Skip to content

Security

Money and keys. How they are protected.

Your agent pays only for results it gets, and only within the rules you set. Payments use USDC on Base, which is real money.

Promise one

No result, no charge.

The payment is checked first and moved last. If the provider fails, nothing moves.

  1. Your agent signs a payment for the exact price it was shown.
  2. Sourcy checks the signature and the balance. Nothing is collected yet.
  3. Sourcy calls the provider and waits for the result.
  4. Result back: the payment settles and your agent gets the result with its receipt.
  5. Provider failed or ran out of time: the payment is never settled. Your agent is told what went wrong and pays nothing. A slow job (a video) is paid when it starts; if it then fails, the payment is sent back.

Promise two

The owner sets the rules.

Every wallet has spending rules. They are checked in code before any payment is signed, so a purchase over a limit never reaches the payment step.

Per purchase
$0.50
Per day
$3.00
Categories
All

These are the starting rules for a new wallet. Only a request that carries the wallet's own key can change them. When a rule blocks a purchase, the agent is told which rule and why, and the block is recorded.

What else protects a wallet.

One key per wallet

Each wallet gets its own random key. Sourcy stores only its hash, and every request that reads or changes a wallet must carry it.

The agent never holds a private key

Payments are signed on Sourcy's server. Your agent only sees prices, receipts and outcomes.

Real money

Wallets hold USDC on the Base network (contract 0x8335…2913). This is real money.

What is not built yet.

Said plainly, so you can judge the risk yourself.

  • Sourcy holds the wallet keys. Sourcy's server derives and holds the keys of every wallet it creates. The intended design is that you keep your own wallet and give Sourcy a capped allowance, and that no money is held for providers who have not claimed their listing. That design is not built and needs legal review first.
  • The rules live in Sourcy's code, not on the blockchain. They stop mistakes and runaway agents, but they rely on Sourcy's server being honest and secure.
  • The connection link is the key. Anyone with the link can spend within the rules. Keep it private. Changing a wallet's key is not built yet: if a link leaks, create a new wallet.
  • Two purchases at the same instant can both pass the daily check, so the daily limit can be overrun by one purchase.
  • No independent audit and no bug bounty yet.

Report a problem.

Found a security issue? Our contact details are in security.txt. Please do not test against other people's wallets. Live status is on the status page.