ProveX: payment proofs, the sacrifice and PRVX

What is ProveX?

According to provex.com, ProveX removes the exchange as middleman between crypto and bank money. A seller locks crypto in an escrow smart contract; the buyer pays in their own bank or payment app; a browser extension turns that payment into a zero-knowledge proof; and the contract releases the crypto when the proof checks out. The site claims no account and no identity check are needed. A second product, “Prove your identity”, creates a zero-knowledge proof that you control an X or Discord account and can anchor it on PulseChain, bound to your wallet.

The site footer says ProveX is built on ZKP2P, an open-source project. The code confirms it: the escrow contract deployed on PulseChain is line for line the same as contracts/EscrowV2.sol in the public ZKP2P repository (MIT licence, commit 0b22bfb7 of 2026-10-16; diff 0 lines).

How does Richard Heart explain it?

In his video of 2025-12-02 (tier 2, our paraphrase):

• Websites and mail servers prove their identity with TLS certificates. That makes it possible to produce a cryptographic proof of what a server said — so a buyer can prove “I sent the money” without screenshots and without revealing anything else, which removes counterparty risk in person-to-person trades (04:32–07:30).
• The project is branded ProveX rather than marketed through its underlying technology; the version without a token can be tried at zkp2p.xyz, and ProveX adds a token and token burning (07:30–09:01, 12:32–13:30).
• No banking partner is needed: it is person-to-person software that users run themselves (36:04–37:30).

Who runs ProveX?

This is not stated. Neither provex.com nor the official X account @ProveXCom names a team or a legal entity (checked 2026-10-17). Richard Heart presented and explained the project in the video above; this portal attributes nothing beyond that. On-chain, the PRVX token was deployed from 0xF6976f0355D510DC1C8239F8A1b31EA7b513926A, and the app contracts were deployed from — and are owned by — 0x948eB6D3A08BEb29Dc1D08d09753862573A94122; both are single-key addresses, and the chain does not show who holds them.

Which addresses are official?

Several tokens named “ProveX”, “PRVX” or similar exist on PulseChain; some were even sent to the sacrifice address. Only the address above is named by the official site — check the address, not the name. More on copycats: Security.

How does the app work on PulseChain?

The current contract set (“v4”, from the app’s build) was deployed on 2026-07-24 between 15:59 and 16:00 UTC (blocks 27,112,395–27,112,403). Trades on PulseChain settle in USDC from Ethereum (0x15d38573d2feeb82e7ad5187ab8c1d52810b1f07), the bridged USDC. The app also supports Base. An earlier contract set owned by the same key was deployed on 2026-01-12 (blocks 25,512,608–25,512,659); its orchestrator is still listed in the registry (see who controls the app contracts).

Usage of this contract set is small: on 2026-10-19 (block 27,837,197) the escrow’s depositCounter() was 9, and its orchestrator had paid 14.63484 USDC in fees — at 2 %, about 732 USDC of settled trades. An earlier contract set owned by the same key, deployed on 2026-01-12 (blocks 25,512,608–25,512,659), saw more use: its escrow 0x0b42393d4dba08892d339b32cd3064248003f11a had 198 deposits, and its orchestrator 0x742d48639f44701bff5a0a441600ad6da4a3b080 had paid 1,116.300783 USDC in fees to the same fee address — at 2 %, about 55,815 USDC of settled trades.

Who controls the app contracts?

The admin key has no function that sends a deposit to itself directly. But the escrow locks and releases deposit funds on the instruction of any orchestrator listed in the registry, to whatever address that orchestrator names (EscrowV2.sol:107-110, :728-878) — and the same single key decides which orchestrators are listed. In our reading of the code, that key could therefore list a contract of its choice and move funds of deposits that are open for trades. On 2026-10-19 (block 27,837,197) the registry listed two orchestrators — the one above and 0x742d48639f44701bff5a0a441600ad6da4a3b080, the orchestrator of the earlier contract set, both added on 2026-07-24 — and neither the escrow nor the orchestrator was paused. Funds in the escrow depend on that one key, much like funds in the PulseChain bridge depend on its admin keys.

Where does the 2 % fee go?

provex.com says that a 2 % fee — 1 % from the buyer and 1 % from the seller — is collected and automatically used by a smart contract to buy PRVX and burn it; Richard Heart points to the same 2 % buy-and-burn in his video (10:30–11:00).

What the chain showed on 2026-10-19 (PulseChain block 27,837,197):

So, as of that date, any buy-back and burn would have to be done by the fee address in separate transactions, and none had happened. Richard Heart said in 2025 that the minimum product is the software working with the token and token burning, and that the token can launch before the burn mechanisms exist (34:31–35:30). Whether burns follow later, or run through another address, has to be re-checked; the site’s “1 % + 1 %” split versus a single 2 % fee in the code is a wording question only the project can clarify.

Has ProveX been audited?

No third-party audit report for PRVX or for the ProveX deployment has been found. The PRVX source contains a comment “[M-01 fix]”, which suggests that some review took place, but no report is published. The upstream ZKP2P repository’s audits/ folder holds only a description of an automated audit workflow, not a third-party report.

What happened when?

Where are the allegations?

On-chain analysts have made claims about the sacrifice funds. They are not facts and are not repeated here; they are listed as claims, with their status, on the legal timeline.