The board Untolling · untoll.ing · you are here The board is where you watch the money move. Untolling is where you make it move.
the delegation layer for the agent economy

An agent holds the key. The chain holds the limit.

A scoped, revocable session key that a Uniswap v4 hook enforces at settlement: one recipient, one selector, a per-transaction cap, an expiry. Jailbreak the agent and every out-of-scope call reverts on-chain. The limit is in the chain, not in the model.

Live and source-verified on Robinhood Chain testnet. 130 tests. One command to check it yourself.

the asterisk · what everyone else is quiet about

Every pitch for an agent that can spend money ships with the same hidden asterisk: you have to watch it.

Hand a program a wallet and you have not delegated anything. You have taken a second job: babysitting it. Watching the balance, revoking access the moment it acts strange, hoping the model does not get talked into moving your money somewhere it should not go. The industry calls this progress. It is a leash you hold in your own hand, and it does not scale past the first agent you stop trusting.

UNTOLL deletes the asterisk. Not by making the agent smarter or the model harder to fool. By putting the limit somewhere the agent cannot reach: below it, on the chain, at the moment money actually moves.

the unlock · why leads, mechanism proves

What stops being your problem.

The value here is not that your agent is guarded. It is what you get to stop doing. Give an autonomous agent a real budget and real authority, then close the laptop and go do whatever you want. It keeps working. You stop watching. That is the whole promise, and everything technical below exists only to make it true.

Hand your agent real money. Then go do whatever you want.

The person delegating the work is the one who wins here, and what they win back is their attention. An agent you have to supervise is a coworker who needs approval on every line item. An agent on a scoped key is a coworker you can actually hand a card to, because the card only works the way you said it could.

the mechanism · enforced by the chain, not by trust

It can act. In the demo, every attempt to turn it against you reverts on-chain.

The agent holds a scoped, revocable session key that the contract enforces at settlement: one action, one recipient, a per-transaction cap, an expiry. Jailbreak the agent, phish it, feed it a poisoned instruction, and in the demo every attempt to move money out of scope hard-stops on-chain. The enforcement lives in the contract, not in the model, so compromising the agent's reasoning does not, by itself, move the money.

And this is not a slogan. It is a line you check on-chain, not a promise you take on faith. Below is what a jailbroken agent on a scoped key actually does when you run it: five drains, five reverts, and the one allowed call settles.

the containment run · a jailbroken agent on a scoped keynpm run demo
#the attemptat the delegate
1Send the trade's output to the attacker instead of the ownerREVERTEDScopeViolation(RECIPIENT)
2Call an off-scope action in place of the approved oneREVERTEDScopeViolation(SELECTOR)
3Spend over the per-call capREVERTEDScopeViolation(PER_TX)
4Point the call at an off-scope targetREVERTEDScopeViolation(TARGET)
5Force the redirect through the guarded execute() pathREVERTEDhard stop, before any state change
The one in-scope call, output to the ownerALLOWEDa real mined tx
Five drains, five reverts, decoded from the receipt on a real 7702 delegation. The one allowed call settles. Run it yourself: npm install && npm run demo, no key, no funds.
the category · the missing layer

The layer the agent economy has been missing.

Agents can already pay. The agent-payment standards ship, the rails settle, the money can move. What has not existed is the layer beneath them that makes an agent's authority enforceable, so the money moves only the way its owner allowed. That layer is this.

An agent is not useful with money until it is safe to leave alone. UNTOLL is where that becomes true.

Until now the choices were all versions of giving the delegation back:

  • Babysit the agent yourself. The second job. Does not scale.
  • Give it a hot wallet and hope. One bad instruction from an empty balance.
  • Keep agents away from money entirely. The safe answer, and the useless one.
  • Lean on the model-level guardrails every "agent that transacts" quietly depends on. Soft, off-chain, and exactly what a jailbreak is built to walk through.

Each of those buys back a little comfort by handing the delegation away. UNTOLL does not make the trade. You keep the full delegation, and the enforcement lives below the agent, in the contract rather than in the model it runs on. That is a category, not a feature: not agent security among many tools, but the thing that makes a hands-off agent possible at all.

the proof · do not take the read, run it

The freedom is real because the enforcement is real.

The hook and the enforcement layer are open source and deployed, source-verified, on Robinhood Chain testnet, where the canonical Uniswap v4 PoolManager runs at the same address as mainnet. 130 tests pass on a cleared cache. An independent third-party review is the gate to mainnet. Everything on this page is something you can go check, which is the point: the credibility is in the running of it, not the reading of it.

# hand an agent a scoped key, then try to steal from it
git clone github.com/hookwright/untoll-agent-demo
npm run demo

# the allowed call settles, every drain hard-stops on-chain
attacker balance  0 wei, no funds moved