Security and limits
Read this before putting fees behind an agent.
What Mandate guarantees by construction
- No Mandate contract. There is no contract holding funds and no admin key. The agent wallet is an ordinary wallet that belongs to whoever holds its key: you, if you run it yourself; the platform operator, for a hosted agent (see custody and trust).
- The model has no power. It reads a snapshot and writes target weights. It has no keys, no tools and no way to alter the rules.
- Bounded orders. Position caps, a cash floor, a turnover cap, a price-impact limit and a minimum output on every swap are enforced in code that makes no network call.
- No double trades. The intent id is saved before sending, and a repeated intent is never sent.
- A circuit breaker that does not consult the model.
- A public record. Every snapshot is hashed and stored, every decision links to it, every fill is measured.
What the platform adds, and what it risks
- Custody of hosted wallets by the operator, through one seed. If the seed leaks, every hosted agent wallet is exposed; if it is lost, those funds are stuck. It is stored outside the repository and never served, and the operator must back it up.
- A public API that creates wallets. It is rate limited (6 agents per address per hour, 60 pending at most, pending agents expire after 48 hours) and validates every field; it never accepts or returns a key.
- A shared model budget. A global daily cap on model spend stops a flood of agents from running up the bill.
- Launch attachment is verified on-chain. A coin is only attached to an agent if Pons says its creator-fee recipient is exactly that agent's wallet, so nobody can claim an agent by guessing a coin.
- The scanner and the loop are one process. If it stops, agents stop (they hold their positions; nothing is sent). Restarting resumes from the ledgers.
What it does not guarantee
- Profit. A model can be wrong for weeks. The benchmark is shown next to every result for that reason.
- That the real stock moves like the token. Tokenised stocks trade on pools around the clock. When NYSE is shut the pool can drift from the real price and snap back at the open. New buys are blocked on weekends and holidays, but a Tuesday night is not protected.
- Deep liquidity. The pools are small. Impact is estimated from the current liquidity inside the current tick range: a large order could cross into a different range and move the price more than estimated. The minimum output makes such a swap revert, and orders are cut to stay small, but it is an estimate.
- Protection against a pushed price. A trader can move a pool between your decision and your block. The minimum output limits the damage; the 5 minute average check refuses to trade a stock whose spot has already left it. Neither is a promise.
- Audited code. The engine is short, tested (69 offline tests, fork tests against real contracts, and a browser end to end test of the launch) and open to read, but it has not been audited by a third party.
- Post-graduation buybacks. If the agent's coin graduates from its bonding curve, buybacks stop until that path is added.
Failure modes, and what happens
| What fails | What happens |
|---|---|
| The model returns garbage or the API is down | THINK logs the error. The book holds. |
| The RPC fails mid-cycle | The cycle logs an error and retries after two minutes. Nothing is half-applied: the ledger only changes after a measured fill. |
| A swap reverts (slippage, allowance, pool move) | A RISK line with the reason. The ledger is untouched. |
| The runner is restarted mid-cycle | The intent ids are on disk. A repeated intent is not sent again. |
| The book falls 15% from its high | The breaker sells everything and pauses. |
| The ledger file is lost | The agent no longer knows its deposits and its high-water mark. Back it up. |
| The wallet key leaks (self-hosted) | Anyone can move the wallet's funds. Keep the wallet small and the key off shared machines. |
| The platform seed leaks or is lost | Hosted wallets are exposed, or their funds are stuck. Back it up and keep it secret. |
| The agent wallet has no gas | Claims and swaps fail with a RISK line until someone sends a little ETH; the launch page offers a button and an operator can sponsor it. |
| The coin graduates from its curve | Buybacks stop until the pool path is added. The agent keeps trading. |
Trust assumptions
On the hosted platform you also trust the operator with the agent wallet. You trust: the Robinhood Chain RPC you use for the data and the transactions; the Uniswap pools and the Universal Router and Permit2 contracts; Pons for the fee escrow and the curve; and the model provider for the answers. You do not have to trust the operator's word about what the model saw: the snapshots are public and verifiable.
Not financial advice
Mandate is software. Nothing on this site is an offer or advice. Mandate is an independent project and is not affiliated with Robinhood Markets, Inc., Uniswap Labs or Anthropic.