Floatt

Demo

About

Float is a non-custodial, ENS-named treasury wallet for businesses that get paid in stablecoins — increasingly by AI agents, not people. The problem: real institutional-grade yield exists on-chain today (tokenized Treasuries, a market headed toward the trillions), but almost none of it reaches ordinary businesses, and under the GENIUS Act, payment stablecoins like USDC are legally barred from paying yield directly. Meanwhile, businesses are increasingly paid by autonomous agents rather than humans — and an agent has no legal identity, so it can't complete KYC, and handing it a wallet with broad permissions is exactly how recent AI-agent wallet drains have happened. Float solves both problems with one mechanism. A business completes KYC once and gets a wallet named after itself — mybiz.float.eth — which it fully owns and can recover independently of Float. It sets one number: a working-capital buffer. From then on, a narrowly-scoped agent automatically sweeps any balance above that buffer into a real yield-bearing tokenized-Treasury position through a Uniswap v4 Permissioned Pool, and sweeps it back out before bills come due — with zero manual intervention. The safety guarantee is the actual product: the agent's session key is scoped at the protocol level (an ERC-4337 permission validator) to call exactly one thing — a fixed sweep-in/sweep-out contract, capped at a per-transaction limit the agent itself can never raise. It cannot approve a different spender, target a different contract, remove the cap, or move funds anywhere else — no matter what instruction it's given. We proved this live: nine different adversarial attempts to break out of policy were all cryptographically rejected against a real bundler and a real Sepolia smart account, with zero state change. ENS v2 is more than a name here — the same mybiz.float.eth carries the compliance attestation the pool checks before allowing a swap, so the AMM's allowlist and the business's KYC status are literally the same on-chain fact. And the underlying "should this business sweep right now" decision is exposed as a metered, agent-callable API via Bazantic, so any other agent-commerce builder can use Float's treasury logic without building their own. Float is live on Sepolia today: a real business is fully provisioned end to end, real sweeps route through a real permissioned pool, and the admin key has already been rotated off a single EOA onto a 2-of-2 Safe multisig.

How it's made

Float is a full-stack, multi-tenant TypeScript monorepo (pnpm + Turborepo) built around one idea: a business's wallet should be safe to hand to an autonomous agent because it's cryptographically incapable of doing anything unauthorized — not because the agent is trustworthy. Contracts (Foundry, Solidity 0.8.26, deployed live on Sepolia): six contracts — FloatComplianceRegistry, FloatAllowlistChecker, FloatPolicyView, FloatSweepExecutor, FloatUSTB (ERC-4626), FloatYieldReserve. The centerpiece is FloatSweepExecutor — a minimal, immutable contract that is the ONLY thing the agent's ERC-4337 session key (ZeroDev Kernel v3 + @zerodev/permissions toCallPolicy) is allowed to call. Partner tech, load-bearing, not decorative: - Uniswap v4 Permissioned Pools — we deployed a real PermissionsAdapter through Uniswap's own factory, wrote FloatAllowlistChecker as a genuine IAllowlistChecker bridging our on-chain compliance registry into the pool's protocol-level allowlist, and hand-built the Universal Router's execute() calldata (SWAP_EXACT_IN_SINGLE → SETTLE_ALL → TAKE) inside the executor. This is why the executor exists at all: a permissioned pool's router call is opaque ABI-encoded bytes a call-policy can't bound by amount — so we built a thin, unprivileged shim with two typed uint256 functions (sweepIn/sweepOut) that can be bounded, and let it build the router complexity internally, off the agent's signable surface. - ENS v2 (Sepolia beta) — mybiz.float.eth resolves directly to the smart account and carries two record groups on its own Permissioned Resolver: owner-writable policy records and oracle-only compliance records, split via Enhanced Access Control's authorizeTextRoles. One name carries payment, compliance, and delegation. - Bazantic/x402 — the sweep-decision logic is exposed as a metered gateway (checkSweep, getPolicy) and published as a Recipe, tested live against real on-chain data. Backend: a Node.js agent-service running BullMQ workers over Redis (balance watcher, evaluate, execute, oracle-sync, policy-sync, provisioning), Postgres via Drizzle, a Hono gateway for x402, and a Next.js 16 dashboard with SIWE auth via wagmi/viem. Hacky/notable, all found running against real infrastructure, not mocks: BullMQ silently rejects ":" in both queue names and job IDs; worker failures were completely silent until we added explicit failed/error listeners (an unfunded oracle key stalled for minutes with zero trace before that); Turbopack choked because our wallet package's root export barrel transitively pulled node:fs into the browser bundle, fixed with a dedicated browser-safe subpath export; and — the best one — our own SIWE sign-in kept failing mid-demo with "account not authorized," root-caused to multiple installed wallet extensions racing to inject window.ethereum, so the page read one wallet's address while the signature request never reached the extension that actually held permission. We validated the core security claim live, not with a fork test: an out-of-policy attack script fires nine adversarial UserOperations (over-cap sweeps, unlimited approvals, wrong targets/selectors, non-zero value, mixed batches) at a real ZeroDev bundler against a real provisioned Sepolia business. All nine were cryptographically rejected at validation with zero state change — proof a fully compromised agent still can't move funds anywhere except in/out of the approved position, within a cap it can't raise. Two pieces are deliberately stubbed behind real interfaces because no live counterparty exists yet: FloatYieldReserve pays FloatUSTB's yield from a Float-funded reserve instead of real T-bill coupons, and KYC runs through an admin-review queue instead of a live issuer webhook.