GuardPay

Demo

About

GuardPay is an autonomous treasury agent that pays tokenized supplier invoices over x402 on Base, with graduated trust for every payment. Agents that move money are a new attack surface: swapped payout addresses, fake invoices, sanctioned counterparties, or a prompt-injected agent that signs whatever it is told. An agent that pays everything is a liability; one that asks a human about everything is useless. How it works: a supplier issues an invoice as an NFT on Base Sepolia, naming our company as the payer. The agent detects the InvoiceIssued event, calls the supplier's x402 endpoint to get the 402 quote, and signs the EIP-3009 USDC authorization but keeps it in memory. Before anything is sent, it screens the payee address, the token and the signed authorization with the Intercepta API. A policy engine then decides: - small and clean: PAY automatically - flagged or sanctioned payee: REFUSE (the signature is never sent) - large or on hold: ESCALATE to a fresh World ID for Agents approval from an Orb-verified human, validated on our backend - denied, expired or cancelled: NOT PAID Once paid, the facilitator settles USDC and the agent marks the invoice NFT paid with the settlement tx hash. Every decision, with its verdict, reason, approval and transaction, is shown on a live dashboard that animates each stage and streams the backend logs. All paths have run live on Base Sepolia. For example, an invoice whose payout address was swapped to the Ronin exploiter wallet was refused (Intercepta toxicScore 100: known_scammer, sanction_address, blacklist), while a $2 invoice was paid only after a real approval through sandbox.auth.world.org.

How it's made

TypeScript monorepo with four parts: 1. Contracts (Foundry, Solidity): InvoiceToken, an ERC-721 receivable. Suppliers issue invoices to a payer (the NFT is minted to the supplier, so it could be sold for invoice factoring); only the named payer can markPaid, which stores the x402 settlement tx hash on-chain. 2. Supplier x402 server (Express + @x402/express): POST /invoices/:id/pay is paywalled with dynamic price and payTo read per invoice from the chain, settled through the x402.org facilitator on Base Sepolia. 3. Treasury agent (Node, viem, @x402/fetch, jose): - An event listener polls InvoiceIssued logs where payer = us. We wrote our own poller because viem's watcher failed on load-balanced public RPCs. - The x402 buyer is split into quote / sign / submit, so we can screen the exact EIP-3009 authorization before it leaves the process. - Intercepta: live calls to quick-scan and toxic-score (payee), token-intelligence risks (USDC), and analysis/signature (the signed authorization), with rate-limit spacing and retries. Testnet assets are mapped to their Base mainnet equivalents because Intercepta's intelligence is mainnet data. Screening failures fail closed to human approval. - A policy engine maps verdicts (CLEAN / CAUTION / HOLD / BLOCK) to PAY / CAP / ESCALATE / REFUSE. - World ID for Agents: an OIDC device authorization grant against sandbox.auth.world.org. The id_token is validated server-side (JWKS signature, iss, aud, exp, acr = orb-v3, fresh auth_time, single-use jti), and each approval is bound to a hash of that exact invoice, payee, amount and network. 4. Dashboard (Vite + React): an animated nine-stage pipeline, a World ID approval card, a replayable decision log and a live backend console. No secrets reach the browser. Notable hacks and findings: - Intercepta's scan-message does not decode EIP-3009 TransferWithAuthorization (the payload x402 signs), so we added a local integrity check that the signed to/value equal the screened payee/amount. - The x402.org facilitator occasionally fails to settle, so the agent retries once with a freshly signed authorization. - 15 tests (6 Foundry, 9 agent), including rejection of replayed, stale, forged and wrong-audience World ID tokens.