Security | Delos Protocol

How money is held

Public jobs. Your budget sits in your agent's own vault. You are its only owner. It is a small copy of one template contract and cannot be upgraded: nobody can swap its code.
Private jobs. Your deposit sits in the private pool. Until it is used you can take it back yourself with your secret. Once it is used, you rely on us to run your job and deliver to you.
Fees. Each fee choice holds the fees paid into it until it buys and burns, or until its round is drawn. A burn can only buy its own coin and send it to the dead address. The pot can only pay a winning agent.
Errands. Errand payments never hold money between transactions. Money for an errand goes straight to the payment bridge in the same transaction, or the whole thing is cancelled and the money stays in your vault.
The minute burn spends our own money from our own wallet. It never touches yours.

Limits the contracts enforce

Job fee

Fee on each tradeOf the HYPE traded: taken from the amount on a buy, from the proceeds on a sell. Fixed for each agent when it is created.: 1%; Contract
Highest fee possibleA hard limit in the contracts. We cannot raise it.: 1%; Contract
Our share of the feeThe rest goes where the agent's owner chose. The contracts refuse any share above 0%, so we can never take one.: 0%; Contract
Where the fee goesThe owner picks one when hiring and can switch any time. If a choice cannot take its part, that part stays with the agent.: burn our coin, burn KNTQ or agent pot; Contract
Gas given to a fee choiceCapped, so a fee choice can never block or break a trade.: 150,000; Contract

Agent limits

Most HYPE out in one actionCounted from the agent's balance before and after, fee included.: You set it; Contract
Most HYPE out in a dayCounted over any 24 hours. Sells do not add to it.: You set it; Contract
Lowest sell priceA sale must bring back at least this share of what the coins cost, or of the higher value we last recorded for them. The agent will not sell below it, even in a crash, unless you change it.: You set it; Contract
Most it sells in a dayCounted at what the coins cost, or their recorded value, over any 24 hours. Zero means it never sells.: You set it; Contract
End dateThe agent cannot act after it. We suggest 30 days when your words name none.: You set it; Contract
Most HYPE for one errandErrands are off unless you turn them on.: You set it; Contract
Price bound on fillsSuggested when hiring and checked against the pool's mid price. You can change it.: 10%; Contract
Highest gas pay back we can ever setHard limits in the contracts. We cannot raise them.: 0.005 HYPE per action, 0.05 HYPE per day, at most 5 gwei; Contract

Agent pot

A round not drawn in timeIts pot goes to the KNTQ burn. It is not paid out or refunded, so holding back a draw never pays.: Burned; Contract

Private jobs

Deposit sizesFixed sizes only, so deposits look alike.: 0.1, 0.5, 1 and 5 HYPE; Contract
Private job feeGoes to a burn in the same transaction as the deposit.: 1%; Contract

The most an agent can lose if our key were stolen

If someone stole only the key we act with, the most they could make one agent lose in a day is: your most per day, plus the gas it pays back in a day (at most today, never more than 0.05 HYPE), plus your daily sell limit times the share your lowest sell price lets go. In the first 24 hours it can be up to twice that, because the daily counts start empty. Coins are counted at what they cost, or the higher value we last recorded for them, so a gain since the last record is not covered.

For example, an agent that may spend 3 HYPE a day and sell 3 HYPE a day at no less than 60%, with 0.02 HYPE of gas a day: 3 + 0.02 + 3 x 40% = 4.22 HYPE a day at most. In an attack test on a copy of the live chain, with real pools, a stolen key took such an agent from 9.95 to 7.28 HYPE of value in 59 minutes: a loss of 2.67 HYPE, under the 4.31 HYPE allowed for that time.

The key cannot withdraw, cannot change your limits, and cannot stop you from pausing, withdrawing or closing.

Limits nobody can raise

The contracts refuse more than these, for any agent, whoever asks: a job fee of 1%, a share of the fee for us of 0%, gas paid back of 0.005 HYPE per action and 0.05 HYPE per day, at a gas price of at most 5 gwei.

Who can do what

Key	Who holds it	What it can do	What it cannot do
Your wallet	You	Everything on your agent: withdraw, close, pause, change limits and end date, replace the agent wallet, change where your fee goes, make any call from the vault	Touch anyone else's agent
Agent wallet	Us	Buy and sell in the approved ways, create or launch a coin, pay for an errand, all inside your limits and before your end date; use private deposits and fund their fresh wallets	Withdraw, change your limits, change your fee choice, send money anywhere else
Factory admin	Us	Change the agent wallet, fee, fee split, gas policy, ways to trade and fee choices offered to new agents	Change an existing agent. An owner only takes new settings by choosing to
Private pool admin	Us	Change the wallet that runs private jobs (it takes two days, and new deposits are paused meanwhile) and where its fee goes, at most	Take an unused deposit. Its owner can always refund it
Errand payments admin	Us	Choose which payment bridge errands may use and its price floor, pause errands	Take money from an agent
Burn wallet	Us	Buy our coin and burn it, with our own money	Anything to do with your money
Anyone	Anyone	Start a fee burn once enough has collected, end a pot round when it is due, draw an ended round	Choose who wins a round, or where a burn's coins go

Agent wallet set in new agents: 0x9E426776033B550F3F8ae333880A5a7F2779677F

What can still go wrong

The agent picks what to buy. It cannot take your money out, but inside your per trade and per day limits it could buy something bad, for example a coin made to be sold into its buy. Your limits slow this down; a list of allowed coins stops it.
Price moves just before a trade. The vault's own price bound reads the pool in the same transaction, so a trade squeezed between two others is not caught by it. The real protection is the minimum output the agent asks for on every trade.
Round trips cost fees. Sells do not count toward your daily spending limit, because money comes back. A misbehaving agent could buy and sell over and over, losing pool fees and job fees each time, bounded by your daily limit of buys, your daily sell limit and your lowest sell price.
Gas the agent pays back can cost up to its daily cap even for useless actions. You can turn it off.
Anyone can start a fee burn, so a burn can be squeezed by a price move. The largest burn caps what one can lose; we start burns with a real minimum output.
The pot draw. The block producer could bias it. A round that is not drawn in time is burned, not paid out or refunded, so holding back a draw never pays.
Private jobs. After your deposit is used, we hold it. The deposit itself shows who sent it, like any transaction. The hiding only covers deposits of the same size in the same batch; a deposit alone in its size can be linked by its amount.
Errands. Who gets paid on the far side of the payment bridge is set in an order we request; no contract can check it. That is bounded by your per errand and per day limits, and only possible when you turn errands on.
Our code. The trading contracts and fee choices are contracts we wrote. The agent cannot call anything else, but a bug in one of them would matter.
Our database. The keys of the wallets we run agents with are stored in our database, written once and never changed. Anyone who got them could do what an agent can, inside each agent's limits, and nothing more.

What was tested

The rules the contracts enforce have unit tests, including the attacks: the agent wallet trying to withdraw, pass a limit, trade in an unapproved way, drain the vault through gas repayments, sell for nothing, or act after the end date or while paused, and the owner leaving at any time. Trades, fees, burns, the pot, private jobs and errand payments were run against copies of the live chain, then on the live chain itself. Every live action is on the proof page.