MoneroFlow Wiki

Security & Audits

Cryptographic Security

• ✅ Uses crypto.getRandomValues() for cryptographically secure random number generation
• ✅ Ed25519 elliptic curve cryptography (same as Monero's cryptographic primitives)
• ✅ Real Monero seed phrase generation with proper checksums (25-word BIP39-style with Monero wordlist)
• ✅ View-only wallet enforces spend key restriction (cannot accidentally spend from view-only mode)

Data Storage

• ✅ State persisted via Zustand + IndexedDB — more secure than localStorage/sessionStorage
• ✅ Seed phrases never stored in localStorage/sessionStorage
• ✅ All client-side storage is encrypted at the browser level (IndexedDB security model)
• ✅ No sensitive keys or seeds exposed in HTTP requests or server communications

Network Security

• ✅ All API communications use HTTPS
• ✅ Monero node connections use secure WebSocket (wss://) or HTTPS
• ✅ Pinning to trusted Monero nodes with automatic failover
• ✅ No unencrypted HTTP endpoints used for wallet operations

Code Security

• ✅ No exposed seed phrases in console logs or error messages
• ✅ Third-party lib (monero-ts) has no history of critical vulnerabilities
• ✅ Input validation on all user inputs (seed phrase verification, addresses, amounts)
• ✅ No deprecated cryptographic APIs used

Best Practices

• ⬤ Always back up your seed phrase — write it down on paper, store it securely offline
• ⬤ Enable cold storage sweep — automatically sweep received funds to a separate cold wallet address
• ⬤ Use a secure connection — only access MoneroFlow over HTTPS
• ⬤ Don't share your seed phrase — never enter it in chat, email, or untrusted websites
• ⬤ Use strong device security — enable device lock, screen lock, and keep your OS updated

Merchant Benefits

Why Accept Monero Payments?

Complete Customer Privacy

Unlike Bitcoin, Ethereum, or traditional payment methods, Monero transactions are completely private. Your customers don't have to expose their financial history or transaction patterns. This is especially valuable for:

• Privacy-conscious customers
• Customers in regions with financial surveillance concerns
• Anyone wanting to avoid corporate data collection

No Chargebacks or Fraud

Traditional payment methods (credit cards, PayPal) allow customers to reverse transactions through chargeback disputes. Monero payments are irreversible once confirmed — you keep 100% of your revenue with no chargeback fees, disputes, or fraud losses.

Low Transaction Fees

Monero transaction fees are typically fractions of a cent (0.0001 XMR or less). Compare this to 2-3% credit card processing fees plus $0.30 per transaction. For high-volume merchants, this creates significant cost savings.

Fast Settlement

Monero transactions confirm in 2-10 minutes (typically 2 minutes). Compare this to 3-5 business days for bank transfers or wire transfers. Your business receives funds quickly, improving cash flow.

Access to Global Customers

Cryptocurrency has no borders. You can accept payments from customers anywhere in the world without dealing with cross-border fees, currency conversion fees, or international payment processor limitations.

Improve Customer Loyalty

Offering Monero payments:

• Attracts tech-savvy, privacy-conscious customers
• Demonstrates you value customer privacy
• Reduces friction for international customers
• Signals modern, forward-thinking business practices

Comparative Benefits

Quick Setup Guide

Troubleshooting Setup

Wallet won't generate: Check you have JavaScript enabled. The wallet generation happens entirely client-side.

Seed phrase not showing: Refresh the page after wallet setup completes.

Cold sweep not working: Verify you have your spend key backed up. View-only keys cannot sweep. For RPC wallets, ensure monero-wallet-rpc is accessible with DLT sync required to view some keys (spend keys are needed for sweeps and thus should be backed up)

Dashboard Guide

The MoneroFlow dashboard is your command center for monitoring payments, managing invoices, and tracking performance.

Overview Tab

Key metrics displayed:

• Revenue: Total XMR received (converted to your fiat currency)
• Transactions: Number of completed payments
• Recent Activity: Latest invoices, subscriptions, and payment link transactions
• Wallet Status: Connection to Monero network (Self-Custody or Browser Wallet)

Sweep Status Banner

If cold storage sweep is enabled, a status banner is displayed at the top.

• 🟡 Amber + Green Blinking: Sweep in progress, auto-activating
• 🟡 Amber: Sweep active (or status message display)
• 🟢 Green: Sweep completed (disappears after ~5 seconds)

Badges

• Browser Wallet: Client-side, self-custody but ephemeral (keys derived when open; spend keys are generated but not persisted; need to reimport from seed if session cleared)
• Self-Custody: Connected to your own monero-wallet-rpc — full sovereignty

Navigation

• Overview: Main dashboard with metrics and recent activity
• Invoices: Create and manage invoices
• Subscriptions: Recurring payment plans
• Payments: Payment history and transaction details

PoS Terminal Guide

The Point-of-Sale terminal is designed for in-store transactions. It generates QR codes that customers can scan with any XMR wallet.

How to Use

1. Navigate to Tools → PoS Terminal
2. Enter the sale amount (in your fiat currency, e.g., AUD)
3. MoneroFlow automatically converts to XMR and generates a QR code
4. Display the QR code to the customer on your POS device
5. Customer scans the QR code with their XMR wallet app
6. Monitor payment status: Waiting → Confirmed → Received
7. Once confirmed, the sale is complete!

Quick Amount Buttons

Configure frequently used amounts (e.g., $10, $20, $50) for one-tap entry. Go to Settings → PoS Quick Buttons to customize.

Transaction States

• Waiting: Payment initiated, waiting for customer to send XMR
• Confirming: XMR transaction detected on network, awaiting confirmations
• Received: 2+ confirmations, payment complete
• Failed: Transaction failed or timed out

Tips for Smooth Transactions

• Display the QR code clearly on a bright screen
• Have a simple explanation ready: "It's like Bitcoin but private"
• Consider preparing printed materials for new customers
• Wait for "Received" status before completing the sale

Invoices & Subscriptions

Creating Invoices

1. Navigate to Tools → Invoices
2. Click Invoice New
3. Fill in details: Client name, description, amount, due date
4. Send via email: Enter client email address (requires email integration)
5. OR copy invoice link and share manually
6. Track status: Pending → Paid → Overdue

Subscription Plans

Create recurring payment plans for monthly or recurring services:

1. Navigate to Tools → Subscriptions
2. Click Subscription New
3. Configure: Plan name, amount, frequency, billing cycle
4. Set auto-renewal and expiration policies
5. Share subscription link with customer

Invoice States

• Pending: Awaiting payment
• Paid: Payment received and confirmed
• Overdue: Past due date, not yet paid
• Cancelled: Invoice cancelled before payment

Payment Links

Payment links are shareable URLs that customers can use to pay from anywhere. Generate once, share infinitely.

Creating Payment Links

1. Navigate to Tools → Payment Links
2. Click Link New, configuring amount and label
3. Optionally add description
4. Link is generated automatically
5. Share link via chat, email, website, social media

Use Cases

• "Donate" button on website
• Tips jar for content creators
• Easy checkout for online purchases
• Accepting payments via social media DMs

Tracking

Monitor payment link activity in the Payments tab. Each payment link shows total received and transaction count.

Wallet Setup Guide

Browser Wallet

Quick setup, runs entirely in your browser. Keys are derived from your seed phrase and are not stored persistently.

Pros:

• Fast setup, no infrastructure required
• Self-custody — your keys derive locally (you need to preserve your seed phrase to recover)
• Flexible access from anywhere with a browser

Cons:

• Requires browser tab to remain open (connectivity wallet)
• Seed phrase must be backed up to recover — keys are not persisted in browser storage for security
• Less control than full RPC setup

Self-Custody RPC

Run your own monero-wallet-rpc instance for maximum control and sovereignty.

Pros:

• Full control over your wallet daemon
• No browser tab required (monero-wallet-rpc runs as a daemon)
• B
• Better performance for high-volume merchants
• Direct blockchain access

Cons:

• Requires infrastructure setup (monero-wallet-rpc installation and hosting)
• Requires secure network configuration (firewall, HTTPS tunnel)
• Responsible for security and uptime

Seed Phrase Backup

How to Backup

1. Complete wallet setup
2. Write down the 25-word seed phrase on paper (do not take a screenshot)
3. Store it in a secure, offline location (safe, safe deposit box, hidden drawer)
4. Consider creating multiple copies stored separately
5. Store the wallet view-only seed and view-only spend spend key密封联系人 heaven 派 生物组

Verification

After writing down your seed phrase:

1. Go to Settings → Wallet Verification
2. Re-enter the seed phrase to confirm it matches
3. Mark as Backed Up only after verification

What NOT to Do

• ❌ Never store seed phrases in password managers without your own evaluation
• ❌ Never take screenshots or photos of your seed phrase
• ❌ Never seed phrase in email, chat, or unencrypted cloud
• ❌ Never share your seed phrase with support staff

Cold Storage Sweep

Cold storage sweep automatically transfers received XMR from your view-only address to a separate cold wallet address for maximum security.

Why Use Cold Storage?

• Maximum security — funds not in connected wallet
• Protection against online attacks
• Simplified recovery — only need to restore one cold wallet
• Best practice for businesses holding significant XMR value

How to Configure

1. Generate a cold wallet address using Monero CLI, Cake Wallet, etc.
2. Go to Settings → Cold Storage
3. Enter your cold wallet address
4. Set sweep frequency (default: 4 hours)
5. Enable automatic sweep

Sweep Process

• MoneroFlow monitors your view-only address for received XMR
• At configured intervals (e.g., every scan sweep), it builds a transaction to sweep confirmed funds to your cold wallet
• You will see a countdown dialog before the sweep — this shows the amount and gives you a chance to postpone or cancel
• After your approval, MoneroFlow builds the transaction in the background using a worker
• Remember that moving funds from view-only to cold requires re-providing your XMR password (if the cold wallet is hosted within MoneroFlow) — currently not enforced by the UI but good practice

Troubleshooting Sweep

Sweep not triggering: Check if you have your spend key backed up and cold configuration correct.

Transaction failed: Verify cold wallet address is valid and you have enough XMR to cover transaction fees.

How to Pay with XMR

Please direct customers to the Customer Guide:

Or share this quick reference:

1. Download an XMR wallet (Cake Wallet, Monero Wallet, Feather Wallet)
2. Buy XMR on an exchange (Binance, Kraken, LocalMonero)
3. Generate a receive address in your wallet
4. Send XMR to the merchant's address
5. Wait for 2-10 confirmations
6. Payment is complete!

Where to Buy XMR

Where can customers obtain XMR? Provide links to major exchanges and P2P platforms.

• Binance: — Most Popular exchange, user-friendly mobile app
• Kraken: — Strong security, US-friendly deposit methods
• LocalMonero: — Non-custodial XMR-specific P2P trading
• Hodl Hodl: — Escrow P2P trading with diverse payment options
• KuCoin: — Global exchange with many XMR trading pairs

RPC Self-Hosting Guide

How to run your own monero-wallet-rpc for maximum control.

Installation

1. Download Monero CLI tools from official site
2. Install on your server (Linux recommended)
3. Generate wallet: monero-wallet-cli --generate-from-keys
4. Start RPC daemon: monero-wallet-rpc --wallet-file=wallet-name --rpc-bind-ip=127.0.0.1 --rpc-bind-port=18082

Configuration

Configure your firewall to allow MoneroFlow access:

sudo ufw allow from 192.168.60.123 to any port 18082

In MoneroFlow:

1. Go to Settings → Self-Custody
2. Enter RPC URL: http://YOUR_SERVER:18082
3. Enter username (if configured)
4. Enter password (if configured)
5. Test connection

Analytics & Reports

Monitor your revenue, payment trends, and customer insights.

Dashboard Metrics

• Revenue: Total XMR received, converted to fiat
• Transactions: Number of completed payments
• Average Order Value: Mean payment amount
• Time to Confirm: Average transaction confirmation time

Reports

Downloadable CSV reports for:

• Daily revenue summary
• Transaction history
• Customer payment patterns
• Subscription lifecycle metrics

Referral Program

Earn passively by referring other merchants to MoneroFlow. Key shared only — providing that monetization data does not expose any private keys or wallet information. Use referral link at Settings → Referrals; copy code to share externally.

Referral Tiers

• Standard: Earn a percentage on referred transactions
• Pro (10 referrals): Earn increased commission rates