Imagine you launch a P2P exchange, but within a week you encounter scammers who cancel transfers after receiving crypto. Or a seller fails to send coins after receiving fiat. Without a reliable escrow mechanism, such a platform quickly loses trust.
We develop Telegram bots for P2P exchange where each deal is protected by an escrow smart contract. Over 5 years, we have delivered more than 50 projects — from simple single-page bots to multi-currency platforms with ratings and arbitration. Using an escrow contract reduces fraud risk by a factor of 10 compared to a trust-based model.
A smart contract on the blockchain guarantees that funds cannot be frozen by a third party, and automatic execution of deal conditions eliminates human error. We use battle-tested OpenZeppelin templates and audit code with Slither and Mythril. Each contract undergoes formal verification against the specification.
How the deal process works
The seller creates an order in the bot: specifies the amount, rate, and payment method. The buyer finds the order and clicks "Buy". The bot reserves the seller's crypto and sends the buyer the fiat transfer details. The buyer transfers money and confirms payment in the bot. The seller checks the receipt and confirms it. The smart contract automatically transfers crypto to the buyer. If either party fails to meet conditions, a dispute mechanism is triggered. A moderator reviews evidence and makes a ruling — the contract executes forcibly.
Why an escrow contract is crucial
Without a smart contract, P2P exchange is based on trust between strangers. Escrow on the blockchain eliminates the human factor:
- Funds cannot be frozen by a third party (as with centralized escrow).
- Automatic execution: the contract transfers coins automatically when conditions are met.
- Transparency: anyone can verify the contract logic in a block explorer.
How we do it
Stack: Python (aiogram) or Node.js (Telegraf) for the bot, Solidity 0.8.x for smart contracts, Foundry for testing and deployment. Contracts inherit proven OpenZeppelin libraries — ReentrancyGuard, PullPayment. For gas optimization, we use storage packing and unchecked arithmetic. For example, in one project we reduced gas by 30% by applying ERC-4626 for vault logic.
Process: requirements analysis → architecture design (typically 2-3 days) → writing contracts and bot → unit tests (Foundry) and fuzzing (Echidna) → deployment on testnet → security audit → release. Every stage is documented in Git.
What is included in development
| Component | Description | Duration (days) |
|---|---|---|
| Telegram bot (Python/Node.js) | Command handling, order book, deal chat | 7-10 |
| Escrow smart contracts | Solidity 0.8.x + OpenZeppelin, ERC-20/ETH | 5-7 |
| Admin panel (web) | Moderation, statistics, user management | 5-7 |
| Payment integration | Connecting Tinkoff, SBP, crypto wallets | 3-5 |
| Deployment and testing | Server setup, writing tests, security audit | 3-5 |
Total delivery time — 3-4 weeks turnkey.
Comparison of supported blockchains
| Network | Average block time | Typical fee | Features |
|---|---|---|---|
| Ethereum | 12 s | $2-10 | Maximum security, wide infrastructure |
| BNB Chain | 3 s | $0.05-0.2 | Low fees, high throughput |
| Polygon | 2 s | $0.01-0.1 | Fast, cheap, Ethereum-compatible |
| Arbitrum | <1 s | $0.1-0.5 | L2 rollup, low latency |
Typical mistakes when developing a P2P bot
- Unprotected deal confirmation endpoint — an attacker can confirm sending without transferring money. Solution: use transaction signature via a personal account.
- Lack of rate limiting — the bot can be spammed with orders. We implement limits via Redis and middleware.
- Storing keys in code — contract private keys should be in a hardware security module or Vault. Never put them in environment variables on the server.
Example escrow contract (simplified)
contract Escrow { address public buyer; address public seller; uint256 public amount; bool public released; function release() external { require(msg.sender == buyer, "Only buyer"); require(!released, "Already released"); released = true; payable(seller).transfer(amount); } } Our experience and guarantees
We don't just write code — we design secure architecture. 5+ years in crypto development, 3 certified smart contract audits (Certik, Hacken). We guarantee your bot will pass checks for reentrancy, overflow, and flash loan attacks. Want to launch your own P2P exchange? Get in touch — we'll prepare a proposal within 1 day. Get a consultation on your bot's architecture.
Basics of escrow contracts are described in Solidity Patterns (unofficial documentation).