New skill proposal: `use-refund-protocol`

[OliverDevDS]

Summary

Proposes a new skill documenting the Circle Refund Protocol — a non-custodial escrow system for stablecoin payment disputes on Arc.

The gap

The circlefin/refund-protocol repository exists and the arc-escrow sample app uses it, but no skill documents how to integrate the Refund Protocol into applications. Builders currently have no guidance on the arbiter system, lockup configuration, or dispute resolution flows.

What the skill covers

• Full pay/withdraw lifecycle with lockup periods (0–180 days)
• Three refund paths: voluntary (recipient), forced (arbiter), early release (EIP-712 signature)
• Arbiter fund management and debt settlement
• updateRefundTo for changing the refund destination
• 6 antipatterns: zero refundTo address, missing USDC approve, insufficient arbiter funds, signature replay, wrong decimal precision, missing state checks
• Decision guide: which refund path fits which situation
• Use cases: merchant chargebacks, gig economy payouts, AI-validated escrow

Source

Based on: https://github.com/circlefin/refund-protocol

[erhnysr]

Opened a PR for this: #32 — covers the full pay/withdraw lifecycle, all three refund paths (voluntary, forced, early release), debt settlement, and a documented security warning for the known earlyWithdrawByArbiter vulnerability. Happy to adjust scope or format based on feedback.

[theyavuzarslan]

This is a real gap. I've been working the pre-payment and settlement-verification side (#35), and refunds are the part of the lifecycle that comes after settlement, so a skill here would sit next to that rather than overlap it. Two of the antipatterns you list, signature replay and missing state checks, are the same failure classes that show up in guarded payment flows, so documenting them for the refund path is worth doing. Happy to read a draft.

[erhnysr]

Thanks for the context on #35 — that's really helpful to know, sounds like the two skills would complement each other well. I actually already opened a draft PR for this: #32. It covers the full pay/withdraw lifecycle, all three refund paths, debt settlement, and includes a documented security warning for the known earlyWithdrawByArbiter vulnerability. Would love your feedback on it whenever you have time!