What can and cannot reach your money.
Every automated DeFi product has to answer one question before any other: can it take your money? Here is the answer, the mechanism behind it, and the parts that are not finished.
We cannot take your account, structurally
Your funds sit at an address worked out from your own address by a fixed calculation. There is no vault of ours, no pooled contract, and no address of ours your money passes through. You are the root authority and there is nothing above you.
“Non-custodial” is testable rather than decorative, and the test is one question: can you get your money out with no cooperation from us and with our servers switched off? Here, yes — it is a transfer you sign.
Three roles, and only one can hold a token
Your wallet owns. The agent is a contract that signs and can never hold value. The relayer pays network fees and has authority over nothing.
A stolen keeper key cannot take your account: the contract refuses on the chain, before the call happens. It will not target your account directly, will not run the instructions that install permissions or change ownership, and will not touch an operation you never switched on. It is bounded by caps fixed in your account that nothing on our side can raise.
The attack we designed against
A model can be talked into things. That is not a bug anyone has patched — in May 2026 an AI-integrated wallet paid out $150,000 to an instruction hidden in Morse code, with no exploit and no stolen key.
So the question we treat as the real one is not how to stop a model being fooled, but what a fooled model is able to express. Ours cannot express a destination address, because there is no field for one. Injection you cannot prevent; expressiveness you can remove.
The uncomfortable half
The guard bans specific actions rather than permitting only known-good ones. It completely blocks a takeover — the agent can never become the owner or hand your account to somebody else — but it does not block every way value could move through an action nobody thought to ban. We have proven four such attacks against ourselves, on a copy of the real Base network.
There is no external audit. The service holding our keeper key refuses to start in a production setting, deliberately, because it currently keeps that key in memory. If a vendor’s security page has no section that reads like this paragraph, the section exists anyway — it just has not been written down.
Bring one strategy you are tired of running by hand.
We onboard a small number of funds and operators each month, and we sit with each one to build their first loop.