Helico

Demo

About

Helico lets an AI agent manage your capital without ever taking custody of it. Instead of granting an open-ended token approval to an external bot, you receive a counterfactual smart contract account at a precomputed address, allowing it to receive funds before deployment. You name Helico's agent — a contract, not a key — and explicitly whitelist allowed markets. The agent cannot call functions that transfer tokens elsewhere or specify arbitrary recipients—it can only allocate capital across your approved venues. Capital recovery is permanently guaranteed: the emergency escape hatch resides directly in the proxy rather than the implementation contract, meaning no upgrade can alter or remove it. Even when tested against a hostile implementation, the account owner retains full clawback authority. Execution is a Chainlink CRE workflow that registers handlerInTee — the handler is declared for the AWS Nitro enclave the network provides — and runs on Chainlink's DON. Every five minutes, it scans every account, evaluates real-time yields across four lending markets, and balances idle liquidity against active allocations. Strategy thresholds are secrets the Vault DON releases only to that handler; what leaves is only the final rebalancing decision — as a report the DON signs and writes to Arbitrum One through Chainlink's KeystoneForwarder, into the agent contract your account named. No key of ours is in that path: the forwarder is the only address that can reach the agent's onReport, a DON transmitter pays the gas, and the agent can only call the two functions your account lets an agent call. In practice it moves capital to whichever pays most — Morpho at 4.32%, Compound USDC at 2.83%, Aave at 2.69%, Compound ETH at 1.26% as of today. Fifteen such moves are on chain across five owners' accounts, sent by nine different DON transmitters under one policy hash, each with the account's own event confirming what moved; the latest landed 23 seconds after a fresh wallet's single signature. Allocated funds remain fully liquid and spendable. Through a 1inch Aqua mandate, your tokens never leave your wallet — the app holds a ledger entry, not money. When a taker executes a swap, the app unwinds the exact deficit from the lending venue mid-transaction, eliminating the traditional tradeoff between earning yield and staying liquid. Three such fills are on Arbitrum One: each one spent the account's idle cent first, redeemed exactly the shortfall out of Morpho inside the swap, paid the taker, and left the rest earning — and within two runs the network had restored the floor and lent out the ether the taker paid. A dedicated subgraph, published to The Graph Network, provides visibility across the system. Because Aqua balances are nested multiple layers deep without indexed event parameters, querying active mandates for a wallet is impossible directly on-chain; the indexing layer bridges this gap to surface full portfolio activity. The chat reads that index through The Graph's Subgraph MCP, so a question about your position is answered from the data, with the queries shown beside the answer.

How it's made

Three partner integrations perform critical on-chain work rather than serving as passive marketing additions. Chainlink CRE Rebalancing decisions are computed by a workflow that registers handlerInTee — the handler is declared for the AWS Nitro enclave the network provides — and runs on Chainlink's DON, deployed to the WorkflowRegistry on Ethereum mainnet (workflow id 0x00fa897bf0b15b8f108f18499ec76ed0817ffac1a06fac02d6e2a8814339b14c), executing every five minutes on DON zone-a against Arbitrum One. Its production configuration matches the repository's config.production.json byte-for-byte, confirmed by identical SHA-256 hashes. The rebalancing policy is injected from the Vault DON as a single JSON secret per execution; an LLM only explains the verdict afterwards and has no influence over it. The verdict leaves as a report the DON signs and writes to Arbitrum One through the KeystoneForwarder (0xF8344CFd5c43616a4366C34E3EEE75af79a74482, confirmed by typeAndVersion() before anything was pinned to it) into HelicoAgent (0x98c3979358A4e5086Da432CfE91F45aE2A854463), an IReceiver behind a UUPS proxy that the account names as its agent. The forwarder and Helico's workflow-owner key are immutables of that contract; any other sender or workflow owner is refused, and a move past its deadline is dropped rather than made late. A DON transmitter pays the gas, no Helico key signs anything on the way, and the agent can only call supplyIdle and withdrawIdle on the account — neither takes a recipient. Fifteen moves have been carried this way across five owners' accounts, by nine different DON transmitters under one policy hash (0x84e5626f4fce38e751648d10b37c972d2e1833a8cb2abe9287332894e0ae5363). The first, on 11 September, supplied the first account's idle USDC to Morpho (0x0668c698cf3d396e622a97bfa3e21016de44fb41863fa7cb69b47bd126f9ed27). On 12 September it withdrew that position a minute after an Aqua mandate was shipped from the account (0x6b37141bf0357a7c7b16d7288336bebdb1c091f3f5e40901addfc421fe7fb1b5) — the enclave read the mandate as a claim on the wallet — and after we taught it which apps cover a fill from a venue (coveringApps) the next run supplied it back with the mandate still live (0x0beffeee97ad8a0f11e19af59e763394d4838440796967357ef578299e1d3435). On 13 September a second owner, from a wallet holding 0.001 ETH and nothing else, typed "swap $1 of ETH to USDC and put it all to work" and signed once — the batch opened the account, swapped through 1inch with the account as receiver, named the agent, permitted four markets and shipped a mandate (0x2742cb300e00e8345b5fb395c6732de9fcb4a1911c2b6de7b71d34b4e77f4814) — and three minutes later the DON supplied the USDC to Morpho (0xa99162965825d575b30809c2b073eac53079e3ac573bb732da6f695fb7a9866e). A third owner put both assets to work in one sentence (0xf10298a158159d53b76fbe00b7ffe9c3c63c2db3f457c361ce497aefa1ab278f); the DON placed them one per run, five minutes apart (0x9484d76177ef7a0994f524185786141987e1b74a8755857b993829db0fa57cbc, 0x98bd82ef069c8370be2a334fe492037623d8fed3953c045ba4142e2b73e0a82f), because HelicoAccount.nonce is strictly sequential and one signed statement authorises one call. A fifth owner, on camera: "swap $10 of ETH to USDC and put it all to work", one signature (0x3e12b4fd710b332fda1ec713a30920652edde4ba151e63df80e233af356da25e), and 9.96 USDC was in Morpho 23 seconds later (0xb1f4d9bf239faceda9251747bde970a228b5843a9b757426b7c481221663bf6f). Each time a taker filled against a lent-out position, the network restored the account's floor and lent out the ether the taker paid within two runs. The portfolio line values an ether position at Chainlink's ETH/USD feed at each hour, read from the aggregator's own round history (getRoundData) — the same feed the app sizes dollars with — so the chart moves when the market did. Standardizing three distinct lending protocols required bridging major interface differences. Because ILendingVenue adopts Aave v3's native function signatures, Aave connects directly while Compound and Morpho use custom adapters. Both Aqua applications query receipts for UNDERLYING_ASSET_ADDRESS(); Compound's Comet uses baseToken(). To streamline integration and grant native burn authority without external approvals, our custom venues serve as their own receipt tokens. Yields are normalized from three distinct representations into a single metric before entering the enclave: Aave uses an annual ray, Compound uses a per-second wad, and Morpho's unlisted rate is derived by sampling its share price against a 1e27 probe. 1inch Aqua HelicoMandateSwap (0x0524a353dfab33CD362593ae8e97707764Fb6041) operates as an Aqua application where the mandate defines the entire execution strategy: expiration, designated agent, fee parameters, and permitted venues. User funds remain in their own wallets. If a trade requires more capital than the wallet currently holds idle, the contract pulls the receipt token via Aqua and redeems only the necessary balance before finalizing the swap. A taker of this app must be a contract, since the app pays first and calls back for payment, so HelicoTaker (0x7A52bfD7EF1b4D0345d6e76deD649FC05208DD58) is deployed for any wallet to take through; three fills are on chain — 0xd8dc7dfdfce77c83ea79c9e6eb683cb013939a5f8113af5a10d6936212ff7310, 0x05cad1f5ae7c6c02588b0227d7d165de4ef2224aca2720ec0ae2063629e5afb2, 0xfb15dd01efa9aca0a8e11d05a94a831f07e25008e0e620056a75a5a8725184d1 — each spent the account's idle cent first, redeemed exactly the shortfall out of Morpho inside the swap, and left the rest earning. Additionally, we added an on-chain instruction to a fork of 1inch's SwapVM—returning opcode 34 for AQUA_YIELD_COVER_OPCODE()—letting a concentrated position pay a taker directly out of an active lending position. The Graph A custom subgraph indexes both Aqua and our account factory. This indexing layer is essential: because the three-state sentinel distinguishing a docked mandate from an empty balance emits no event, the indexing handler queries the chain directly for each balance. The frontend queries this index through an intermediate Go caching service with operation-name whitelisting to protect API quota limits. Two Graph products, composed. The subgraph is published to The Graph Network (id 7Qw2zNn9recjF81BVL), and the chat backend composes it with The Graph's Subgraph MCP server: a status question —"why has nothing moved?" — opens an MCP session, hands the model the subgraph's schema, and lets it write its own GraphQL against our subgraph, at most five queries, pinned to that one id. The answer comes back as the last step beneath the reply, with every MCP call shown as a step above it — initialize, schema, each qhether the schema accepted it — so the reads that produced the sentence are visible beside it.Asked what is left in a mandate a taker had just filled against, it answered the ledger's figure to the micro-unit. The enclave keeps its direct GraphQL read; the composition lives in the natural-language interface. Engineering Highlights - Declared Asset Scope: The enclave batches every market and asset into a single eth_call, and a venue reverts when asked about an asset it does not list, so one refusal would fail the whole run. Markets now declare which assets they list, and a market that declares none serves them all. Declared rather than inferred ropped call, a paused venue, and a market that genuinely does not hold the asset all arrive as thesame silence. - Precise Share Conversions: A share count is not an amount of money, so conversions go through tdeem rather than arithmetic copied out of it. Copied arithmetic works today and drifts from thecontract that actually burns the shares. - Upgradeable Proxies: Both Aqua contracts and the agent sit behind the same lightweight 163-byteintegration tests proving active mandates persist across implementation upgrades and that areplaced agent implementation brings its own forwarder and workflow owner with it. - Verification & Transparency: Testing spans 178 Solidity tests, 74 of them on an Arbitrum One fothe deployed MorphoVenue through the live account from the real forwarder's address, five moredriving HelicoTaker against the live two-sided mandate's bytes, alongside a live-address suite of 46 checks that drives the deployed contracts themselves on a fork of Arbitrum One. AI assistance is logged in AI-USAGE.md, each entry naming what was asked for, what changed, and what was verified, and implementation plaplans/ before the code, 41 of them.