Launch app
Security

Agents hold a policy, not a treasury.

How Elypx402 bounds what an agent can do, who can touch funds, and exactly which contracts it trusts.

Launch appPrivacy model
Security model

Bounded by design.

Agents never get the user's main wallet or an unbounded approval. An agent is a policy: a scoped session key constrained by caps, allowlists and expiry.

Scoped keys

Each agent is bound to a per-request cap, daily cap, lifetime cap and expiry.

Allowlists

Merchants, asset (USDC only at launch) and network (Elysium only at launch).

Revocable

A revoked agent can’t be reactivated without a new, explicit policy.

Custody

Who can touch what

AgentSigns within its policy
→
MerchantIssues the 402, never holds funds
→
FacilitatorVerifies and broadcasts
→
ChainSettles
  • The facilitator pays gas from its own small, isolated HYPE float. It is not a treasury and never custodies buyer funds.
  • No raw secret material ever reaches the backend. Private keys, recovery phrases, ZK notes, proofs and x402 signatures stay client-side. We store receipt hashes and status.
  • Payment signatures, proofs and viewing keys are never logged.
Settlement

A state machine, not a boolean.

CREATED→AUTHORIZED→SETTLEMENT_PENDING→SETTLED→DELIVERED·FAILED

The intent is stored at CREATED, before verification. A broadcast with no confirmed receipt stays SETTLEMENT_PENDING and is reconciled by transaction hash — a timeout is never treated as safe to resend. The paid resource is delivered only after SETTLED.

Pinned contracts

Contracts on Elysium · 99901

These are the only addresses Elypx402 trusts. Before every deploy we re-verify each address’s on-chain bytecode with eth_getCode and confirm eth_chainId returns 0x1863d. An asset is never allowlisted by symbol or name alone — look-alike USDC is a known risk on this chain.

ContractAddress
USDC (canonical)
The only USDC an agent may be allowed to spend.
0xb47c4C8F73F009CC0C0d3f92B388d13E293F0B65
Permit2
Fallback transfers for tokens without EIP-3009.
0x000000000022D473030F116dDEE9F6B43aC78BA3
x402 Exact Permit2 Proxy
The spender in Permit2-based x402 settlement — never the facilitator.
0x402085c248EeA27D92E8b30b2C58ed07f9E20001
Private Entrypoint
Privacy rail entry point. Upgradeable — confirm owner before go-live.
0xfBa04Fd6819637F8b997223231C92c9938817934
Private USDC pool
Where shielded USDC lives.
0xB06FfA7Fd64268e2605eFfa26883A5D508C83311
PrivatePay
Private payment execution.
0x8afdCE86be64AB3fbB34FEf0Ef22b98bde9A839A
ERC-5564 announcer
Standard stealth-address announcer.
0x55649E01B5Df198D18D95b5cc5051630cfD45564
Audit status

What is not yet audited

ⓘThe Elysium private rail’s processor and relayer contracts are disclosed as not yet externally audited. We reconfirm this before relying on them for real funds, and Elypx402 itself has not been through an external audit.

Found something? Tell us before you tell anyone else. Contact details will be listed here when the program opens.