Verifiable Treasury Agent

AI plans. The payer signs. The contract rejects a payment after a synthetic risk update—and proves every escrowed token was refunded.

Comment

Inspiration

Cross-border treasury automation does not fail because software cannot send a token. It fails when no one can prove that the right payer authorized the exact order, the right approval and risk controls were current, the payment could still be revoked, and a failed release returned every escrowed unit. AI makes planning faster, but a fluent explanation must never become financial authority.

What it does

Verifiable Treasury Agent makes the failure path a first-class product.

The separation is simple: AI proposes. The payer signs. The contract decides.

  1. A deterministic planner converts invoice, route, quote, policy, and risk inputs into an unsigned EIP-712 intent.
  2. The payer wallet signs the exact amount, asset route, order ID, quote lifetime, compliance clearance, and salted invoice commitment.
  3. A Solidity state machine verifies separate role-wallet addresses, two approvals for high-value orders, current payer and beneficiary risk attestations, credential capacity, quote expiry, and daily limits.
  4. Tokens enter revocable escrow. The funded challenge window starts only after funding, not at proposal time.
  5. A clean order releases after the window. A risk change makes release fail atomically; cancellation or expiry restores the funds.

The V2 public run proves both outcomes: one 15,000 mUSD order released to a separate clean-beneficiary wallet, while a second release was rejected after a synthetic risk update and the full 15,000 mUSD returned to the payer. Final escrow is zero and the contract is solvent.

Why it is different

Most payment demos celebrate one green transaction. This one exposes a proof-carrying negative path: the public ledger includes the intentionally reverted release transaction, its decoded BeneficiarySanctioned error, the subsequent full refund, and exact end balances. The read-only control room lets a judge replay the decisions without connecting a wallet.

The contract also prevents replay and stale authority with payer-scoped commitments, nonces, membership epochs, live approval checks, expiring risk attestations, cumulative clearance capacity, quote expiry, and domain-separated invoice commitments bound to chain, contract, payer, beneficiary, amount, route, and order.

How we built it

  • Solidity 0.8.28, OpenZeppelin Contracts, EIP-712, Hardhat, ethers.js, and Base Sepolia.
  • A typed JavaScript orchestrator that emits pure JSON and never receives a private key, provider, or broadcast capability.
  • A static read-only HTML/CSS/JavaScript control room backed by a public evidence manifest.
  • A deep verifier that checks the exact order, sender, target, calldata, settlement ID, events, balances, allowance, supply, nonce, clearance consumption, solvency, and the expected revert trace for all 26 public transactions.
  • GitHub Actions for frozen dependency installation, contract and planner checks, release dependency audit, bytecode-size gate, and Pages deployment.

Raw invoice and identity records stay off-chain. Only a salted, domain-separated commitment is public; an authorized party may selectively disclose a preimage later. This is not zero-knowledge privacy: addresses, amounts, digests, and the deliberately opened demo invoice remain public.

Public proof

On Base Sepolia, chain ID 84532:

  • 26 unique state-changing receipts: 25 successful and 1 expected status-0 rejection.
  • Separate payer, clean-beneficiary, blocked-beneficiary, approver-role, and compliance-role wallet addresses.
  • Clean route: 15,000 mUSD released.
  • Blocked route: synthetic risk update, on-chain release rejection, then 15,000 mUSD full refund.
  • Final balances: payer 15,000; clean beneficiary 15,000; blocked beneficiary 0; escrow 0 mUSD.
  • totalEscrowed = 0, reconciliation passed, solvent = true.
  • Observed demo cost: 9,303,697 gas and about 0.000055950883 ETH testnet fee across 26 transactions.
  • Observed confirmation latency: 7,499 ms median across 9 recorded samples; the chain span was 736 seconds. These are demo observations, not production performance promises.

Verification and security work

The repository currently runs 37 checks: 30 V2 contract/state-path/planner checks plus 7 retained V1 controls. V2 includes 64 deterministic state paths, 99.14% line coverage and 45.45% branch coverage. Filtered Slither review found zero high/medium project findings. The 22,427-byte runtime remains 2,149 bytes below the EIP-170 limit, and local compiler inputs match the deployed runtime after accounting for Solidity immutable slots.

These results are evidence, not an independent audit, formal verification, or a complete fuzz proof.

Challenges we ran into

The hardest work was removing claims that looked convincing but were not enforceable. V1 used the same test wallet at both ends and a simplistic commitment. V2 replaced it with separate role wallets, a domain-separated commitment, live membership epochs, corridor-bound clearances, risk freshness, concurrent liability accounting, cumulative clearance capacity, payer-signed intents, and a challenge window that begins after funding.

Public RPC nodes also returned temporarily inconsistent state immediately after receipts. The resumable deployment runner therefore checks bytecode, roles, nonces, settlement state, and recovered wallets before continuing; it never blindly redeploys or replays completed steps.

What we learned

The safest AI-finance architecture is not a more powerful agent. It is an agent with a narrow, typed output and no signing or broadcast authority, paired with a contract that can independently reject stale or unsafe actions. A champion-quality demo must prove the rejected action and the refund, not merely describe them.

Try it

Prior work, AI use, dependencies, and limits

Before the event, the entrant researched the public rules and drafted the concept. No V2 contract, tests, deployment, evidence, demo, or prior commercial product existed. The repository history and DISCLOSURE.md record the implementation.

OpenAI Codex was used extensively for research, architecture, code and documentation drafting, adversarial review, test orchestration, and evidence interpretation. The canonical CLI trace reported model gpt-5.6-sol; no API billing amount was available. AI is outside the trusted runtime boundary: it cannot sign, approve, attest risk, or broadcast a settlement.

The public proof uses project-deployed, valueless mUSD, not Circle USDC and not a fiat-backed asset. The SG-CN corridor, invoice, KYC/risk, sanctions, FX, and off-ramp inputs are synthetic. There is no real cross-border transfer, production deployment, regulatory approval, certified screening feed, customer adoption, or real-funds safety claim. Production would additionally require verified data providers, institutional custody/multisig governance, monitoring, incident response, legal review, and audited contracts.

Built With

Share this project:

Updates

Submission history