Hire an AI agent with a budget it cannot exceed and numbers it cannot misreport.
A smart contract holds the budget, re-derives the agent's profit math itself, and refuses anything that does not add up.
Speaker notes
Say the line slowly. Two promises: a budget it cannot exceed, numbers it cannot misreport. Both are enforced by a contract, not by trust in the agent or in us. This is a testnet prototype; say so once, early.
Agents that move money are trusted on faith.
An autonomous agent decides what to buy and how much, then reports its own profit. Nothing independent checks the number or the amount before the money moves.
A wrong number or an overspend is discovered after the money is gone. The audit trail is a log written by the same agent.
If an agent can be wrong, or be talked into being wrong, the guard has to sit where the money is.
Speaker notes
Keep this short. The point is the ordering: today the check happens after the spend. We want it before. No statistics claimed here on purpose.
The agent proposes. The contract disposes.
The quote, its claimed net profit and margin, and a number of units. It does not send the spend.
Re-derives the unit economics from the quote, derives the spend itself (landed cost x units), checks caps, and reverts with a readable reason.
Speaker notes
Most guardrails limit how much. This one also checks whether the reasoning behind the amount is correct. The red box is a real revert string from the run, decoded from the contract's custom error. Careful wording: the contract re-derives the economics and enforces the budget. It does not verify the product match; that is checked off-chain.
Session keys limit what an agent may do. We also check what its numbers say.
| Session keys / smart-account policies | SKUdesk mandate vault | |
|---|---|---|
| Budget | Caps spend per call or per period | Per-run cap on each purchase and a per-UTC-day cap on new commitments, on a spend the contract derives itself |
| Where money can go | Restricts target contracts and functions | Escrow releases only to an owner-set payee allowlist |
| Are the agent's numbers right? | Out of scope: trusts the amount and the claimed profit | Re-derives net and margin; mismatch reverts with both values |
| Inputs and replay | Not modelled | Quote hash, snapshot hash, TTL on the agent-supplied observation time, one commit per quote-and-snapshot id |
| Profit | Self-reported | Measured on tokens actually received at settlement |
Complementary, not competing. Session keys and smart-account policies are good at bounding what a key can call. A mandate vault bounds what the call is allowed to mean. They compose, and /app/create shows it: each agent acts through a locked ERC-4337 account that can call only its own vault, and the vault still checks the numbers.
Speaker notes
Do not disparage session keys or ZeroDev; they solve a different layer and we would happily sit behind one. The gap is semantic: a spend limit cannot tell a correct decision from a wrong one inside the limit. Also be honest that we do not verify the truth of input prices (slide 10).
Six steps. The money-moving ones are on-chain.
- Enforced by the contract
- Off-chain, committed as a hash
- Agent-attested
- Off-chain, not trusted
- $Money packet
- Data packet
Spend derivation, per-run cap, daily commitment cap, margin floor, quote hash, staleness check on the agent-supplied time, replay check per quote-and-snapshot id, payee allowlist, escrow accounting, tokens actually received at settlement.
Product identity (same SKU, model, pack, MagSafe). The contract sees only the committed productHash, so identity is auditable, not enforced on-chain.
Speaker notes
Walk left to right. Stress the honest split: identity gates are TypeScript, committed as a hash. We say the contract re-derives the economics and enforces the budget, never that it verifies the product match. After escrow, the lifecycle steps (received, listed, sold) are agent-attested in v1.
One real proposal, checked by the contract and settled in test tokens.
- 350units
- $2,306.50spend (derived on-chain)
- $2.61net per unit
- 23.74%margin (floor 18%)
- $913.50settled in the run from the owner’s test wallet
Agent run on Robinhood Chain Testnet. Market data is a fixed snapshot, not a live feed; the settlement token is mUSDG, a test token; real-world steps after escrow are attested by the agent.
Where the proceeds came from. Sale proceeds were $3,220.00: 350 units × $9.20. That is the $10.99 sell price less $1.79 per unit of selling-side costs (marketplace fee, fulfilment, return reserve, chain cost), not 350 × $10.99. The two amounts match by construction in this run: the script set the sale proceeds and paid them from the owner’s test wallet. What the contract guarantees is that profit is counted only on tokens it actually received.
Speaker notes
Settled profit is not what the agent said; it is tokens received at settlement minus escrow paid out, computed in the contract. Be plain that the proceeds were paid from the owner’s test wallet and sized to the verified net, so profit matching the net is by construction in this run. It is not a market result, and no goods moved. The market data is a fixed snapshot, not a live feed, and the settlement token is a testnet stand-in. Every figure on this slide is read from run.json, so it updates when the run data is updated.
We made the agent cheat. The contract said no, in plain words.
- MathMismatchThe agent inflates its profit claim
Agent claimed net $3.90 but the contract derived $2.61 from the quote. Rejected.
- SpendCapThe agent tries to spend over the cap
Spend $2,636.00 exceeds the per-execution cap of $2,500.00. Rejected.
- ReplayThe agent replays the same opportunity
This exact opportunity was already committed. Replay blocked.
- StaleThe agent uses a stale quote
Quote is 781s old; the policy allows 180s. Rejected.
- BadQuoteHashThe agent swaps in a different quote than it hashed
The quote hash does not match the quote that was submitted. Rejected.
- PayeeNotAllowedThe agent tries to pay escrow to itself
Payee 0x3EC91B7dfF57403aE298e503FAe4f5815B4C1818 is not on the owner's allowlist; the agent cannot send escrow there. Rejected.
Tamper cases are decoded from eth_call simulations run as the agent address, because the RPC refuses to broadcast a transaction that fails gas estimation. One failing transaction is sent with a forced gas limit so a revert is visible on-chain.
Speaker notes
Read the first sentence aloud, it is the money shot: claimed versus derived. Then point out the others cover overspend, replay, stale quote, swapped quote and a payee off the allowlist. Be upfront that most were checked with read-only calls from the agent address; exactly one reverted transaction is on-chain.
Re-verifying every decision on-chain only works if execution is cheap.
Our check recomputes fees, margin and spend inside the transaction that commits the opportunity. In the run that commit used 216,056 gas. That is practical on an Arbitrum Orbit chain.
Escrow and settlement are token transfers, so profit is measured on money received. Today the settlement token is mUSDG, a test token on testnet we deployed. The vault takes the token address as a constructor argument.
Idle vault funds in tokenized stocks on Robinhood Chain, valued with Chainlink feeds. Not built. A read-only treasury view is a stretch goal, not a claim.
Status: Robinhood Chain testnet only. No mainnet deployment, no partnership or prize claimed.
Speaker notes
Honest framing: cheap execution is what makes on-chain re-verification of every decision realistic. Do not say we are partners with anyone, do not say mainnet, call the test token mUSDG, a stand-in for USDG, and never plain USDG or USDC. The stock-token treasury and Chainlink feeds are roadmap.
A sealed-bid market where each round clears at one price.
- 1CommitPost a hash of your order and lock a fixed bond. Nobody can read it.
- 2RevealOpen your order. A reveal is checked against its hash.
- 3ClearEvery trade in the round gets one uniform price.
A commit-reveal batch auction in 45 second epochs. Orders stay hidden until reveal. An order that is never revealed forfeits the bond.
- Prices are real on-chain clearing prices on Robinhood Chain Testnet.
- Commit, reveal and clear are contract calls you can read on the explorer.
- Liquidity comes from SKUdesk bots.
- Units are receipts issued by the operator, not backed by on-chain collateral.
- The settlement token is mUSDG, a test token.
- It is not a Uniswap v4 hook. It is its own contract.
Speaker notes
The market is a second product built on the same chain. Say what it is in one breath: a sealed-bid batch auction, 45 second epochs, one price per round. Then be plain about the edges: the prices are real clearing prices, but the other side of every trade is our bots, the units are operator-issued receipts and the token is a test token. It is not a Uniswap v4 hook; do not let anyone leave thinking it is. The owner powers (pause, issuing units) are on the next slide.
What this does not do yet.
- Contracts are not audited. They are testnet prototypes.
- Math, not truth. The contract verifies the arithmetic, not that the input prices are real. The oracle problem remains. We commit a snapshotHash so inputs are auditable after the fact.
- The daily cap limits commitments, not cash-out. Opportunities do not expire, so commitments banked on earlier days can be funded later, and across a midnight up to twice the cap can be committed within 24 hours. Cash-out is bounded by the vault balance; each lot is at most the per-trade cap.
- Agent-supplied inputs. The agent picks the observation time and the snapshot hash, so the freshness check and the replay id bind its own claim. Settlement proceeds are agent-chosen but pulled as real tokens from an allowlisted payer.
- Owner powers on the BlindBook market. The market owner can pause trading. A pause that runs to the end of the reveal window forfeits the bond of every order not yet revealed to the owner’s treasury. The owner can also issue new units. Units are warehouse receipts, not backed by on-chain collateral.
- Agent-attested lifecycle. Purchased, received, listed and sold steps after escrow are attested by the agent. A test-token transfer stands in for a marketplace payout.
- One owner and one agent per vault. No LP flow yet.
- Identity registry is shared. The original agent is id 119 in the ERC-8004 Identity Registry already deployed on Robinhood Chain Testnet at 0x8004A818BFB912233c491871b3d84c89A494BD9e. It is a Draft standard and a shared contract run by someone else: upgradeable, implementation source not verified. The Deploy-your-agent factory registers new agents in that same registry. Reputation and validation registries are not built.
- Product identity is checked off-chain, committed as a hash.
- Oracle-signed or TLS-notarized price inputs
- Proof-of-purchase integrations for lifecycle steps
- Stylus re-verification of the economics
- LP vault so third parties can fund the mandate
- A real stablecoin as the settlement token
- Stock-token treasury with Chainlink feeds
- An independent audit
Speaker notes
Say these before anyone else finds them. Open with the plain one: the contracts are not audited. The biggest design limit is the oracle problem: if the agent is fed false prices the contract will faithfully verify false math. Snapshot hashes make that auditable, not impossible. Then the daily cap: it bounds new commitments per UTC day (up to twice in a rolling 24 hours across midnight), not cash-out, because opportunities do not expire. The contracts are deployed and immutable, so these are disclosed rather than patched; a redeploy would add an expiry on mintLot and fundLot and stop clear from forfeiting bonds while paused. Identity: the original agent is id 119 in a shared ERC-8004 registry that someone else runs; it can be upgraded and its source is not verified, and our factory uses the same registry. Go-to-market is a hypothesis only: teams that want to let agents handle small operating budgets are the first plausible users. No market-size or user numbers are claimed.
Hire an AI agent with a budget it cannot exceed and numbers it cannot misreport.
- Live sitehttps://skudesk.lol
- Run/show (walks through the agent run and tries to check it against the public RPC; not live)
- Market/market (BlindBook, 45 second sealed-bid rounds)
- Repohttps://github.com/johnnyduo/SKUdesk
- Vault (SKUdeskCore)0x3799747B933Ed7FEfAd6097998749Fd95fCD8c2A
- Deploy an agent/app/create (vault + locked ERC-4337 account + identity token in one transaction; nothing runs the agent yet)
- Settlement token
0x0B71c1B397A9d33198e0A6a5701E12011AC84D95mUSDG, a test token - NetworkRobinhood Chain Testnet (46630)
Speaker notes
Close on the one-liner. Give them the live URL, then invite them to open /show, click a transaction, and read the revert sentences themselves, and to try /market. Everything on the page is a testnet prototype and the contracts are not audited.