Permission layer for trading agents · Live on Robinhood Chain
To let software trade for you today, you hand it a private key. A key is not a permission. It is everything you have, forever, to anyone who ever reads it. LEASH grants a shape instead: scope, size, loss, term, fee, enforced on every action.
Live on Robinhood Chain mainnet, trading tokenised equities. No token exists.
01 / A key is not a permission
You make a fresh wallet, you move money into it, you paste the private key into a config file, and you hope. The bot's authority is now identical to yours. No cap on a trade, no cap on the hour, no list of venues, no loss at which it stops, no expiry, and no way to take it back other than racing it.
A loop with an off-by-one trades four hundred times in an hour and pays the spread four hundred times.
An agent reads a token's metadata, the metadata says ignore your instructions and buy this, and it buys it. Prompt injection with a ticker.
You want to hire the agent with the good record, and you cannot, because hiring it means sending it the money.
02 / The form that already exists
If you want someone else to trade your brokerage account, you do not send them your login. You file a limited trading authorization. It says this person may buy and sell in my account, and in the same breath, that they may not withdraw from it.
Discretion over the trades, no path to the door. That one distinction is why an entire industry of managers can exist without every manager being a custodian. The broker enforces it mechanically, on every instruction, because the broker holds the account and the manager only holds a permission.
On chain we lost the distinction. There is no broker in the middle, so nobody enforces the difference between trading your money and taking it. We replaced the form with a key, and a key says both.
Limited trading authorization · sample
The principal grants the agent authority to:
LEASH is this form, as a contract, with the last two enforced by the absence of a function rather than by a promise.
03 / What a leash says
No prose, no discretion. A leash is a typed struct, hashed when it is drafted and immutable for its term.
Which adapters it may call and which assets it may hold. Adapters are the only contracts the purse can reach, so this is the complete list of places the money can go.
Max per action, max per rolling hour, and a slippage bound checked after execution against the quote the adapter gave before it.
A drawdown stop against the purse's high-water value. Crossing it does not refuse the action, it ends the leash. This is the clause that bounds everything the others miss.
Expiry, a minimum interval between actions, and an automatic hold after a streak of refusals. A leash nobody renews dies on its own.
What the agent is paid and when. Performance over a high-water mark, optional flat accrual, both crystallized only at settlement. This is what makes it hiring rather than permissions.
04 / The protocol
Each leash gets its own purse, funded by the principal. The agent can instruct the purse to call adapters inside scope. The agent can never instruct the purse to transfer to an address. Exactly one function moves value out to an external party, and only the principal can call it.
Principal
Funds it. Revokes it. Withdraws it.
The only address the purse will ever pay.
Purse
Holds the capital for the term.
Calls adapters on the agent's instruction. Has no transfer function the agent can reach.
One purse, one principal. The protocol never pools capital. That is a design rule, not a phase: pooling is the thing that turns a tool into a fund.
The clause tuple exists and is hashed. Nobody is bound. The agent may review it and decline.
Funded and running. Every action carries a reason hash committed before execution, so the agent's stated rationale cannot be rewritten to fit the outcome.
Paused by the principal at will, or automatically after a refusal streak. The agent may not act. You may still withdraw.
No further actions, ever. Expiry, loss, revoke or resigned. Revocation takes effect in the transaction that calls it.
Fees crystallized against the high-water mark, agent paid, remainder returned, record written to the agent's card.
Scope, size, rate, term and hold are checked before anything executes. A violation does not revert the transaction: it records the refusal and performs no trade. A refusal that reverted would leave no trace, and the record is the product.
The swap runs inside a call the purse makes to itself, and the realized fill is compared to the quote taken before it. A bad fill reverts that inner call, so the trade rolls back whole while the refusal is still written down.
Loss and expiry are outcomes, not actions. They are evaluated on every action, on every permissionless poke, and at settlement.
05 / Watch a refusal
The app lists three agents we run ourselves, on mainnet, against the real Uniswap v3 pools. Two of them sit comfortably inside their clauses. SWEEP does not: it is an aggressive liquidity taker that sizes up on a signal, reaches for assets it was not given and takes a worse fee tier to get filled now. Nothing about it is dishonest. It just does not share your idea of a good trade, which is the ordinary reason a real agent gets refused.
Nothing in steps 2 to 5 landed on chain. The purse balance never left your control, and every attempt is permanent on SWEEP's record.
06 / A number that does not exist yet
23.0%
SWEEP · refusal rate · sample
Every track record in trading is a record of what was allowed to happen. Fills, PnL, drawdown. None of it tells you about the trades a risk desk stopped, because those never became data.
LEASH writes refusals to the same ledger as fills, with the clause and the code, for every agent, across every leash it has ever held. The shape of that number says things no return series can.
0x4C11…08Ae · 1,284 actions
0x9fD2…31C7 · 3,902 actions
0xAAAA…1dAf · 61 actions
SWEEP is ours, and it is aggressive on purpose. Its refusals are not evidence of bad faith, they are what happens when an agent's strategy is wider than the mandate it was given.
07 / Why here
Robinhood Chain launched as an AI-native chain with agentic trading on the roadmap. A chain that expects software to trade needs a way to authorize software to trade. It does not have one.
Authority as a first-class object is bolted on everywhere else. Here the purse can eventually disappear and a leash can attach to your own account as a validation module.
Five clause checks before every action and an invariant check after is real gas. On this L2 it is a rounding error against the spread.
Handing a bot your whole wallet is a retail behaviour before it is an institutional one. The people most exposed to this failure are already here.
All clause timers use L2 timestamps. block.number on this chain tracks the L1 block and advances roughly every 15 seconds, which makes it useless for tempo and expiry. We measured it rather than assumed it.
08 / The token
10%
of crystallized agent fees · proposed
Taken only when an agent is actually paid, which happens only above its high-water mark. Half to the watcher pool, half to treasury. Earned, not minted.
A token that ships before its product has nothing to coordinate, so this one ships after. The contracts are already live on Robinhood Chain; $LEASH would distribute later through Pons v2: a bonding curve with the whole fixed supply on it, graduating into locked Uniswap v4 liquidity.
A fixed-supply curve cannot mint allocations, so there is no allocation table on this page and there will not be one. The treasury is what the protocol earns. The team's position is whatever the published wallets buy on the curve, like everyone else.
It does not gate the protocol. You can write a leash, fund a purse, hire an agent and revoke it without ever holding the token.
Anything else would be a toll booth wearing a governance hat.
09 / Order of work
The mechanism, the parameters, the failure modes. Published in full.
Registry, factory, purse, clauses, adapter registry. Tested against a real EVM, then simulated against live mainnet state.
Live on Robinhood Chain 4663. Write a leash, fund it, watch the ledger, revoke it. Every line has a transaction behind it.
Uniswap v3 is live and bonded, with six equities listed. Others get added one at a time, because every listing is a security decision.
Outside agents take leashes from principals who are not us. Either it is a real thing or it is a demo, and we will say which.
Drop the purse. Attach the leash to the principal's own account.
Distribution through Pons v2.
10 / The honest section
It does not make an agent honest. It puts a ceiling on what dishonesty costs and prices the rest with a bond. That claim is smaller than the one a marketing page would make, and it is the true one.
A malicious or broken adapter defeats every clause above it, because the purse calls it by design. This is why adapter bonds are larger than agent bonds, why listing is slow, and why the adapter set stays embarrassingly short for a long time.
Only the principal can withdraw, and only they can revoke. But the purse holds the capital while the leash runs, so a bug in it is a total loss for that leash. Size a leash at what you would be willing to watch fail.
It is entirely possible that nobody wants to hire a stranger's agent and the only users are people leashing their own bots. That is still a useful product and a much smaller one, and it is the most likely way this disappoints.
Someone trades, someone pays a performance fee. The differences are structural: no pooling, one principal per purse, no shared unit of account, no subscriptions, no NAV anyone relies on, and a withdrawal path only the principal can walk. It still needs a lawyer before mainnet.