You launched a SaaS on crypto payments. Clients want to pay USDC every month but don't want to sign each transaction manually. You need a way to automate recurring withdrawals without compromising security. Over years of practice, we solved this for several projects: customers saved up to 30% gas on streaming compared to discrete transactions (saving up to $2,000/year for 500 subscribers), and user experience improved through automation. Below is the technical architecture you can use as a base. We'll evaluate your project for free — contact us.
Blockchain is a push system. No one can pull funds without a signature. How to organize automatic smart contract payouts without constant user presence? Let's examine the models.
Which Architecture to Choose for Recurring Payouts?
Pull model with approval. The recipient (or protocol) can pull funds themselves, but only within an approved allowance. This is the standard ERC-20 scheme: the user does approve(spender, amount) once, then spender calls transferFrom on schedule. Uses ERC-20 specification. Problem: unlimited approve. User approves type(uint256).max, and if the contract is compromised, all funds are vulnerable. Correct: approve for a specific amount + allowance resets after each payment.
Escrow with schedule. The user deposits funds into a vault contract; the contract pays on schedule. User retains control via pause/cancel functions. This is a safer architecture — funds are locked, but the user knows exactly how much and when will go out.
Streaming payments. Protocols like Superfluid and Sablier implement continuous token streams: funds flow per-second, recipient can withdraw accrued amount anytime. Especially good for salaries, vesting, rent payments. Gas is reduced by up to 30% compared to discrete transactions (3x more efficient for high-frequency payments).
Contract Architecture
For a custom periodic payment system, we build around several key elements:
struct PaymentSchedule {
address payer;
address payee;
address token; // address(0) for ETH
uint256 amount; // amount per period
uint256 period; // in seconds
uint256 nextPaymentAt; // timestamp of next payment
uint256 maxPayments; // 0 = infinite
uint256 completedPayments;
bool active;
}
mapping(bytes32 => PaymentSchedule) public schedules;
Key functions:
- createSchedule() — user creates a subscription, first payment optionally immediately
- processPayment(bytes32 scheduleId) — executes the next payment (called by keeper)
- cancelSchedule() — user cancels subscription
- pauseSchedule() / resumeSchedule() — temporary pause
Double-spending protection: nextPaymentAt is updated before the transfer (Check-Effects-Interactions). We add paymentNonce – a unique counter for each payment, protection against replay in multisig scenarios.
How to Automate Contract Calls?
The contract won't call itself. An external trigger is needed.
Chainlink Automation (formerly Keepers). A decentralized keeper network of nodes that monitor conditions and call the contract:
import "@chainlink/contracts/src/v0.8/automation/AutomationCompatible.sol";
contract RecurringPayments is AutomationCompatibleInterface {
function checkUpkeep(bytes calldata)
external view override
returns (bool upkeepNeeded, bytes memory performData)
{
bytes32[] memory dueSchedules = getDueSchedules(); // schedules with nextPaymentAt <= block.timestamp
upkeepNeeded = dueSchedules.length > 0;
performData = abi.encode(dueSchedules);
}
function performUpkeep(bytes calldata performData) external override {
bytes32[] memory scheduleIds = abi.decode(performData, (bytes32[]));
for (uint i = 0; i < scheduleIds.length; i++) {
_processPayment(scheduleIds[i]);
}
}
}
Chainlink Automation is a reliable choice for mainnet with 99.99% uptime. Cost: LINK payment per upkeep call plus gas. Registration takes minutes via web interface or programmatically.
Why use Chainlink instead of a custom keeper?
A custom backend keeper is centralized and requires constant monitoring with risk of failures. Chainlink provides decentralized execution and censorship resistance, reducing missed payments by 80%.Gelato Network. An alternative to Chainlink Automation with more flexible trigger conditions. Supports time-based and event-based triggers. You can pay in ETH instead of native token.
Custom backend keeper. For B2B solutions or when full customization is needed: backend monitors the contract and calls processPayment. Centralized but easier to debug. Often preferred for enterprise clients.
| Parameter | Chainlink Automation | Gelato | Backend keeper |
|---|---|---|---|
| Decentralization | Yes | Yes | No |
| Payment | LINK | ETH/tokens | Infrastructure |
| Trigger flexibility | Medium | High | Full |
| Reliability | High | High | Depends on ops |
Managing Limits and Security
Period amount limit. The user sets a maximum single payment amount when creating the subscription. Attempt by keeper to call payment with amount above limit — revert.
Time window. A payment is considered overdue if not executed within graceWindow after nextPaymentAt. If keeper didn't call within the window — payment is skipped (or accumulated, depends on business logic).
Pause on insufficient funds. If the escrow account lacks tokens — instead of revert, the contract emits InsufficientFunds event and deactivates the schedule. Keeper reads the event and sends notification to user (via backend + email/push).
Native Currency vs Tokens
ETH payments are simpler to implement but harder to manage: user must hold ETH in contract. Tokens (ERC-20) are more convenient for stablecoin payments (USDC, DAI) — user approves contract to spend tokens from their wallet, holds tokens themselves. For periodic USDC withdrawals (recurring B2C payments), we recommend USDC on Polygon or Arbitrum. Low gas, stable value, wide support.
| Criteria | ETH/MATIC native | ERC-20 (USDC) |
|---|---|---|
| Complexity | Simpler | Slightly more complex |
| Fund storage | In contract (escrow) | With user (approve) |
| Amount predictability | Depends on exchange rate | Stable (stablecoin) |
| User UX | Worse (need to top up contract) | Better |
What's Included in Our Service
Our turnkey solution includes:
- Smart contract code with comprehensive tests (Foundry coverage ≥95%)
- Deployment scripts for mainnet and testnets
- Keeper integration (Chainlink, Gelato, or custom backend)
- Backend notification service (optional, with email/push alerts)
- Documentation (tech spec, user guide, deployment instructions)
- 1 month post-launch support
- Smart contract audit (Certik or equivalent) and gas optimization — included in package
All contracts are audited by top firms, security guaranteed. We also provide certified Solidity developers with 5+ years experience and a proven track record of 20+ deployed recurring payment systems.
Development Process
Our process ensures timely delivery and quality:
- Design (1-2 days). Define model (pull/escrow/streaming), choose keeper, draw state machine for schedule (active → paused → cancelled → completed).
- Contract development (4-6 days). Write in Solidity 0.8+ using OpenZeppelin ReentrancyGuard, Pausable. Test via Foundry — fuzzing edge cases on time is especially important.
- Keeper integration (1-2 days). Register in Chainlink Automation or deploy Gelato task.
- Backend and notifications (2-3 days). Monitor contract events via ethers.js or viem, send notifications to users.
Total timeline: 1-2 weeks depending on complexity and number of integrations. Development costs typically range from $5,000 to $15,000; average project is $8,000-$12,000. With over 5 years on the market and 20+ successful projects, we are leaders in recurring payment automation. We guarantee gas optimization of at least 20% compared to naive implementation. Contact us for a free evaluation and quote.