Buyer's Guide: Safely Buying Source Code and SaaS Licenses (with Inspection Checklists)Buyer's Guide:Safely Buying Source Code and SaaS Licenses (with Inspection Checklists)

TL;DR On OpenVPT your USDC goes into an on-chain escrow, not straight to the seller. After delivery you get an inspection window (3 days by default; check the listing). Sign to release the funds if everything checks out, or open a dispute with evidence before the window closes. The platform can't move escrowed funds alone: every payout needs two of three signatures (buyer, seller, platform signer). Below: every step, plus inspection checklists for source code, SaaS licenses and website transfers.

Why digital goods need an inspection step#

Downloaded code can't be "returned", a license key may already be active elsewhere, and a domain may still sit in someone else's registrar account. Most disputes aren't about receiving nothing but about receiving something that doesn't match the listing: a missing module, a failing build, a non-transferable license, inflated traffic.

That's why OpenVPT separates paying from releasing:

1. When you pay, the funds go into the VPTEscrow contract. The seller can't touch them yet.
2. Once the seller delivers, the inspection window starts.
3. The seller is paid only after you confirm and sign. If something is wrong, you open a dispute and an arbitrator decides how the funds are split.

Step 1: Choose a listing and size up the seller#

Before comparing prices on Listings, check the following.

What to read on the listing#

• How specific the description is. Good listings name the stack and versions and say what is and isn't included. "Full-featured" gives you nothing to inspect against.
• Delivery method. OpenVPT supports three: a file (its SHA-256 hash is recorded on upload), a license key (stored encrypted), or a delivery checklist (item-by-item handover steps, useful for websites and account transfers).
• Delivery and inspection windows. Each listing shows how many days the seller has to deliver (3 by default) and how many days you have to inspect (3 by default; sellers can set anywhere from 1 to 30). A complex codebase or site migration may need more than a short window.
• Price and currency. Listings are currently priced in USDC on Base.

What to check about the seller#

• Profile and reviews. Reviews on OpenVPT can only be left once an order is completed or refunded, and only by the two parties to that order.
• Seller requirements. To sell on OpenVPT, a seller has to pass identity verification (KYC status verified) and prove control of their payout wallet with SIWE (Sign-In with Ethereum). That rules out throwaway accounts, but it is not an endorsement of product quality.
• How they communicate. Ask questions in chat first; specific answers and a willingness to demo say a lot.

Questions to ask before you order#

• Is this code, license or site still in use? Has anyone else bought the same copy?
• Do the license terms allow transfer or commercial use? Can you show the original license?
• What exactly is delivered (docs, database schema, deployment scripts)?
• If anything has to be migrated (domain, hosting, third-party accounts), who does which step, and how long will it take?

Keep the answers in on-platform chat: they're your evidence if things go wrong.

Step 2: Connect a wallet and get USDC on Base#

OpenVPT payments use USDC (a dollar-denominated stablecoin, 6 decimals) on Base (an Ethereum Layer 2). New to these? See the Base docs↗ (opens in a new tab) and Circle's USDC page↗ (opens in a new tab).

To get ready:

1. Use a wallet where you hold the keys, either a browser extension or a mobile wallet connected through WalletConnect. Nobody, including anyone claiming to be OpenVPT support, should ever ask for your recovery phrase.
2. Switch the wallet to the Base network. USDC on another network is a different asset.
3. Hold enough USDC to cover the order amount.
4. Keep a little ETH on Base for gas. Funding takes two on-chain transactions: an approve so the contract can pull your USDC, then the fund call itself. Confirming later is just a signature; the platform submits settlement for you.

How you get USDC depends on where you live. This article doesn't recommend any particular provider and isn't investment or financial advice. Check local rules and understand the risks yourself.

Step 3: Place the order and fund it#

Creating the order#

When you click buy, OpenVPT creates an order in pending payment state and gives you funding parameters. These include a platform signature over the order, so the amount, fee and seller address can't be tampered with.

Two timers apply:

If the payment page has been open a while, refresh it; no new order needed.

Funding#

1. Approve the contract to spend the order amount of USDC.
2. Send the funding transaction.
3. Wait for confirmation. Once the indexer sees the funding event with enough confirmations, the order moves to funded and the seller starts preparing delivery.

Now the money sits in escrow. The contract has no function that lets the platform move funds on its own. The contract owner can pause new funding, rotate the platform signer, and manage the token allowlist and fee recipient. The owner cannot settle orders or withdraw escrowed funds.

If you want to cancel#

You can ask to cancel at any point before funding. OpenVPT uses a deferred cancel, though:

• After you click cancel, the order shows as "cancelling" and no new funding parameters are issued.
• In case an earlier funding transaction is still waiting to be mined, the system waits until every funding signature you might hold has expired, adds a grace period, checks the chain, and only then marks the order cancelled.
• If your payment does land in the meantime, funding wins: the order becomes funded as normal and the cancel request is dropped.
• If a payment is confirmed after the order has already been cancelled, it goes through a full refund. The platform signs, you co-sign, and all of the USDC comes back to your wallet.

A cancel isn't instant, but your USDC never ends up stranded in escrow.

Step 4: Wait for delivery#

The seller has to deliver within the number of days shown on the listing. If they miss that deadline, a full refund starts automatically: the platform signs, and you sign the refund on the order page to get your funds back.

When the seller delivers, the order page shows:

• File delivery: file name, size and SHA-256 hash, plus a short-lived download link (you can request a new one when it expires).
• License key: stored encrypted by the platform and shown only on the order page to the parties to the order (and platform staff handling a dispute).
• Delivery checklist: the handover steps the seller says are done.

The inspection window starts at delivery.

Step 5: Inspect, with checklists for each type#

One check applies to every file delivery: verify the hash. Compute the SHA-256 of what you downloaded and compare it with the value on the order page.

# macOS / Linux
shasum -a 256 your-download.zip

# Windows PowerShell
Get-FileHash .\your-download.zip -Algorithm SHA256

A match proves you have exactly the file the seller uploaded, which settles "what was delivered" in any dispute.

A. Source code#

• The archive extracts cleanly and the folder structure matches the description
• Following the README, dependencies install from scratch and the project builds (use a clean machine or a container)
• It runs locally, and every headline feature in the description works
• The included tests run, with a pass rate that matches what the seller claimed
• The LICENSE and third-party dependency licenses fit your plans: watch for copyleft terms such as the GPL if you intend commercial use, and for paid components you'd need to buy separately
• No secrets are left behind: API keys, database passwords, .env files, private keys. If found, ask the seller to revoke them, since they may still control those services
• Nothing has been stripped out, obfuscated or encrypted, and there's no hidden license check that phones home to the seller's server
• Database schema, migrations and deployment docs are all included

A quick first pass for secrets:

# Rough scan for suspicious strings
grep -rniE "api[_-]?key|secret|password|private[_-]?key" --exclude-dir=node_modules .

B. SaaS licenses#

• The key activates, under your own account or domain
• Transferability: the vendor's terms allow a transfer, and you know whether the vendor has to approve it
• Seats and usage: seat count, API quota and storage match the listing
• Term: expiry date, whether it auto-renews, and who pays for renewal
• It isn't still tied to the seller's payment method or account, so it won't lapse if they cancel their subscription
• You've saved a screenshot of the license status page, showing expiry and seats

C. Website transfers#

• Domain: moved into your own registrar account (not just a login to the seller's account), registrant details updated, transfer lock and expiry date checked
• Hosting: code and data migrated to hosting you control, or the hosting account formally transferred
• Data: full database export, with record counts roughly matching the description. If it includes users' personal data, check that transferring it is allowed where you and your users are
• Accounts: analytics, ad networks, social profiles, email services and payment gateways handed over, and every password changed with two-factor authentication turned on
• Revenue and traffic claims: verified live in the analytics dashboard or on a screen recording, not from static screenshots
• Every item on the seller's delivery checklist matches something you've actually confirmed

Running out of time? Raise specific concerns in chat before the window closes. When it ends, settlement to the seller starts automatically and you can no longer dispute.

Step 6: Confirm and sign#

When everything checks out, click confirm on the order page. Here's what happens:

1. OpenVPT prepares a settlement proposal (a Settle message) describing how the escrowed amount is split.
2. The platform signs it automatically.
3. You sign the same proposal in your wallet. It's a signature, not a transaction, so there's no gas to pay.
4. With two signatures collected, the platform submits the settlement on-chain and the funds are paid out.

Take a 1,200 USDC order with the default 5% platform fee:

The fee comes out of the seller's share; you pay the listed price. Check the split in your wallet before signing.

Step 7: Open a dispute, with good evidence#

Talk to the seller first; missing files are often fixed fast. Otherwise, open a dispute from the order page before the inspection window closes.

How disputes work#

• Only the buyer can open a dispute, and only on a delivered order that's still inside its inspection window.
• Give a reason (at least 10 characters): what was promised, what you got, how they differ.
• While the dispute is open, both sides can add evidence: text, files, or links (http/https only).
• An arbitrator is assigned and rules on the share the seller should receive. That can be a full refund, a full release, or any split in between.
• The platform signs the settlement that matches the ruling, one of the parties (usually the one receiving funds) co-signs, and the platform submits it on-chain.

In the current version the ruling is final. There is no appeal process, so make your evidence as complete as you can the first time.

How a split is calculated#

Same 1,200 USDC order, and the arbitrator awards the seller 30%:

The fee applies only to the seller's portion; refunds carry no fee.

What good evidence looks like#

• Reproducible steps, e.g. "On a clean Node 20 environment, npm install && npm run build fails at step X; the error log is attached."
• Side-by-side comparison of the listing text and what you received.
• The hash: quote the SHA-256 from the order page to show you tested the delivered file.
• Timestamps on screenshots and recordings.
• Chat excerpts: what the seller promised on-platform. OpenVPT keeps the chat, but arbitrators can't read it directly yet, so submit screenshots or excerpts of the key messages as evidence.

Skip vague claims like "it doesn't work". Arbitrators need checkable facts.

Stay on-platform: contact-info warnings#

OpenVPT's chat detects contact details such as email addresses, phone numbers, Telegram, WhatsApp and WeChat handles, along with off-platform payment links and requests to "pay directly". Flagged messages aren't blocked, but both sides see a warning.

Treat that warning as a red flag:

• "I'll give you a discount if you pay outside" and "Let's continue on Telegram" are classic openers for scams.
• Anything you pay outside escrow can't be refunded or disputed.

If the other party is banned mid-order, your order isn't frozen: a missed delivery deadline still triggers a refund, and a delivered order can still be confirmed or disputed.

This article explains how OpenVPT works. It isn't legal, tax or investment advice. For license terms, personal-data transfers or cross-border deals, get professional advice where you need it.

Next steps#

• Related reading: Why OpenVPT settles in USDC on Base
• Related reading: Disputes and arbitration
• Browse Listings and use these checklists on your first purchase
• Read How it works for the full escrow and signing flow
• See Pricing for platform fees
• Find answers in the Help center, or contact us