Croe
Escrow for social commerce on Mobile Money. Croe holds a buyer's MoMo payment until delivery is confirmed, then pays the vendor automatically.
- Role
- Founding engineer — backend, mobile & admin
- Timeline
- Jul — Sep 2026
- Stack
- React Native · Express 5 · PostgreSQL 16 · Redis
- Links
- Private repo · walkthrough on request
The problem
Social commerce in Ghana runs on trust that doesn't exist. A buyer on Instagram is asked to send Mobile Money to a stranger; the vendor is asked to ship to someone who may never pay. Vendors lose an estimated 20–30% of qualified orders to that standoff, and buyers who pay first have no recourse when it goes wrong.
Both positions are completely rational, and the sale dies between them.
Results
As of the 26 Sep 2026 production-readiness auditThe build
An Express 5 API on PostgreSQL 16 and Redis, a React Native (Expo) app for buyers and vendors, and a Next.js admin for reviewers. Every money movement goes through one state machine and lands in an append-only ledger; payment webhooks are verified, de-duplicated and replay-protected before they can move state.
Money is NUMERIC(15,2), never a float
Amounts travel as decimal strings, are stored as NUMERIC(15,2) and fees are computed in minor units. There is no floating-point arithmetic on the money path, so 2.5% of GHS 1,200.00 is always exactly GHS 30.00.
The ledger can only grow
UPDATE and DELETE are revoked on the ledger at the database level, not just in application code. Corrections are new entries, so every balance can be rebuilt from history and reconciled daily against custody and partner statements.
Custody sits behind an interface
Holding third-party funds is regulated in Ghana. A CustodyProvider abstraction separates the product from who holds the money: aggregator sandbox today, a licensed partner bank's trust account later — a configuration switch, not a rewrite.
What I'd do differently
Escrow is a regulated activity, not a feature — licensing and custody shaped the architecture as much as the code did. Even with that designed in, the September production-readiness audit found gaps to close before real money moves; they're now tracked as launch gates.
The state machine and the append-only ledger. They made the hardest tests — concurrent webhook races, decimal precision, daily reconciliation — straightforward to write.