I build payment infrastructure on Stellar / Soroban: x402 and MPP payment rails, service discovery, and non-custodial treasury automation. This account is the personal contributor identity behind three real projects — Periplo, Nirium, and Contextio — plus the upstream fixes and bug reports that came out of building them.

Most of my public work is either a protocol implementation I maintain or a bug I found in something I depend on and then sent a patch for. Everything below links to the actual issue, PR, or running service — no claim here that you can't click and check yourself. Where something is still open or unmerged, it's marked as such, not implied to be done.

Both cards are rendered live from the GitHub API by github-stats-extended, so the numbers move on their own rather than being typed in here (checked live 2026-08-31, still serving). Some caveats worth stating, since several of these figures look like they disagree and don't:

• The counts above include my own repositories. The tables further down count only repositories I don't own, so those numbers are smaller by design.
• Commits and contributions are different metrics. The card's Total Commits (last year) counts public commits only. The number on my GitHub profile page is the contribution total, which adds pull requests, issues and reviews on top of commits — and private-repo activity too, which GitHub lets you surface as a count without exposing the repositories. A much larger number there is the two metrics measuring different things, not an error in either.
• Contributed to (last year) on the card is a twelve-month count over every contribution type. The per-project tables below are all-time and count only repositories where I opened a PR or an issue.
• Language shares are measured across my non-forked repositories, not across every commit I've pushed somewhere else.

Snapshot below is a live re-check as of 2026-08-31; the search links at the bottom always supersede it. Full first-hand narrative with transaction hashes and reproduction steps lives in Eras256/Periplo's own README.

• x402#3171 — paymentRequirementsMatchAccepted threw on a missing/null payload.accepted. I found and reported it; the code fix was written by @JasonColapietro in #3180, merged 2026-08-17. The merged patch is his work, not mine — my part was the report.
• x402#3270 — HTTPFacilitatorClient.settle()/verify() decoded the EXTENSION-RESPONSES header and then discarded it. I fixed this on Periplo's own side the same day rather than waiting on upstream. The finding then rippled into three independent upstream fixes, none written by me, all still open and unmerged as of 2026-08-31: #3278 (TypeScript, @Bartok9), #3301 (Go, @wnjoon), and PhilBot402/x402#4 (Python, draft, @PhilBot402, opened against a fork, not yet against the upstream repo).
• eas-sdk#132 — getUIDsFromAttestReceipt trusted log topic0 without checking the emitter address. Closed as completed. (General dependency finding, not tied to a specific product below.)

x402-foundation/x402 — #3121, #3148, #3169; stellar/js-stellar-sdk — #1681, #1683; OpenZeppelin/stellar-contracts — #839 (CAP-71 delegated auth trap hit while building Periplo's smart-account extension).

This is Nirium's own repo, so these are bounties Nirium posted, not upstream contributions Nirium made elsewhere. Full live audit as of 2026-08-31: 44 issues across three campaigns (Official Campaign, FWC26, Third Campaign). 42 of those are real bounty asks (the other 2 are unlabeled resource suggestions, not bounties). Of the 42 bounty asks:

• 20 delivered, each with a merged PR inside nirium-sdk itself.
• 2 delivered externally, as real PRs against the target repo, both still open and awaiting that project's own review: #75 → Fundable-Protocol/fundable-sdk#8 and #76 → wejoona/api#23. Both were opened by the same bounty contributor, @Santia2004 — not by this account.
• 4 were closed and administratively recreated under a later campaign, same ask, new issue number: #29→#43, #30→#44, #31→#45, #32→#46.
• 16 closed without any delivery.

A few of the stronger merged deliveries, cited by bounty issue alongside the PR that closed it, since that's better evidence than a bare PR link:

One more worth naming separately because it isn't a bounty at all: #81 was a real fail-open vulnerability in the Next.js x402 example (any X-PAYMENT header granted access, valid or not), reported by an outside party and fixed the same way as everything above — a merged PR, #84.

Separately, nirium-pollar-adapter#1 (deferred wallet funding) merged 2026-08-29, and nirium-sdk#68 (restore viem as a direct dependency) merged 2026-08-26 — both real fixes by this account, not bounty deliveries.

Contextio moved from a personal repo (Eras256/Contextio) to its own org, contextio — Eras256/Contextio now resolves to contextio/Contextio. The planner logic behind its treasury/payroll rebalance decisions was extracted into a separate private repo, contextio/contextio-agent-planner, consumed by the main repo as a private git dependency.

Contextio also runs a bounty-style program, though not GrantFox-labeled like Nirium's: five open issues in contextio/Contextio, all opened by this account, none delivered yet — #1 (Python client parity), #2 (Go client parity), #3 (standalone offline LCP conformance verifier), #4 (GitHub Action to verify a published LCP document in CI), and #5 (CONTRIBUTING.md). Issue #5 already has two competing external submissions, both open and unreviewed: #6 by @mayankbohara0-dev and #7 by @CharoenwitKunna.

Upstream, to stellar/stellar-dev-skill (not owned by Contextio): three merged PRs adding and refining the Contextio SDK's community-skill listing — #98, #101, and #102, all merged 2026-08-15.

Beyond that, I found no upstream contribution from this account to any other external repo specifically for Contextio. Said plainly rather than padded: Contextio's public footprint on this account is its own repo plus that one skill listing, not a wider trail of dependency fixes the way Periplo and Nirium have.

Found using these libraries for one of the three projects above, but not clearly attributable to a single one:

• Creit-Tech/Stellar-Wallets-Kit#105 — signMessage()'s JSDoc says SEP-43 hex, Freighter returns base64. Open.
• foundry-rs/foundry#16209 — cast wallet new <name> still fails with a bare account name. Open.

Protocols — x402, MPP (Charge and Channel), SEP-41 / SAC, SEP-43, SEP-53, CAP-71 delegated auth, MCP Chains — Stellar / Soroban primarily; some EVM and Solana work

• Small PRs, one root cause each, with the reproduction in the description.
• If I file a bug in a dependency, I try to open the fix alongside it when I can — #3187 → #3228, #840 → #844. When someone else beats me to the fix, I say so and name them — #3171 → #3180 by @JasonColapietro, #3270 → #3278/#3301/PhilBot402#4 by three other contributors.
• When I'm not sure whether it's my bug or theirs, I say so in the issue rather than asserting a diagnosis I can't back (#839 is an example).
• Every contract I ship is non-custodial by construction: the client signs, or a role that by contract design can't move funds — never a key of ours that can.

Snapshot above is accurate as of 2026-08-31; these always supersede it: all my PRs · all my issues · nirium-sdk's full bounty board · Contextio's open issues

Open an issue on any repo above, or start with periplo.xyz · nirium.xyz · contextio.xyz