than a claim of protocol-level decentralization. If you have a mathematically sound proposal for handling uncollateralized fiat dispute resolution without a trusted mediator, I am open to analyzing it.

Otherwise, the logic stands, the platform is live, and I am going to focus on shipping code.

so let's stick to objective engineering and market realities.

so let's stick to haveno and DEXs because market realities has been proven that people that didnt encrypt on top of similar services literally got their shits leaked

you're a honeypot wannabe and can fuck off

https://yt.chocolatemoo53.com/watch?v=6ho8EYjE_cc

https://yt.chocolatemoo53.com/watch?v=nVV7FRhmqCk

@SpinningCat You are recycling basic Monero history and pretending it is a groundbreaking technical critique. Everyone in this community already knows that past platforms suffered plaintext database leaks. That is exactly why XMRMatters enforces automated server-side PGP encryption at rest, ensuring that if a compromise ever happens, attackers only get unreadable ciphertext.

You are screaming "honeypot" at the exact defense-in-depth mechanism engineered to prevent the historical flaws you are referencing.

Similarly, everyone knows Haveno exists and is a great protocol. But even Haveno relies on trusted human arbitrators to resolve physical cash-by-mail and bank fraud because decentralized code cannot verify real-world fiat delivery. You haven't brought a single new, insightful, or useful piece of information to this thread that the community didn't already widely understand.

You are just repackaging common knowledge with emotional rhetoric because you lack the technical depth to actually critique the architecture.

The platform is live, the logic is sound, and I am done wasting time on your noise.
I genuinely wish you luck and strength with your bi-weekly copy-paste crusade.

@xmrmatters

because you lack the technical depth to actually critique the architecture.

do you have the technical depth tho?
probably not cause it's closed source, so most likely written by LLM, like you been using for the most basic human shit "writing a forum post"

Everyone in this community already knows that past platforms suffered plaintext database leaks.

do they tho? i thought they were too retarded to use a DEX so they needed to use a centralized closed source service like yours because they too dumb in the head that they have to use known documented flawed designs

edit:
and you have been caught lying on multiple occasions, so the whole trust thing for you just goes out the window
tryna call me out on not having the technical knowledge while you literally lied previously about "being a DEX"
was it you not having the technical knowledge making the difference between "centralized" and "decentralized"? or just lying?
irregardless, you lied multiple times
you're not trusted, and yet want users trust, imo you're honeypot/scammer confirmed

@SpinningCat Accusing both the platform's code and these forum posts of being written by an AI is a weak deflection, especially since I explicitly offered you the deep architectural overview and the about file detailing our engineering logic, and you flatly refused to read it.

Demanding to evaluate a project's codebase while actively running away from the actual technical documentation when it is handed to you proves you are here for theater, not an actual engineering review. Running bare metal nodes, containerized RPC environments, and isolated financial backends requires writing robust code, not generating text prompts.

Your accusation of lying is a deliberate distortion of a simple terminology mistake.
Conflating operational decentralization, by which I meant a completely self-hosted infrastructure isolated from corporate cloud networks, with blockchain protocol consensus is a classification error, not a lie.
Mischaracterizing an immediate and transparent clarification as being caught lying is just a desperate attempt to manufacture a scandal because you cannot argue the actual tech.

You also continue to stubbornly confuse human intelligence with the functional limits of software.
Users do not choose platform-managed escrow because they are incapable of using a DEX. They choose it because no decentralized protocol on earth can natively arbitrate real-world fiat fraud, verify physical cash-in-the-mail deliveries, or reverse legacy bank wires. Escrow serves as a practical logistical bridge for fiat onboarding, which is the exact operational reality that successfully sustained platforms like LocalMonero for years.

You have already openly admitted that you do not know how to audit code, you have proven you do not understand infrastructure data protection like at-rest encryption, and you refuse to read the documentation when offered. You are simply a loud bystander throwing blind insults because the actual engineering is entirely over your head. This conversation is officially over as I am going to focus my time on shipping updates and running the marketplace. I genuinely wish you luck and strength.