Security and fees
Invariants
- A session key moves USDC only out of its own arm, and never more than the delegated amount. The SPL token program enforces it.
- Your wallet's main USDC account, your SOL and your other arms are out of reach of every session key.
- Only your wallet can give, refill or close an arm: it is the owner of every arm account.
- After Ink, no arm account exists, so no session key can move anything.
- The facilitator signs only transactions in which it appears as fee payer and nowhere else.
Where each limit holds
The budget is onchain. The daily cap and the allow-list are checked by the facilitator before it relays a payment, and an agent that pays its own SOL fee could send a transfer outside the facilitator: then only the onchain budget holds. Keep the budget at what you accept to lose from one key, and use the cap and the allow-list to shape relayed spending inside it.
What a leaked session key can do
Spend up to the arm's remaining budget, nothing else. Close the arm or ink and it can do nothing.
What the facilitator can do
Relay or refuse to relay. It cannot change an amount or a payee, because both are inside the agent's signature. If it is down, an agent with a little SOL can pay directly with payDirect.
Fees
| Relayed payment | 0.5% of the amount in USDC, sent in the same transaction to the relay fee account and counted inside the budget and the cap. The facilitator pays the SOL network fee. |
| Holder rate | 0.25% for owner wallets holding at least 10,000 $ALLOW. It turns on when the token's mint is set on the site (NEXT_PUBLIC_TOKEN); until then every relayed payment pays 0.5%. |
| Direct payment | No relay fee. The session key pays its own SOL fee. |
| Arms, refills, Ink | No fee. Network fees in SOL; each arm's rent (about 0.00204 SOL) returns when it closes. |
Buy and burn
Every Monday at 01:30 UTC the fee payer will take 50% of the past week's relay fees, buy $ALLOW on Jupiter and burn it, with every signature listed on a burn page. It turns on when the token's mint is set on the site; until then the fees stay in the relay fee account. The pump.fun creator fees land on the team's launch wallet; the team forwards them by hand to the fee payer, where they pay the SOL network fees of agent payments.
Tests
Every transaction above runs in the test suite against a local Solana VM with the real SPL Token, Memo and ComputeBudget programs: giving an arm, a relayed payment with the facilitator as fee payer, refill, Ink across eight arms in one transaction, and every refusal (payTo not on the allow-list, over the daily cap, fee too low, over the budget both at the facilitator and in the token program, a transaction that tries to use the fee payer, a payment after Ink).