Sage

Demo

About

Sage is an AI agent that moves real money on verified work. A founder funds one account and names a product. Sage inspects it in a real browser, designs paid missions from what it actually saw, deploys an on-chain CampaignVault, and then pays people in USDC for evidence it verified itself — with no human in the loop. Every payout cites its evidence and publishes a receipt anchored to a real transaction that anyone can open, forever. The point is bounded autonomy over money. The agent decides who gets paid; the vault decides how much. A model output is a recommendation, never an amount: the vault derives the reward, enforces per-wallet and per-campaign caps, and rejects replays. A jailbroken model still cannot overspend, because the limit is on chain and not in a prompt. This is not a demo. Sage has paid 41 people on mainnet — 26 on GOAT and 15 on Starknet — and refused 28 submissions that did not hold up: copied artifacts, fabricated evidence, prompt injection inside a deliverable, and one wallet farm that a funding-graph check caught on chain. The refusals matter as much as the payouts. The full ledger is public at sagepays.xyz/explorer. What is new for ETHOnline is the whole loop brought to Arc. On Arc, USDC is the native gas token, which removes the single worst part of onboarding anyone to a payment rail: there is no second asset to acquire before money can move. Funding the account funds its gas. A founder signs in with an email, Privy opens an account for them under a policy that is the mandate, and the agent creates, funds and activates a vault on Arc with four policy-bound signatures and no human key. On Arc testnet the complete loop is proven, unattended: 14 payouts across 6 campaigns and 6 vaults, covering gigs, milestone grants and product-testing runs. A worker submits a public page, Sage fetches it, checks the marker deterministically before any model is consulted, the judge decides, the vault pays, and a receipt appears. Arc mainnet opens on 16 September. The same account, the same mandate and the same receipts move across with it.

How it's made

Next.js 15 and TypeScript throughout, viem for every chain interaction, SQLite via Drizzle for the ledger. Arc (chain 5042002). We deployed our CampaignVault V2 factory at 0xfAc019eF6d8B36FE33233244ff0b97f0D9e99B8c. Arc's defining property drove real design changes rather than a config entry: USDC is the native gas token and also an ERC-20 at 0x3600...0000 with 6 decimals. Our entire gas-stipend subsystem — built because a GOAT founder needs BTC before a USDC payout can move — is simply unnecessary on Arc. Funding the account funds its gas. Balance reads, launch preflight and the payout path all had to stop assuming that gas and settlement are different assets. Privy does the identity and the custody. The login app turns an email into a session: the server verifies Privy's token and mints exactly the session a SIWE signature would, and the embedded wallet signs evidence claims. The server-wallet app holds the account itself, born under a policy that IS the mandate — create a vault through our factory, approve and fund it up to a per-campaign cap, activate it, and sweep unspent money only back to the founder's own address. Nothing else is permitted. Built during this window: one account per network (USDC on one chain is not USDC on another, and a policy is per chain), accounts that open themselves when a workspace is created, a withdraw that attaches a scoped one-time permit and re-locks to the mandate afterwards whatever happened, and a cap change that moves the wallet onto a fresh policy with the same reclaim address. Circle's App Kit with the viem adapter bridges USDC in from Ethereum, Base or Arbitrum over CCTP v2 using the forwarder, so Circle mints directly into the account and the founder never needs a wallet on Arc at all. Verification is deliberately not left to a model. Deterministic contracts run first and can refuse before any LLM is consulted: an artifact must carry the submitter's wallet marker and clear a word floor, an on-chain claim is checked by reading chain state, a public page is fetched and matched. Only what survives reaches the judge, which is a separate payout brain with a frozen rubric, an eight-family prompt-injection detector, and a confidence-ceiling hardener that makes even a jailbroken model unable to auto-pay. Quotes in a decision must be verbatim substrings of the fetched evidence or they are dropped. Two things worth calling out as genuinely hacky. Tokenized-equity-style rebasing does not apply here, but issuer multipliers do elsewhere in the stack, so every displayed number is computed against live state rather than a cached balance. And the evidence renderer opens a guarded headless browser with its own egress proxy that re-validates every subresource against SSRF rules — a public hostname that 302s inward is the classic bypass, so each redirect hop is checked, not just the first. Everything is on Arc testnet because Arc mainnet opens on 16 September, three days after this deadline. We say so everywhere rather than implying otherwise.