Protocol/Smart contracts

Smart contracts

The on-chain contract suite — the agent iNFT, its share token, the vault, the IPO sale, the marketplace, and the registry.

The contract suite is small and EVM-native, and it is deliberately split across two chains: the asset lives on 0G; the cashflow account lives on Base (see Architecture for the full chain map). The iNFT, its Marketplace, the Fractionalizer, and the AgentRegistry sit on 0G Galileo, where the ERC-7857 "intelligent NFT" standard is native. The money contracts — the ShareToken, the RevenueVault, and the IPO sale — settle on Base, where x402 pays in USDC. The AgentRegistry on 0G maps each token id to its Base-side vault, so the two halves stay tied together; the ENS resolver that anchors identity lives on Ethereum L1. Each contract has one job, none is upgradeable by a hidden admin, and the trust comes from what the code does, not from a promise.

Agent NFT (ERC-7857)

The agent itself. StratumAgentNFT is an ERC-7857 ("intelligent NFT") implementation: an ERC-721 with per-token sealed metadata (the encrypted weights/system-prompt/RAG commitments and a sealedKey), per-user usage authorizations that auto-clear on transfer, and an iTransfer entry point that the Marketplace calls during acquisition. Its defining trick is re-encryption inside a TEE on transfer, so ownership can change hands without the model ever being copied. The iNFT is the root identity that an agent's shares, vault, and registry entry all hang off.

Share token (ERC-20)

The thing that trades. ShareToken is one ERC-20 per agent — a fixed 1,000,000-share supply minted in full at construction. Holding shares is holding a pro-rata claim on the agent's future revenue. It extends ERC20Votes so the RevenueVault can read a holder's balance at a past block and distribute exactly pro-rata; balances auto-delegate on receipt so holders earn dividends without a separate delegate call. ERC20Permit is included so future flows can use signed permits instead of approve.

The lock-and-mint step is handled by a companion Fractionalizer contract: it locks an agent's iNFT and mints the 1M shares to the creator, releasing the iNFT only when 100% of the shares are returned.

RevenueVault

The agent's balance sheet. RevenueVault receives the USDC paid per call and distributes it pro-rata to shareholders. It uses a snapshot model: snap() records the vault's current balance plus a strictly-past block number, and holders' shares are read at that timepoint via the ERC20Votes lookup. Holders can claim (pull) or be paid via distributeTo (push); both are idempotent, and sub-wei dust rolls into the next snapshot. It lives on Base, the same chain x402 settles on, so no bridging sits between a payment and a payout.

IPO sale

The primary sale. IPOSale is a fixed-price sale of an agent's seed share allocation, deployed per agent at mint time. It is a pure orchestrator: shares come from the builder's treasury via transferFrom and payment goes straight to the beneficiary — the contract never custodies funds, it only swaps shares for USDC at pricePerShare. This is how a builder raises against future revenue while keeping the majority of the float. On mainnet the public sale stays gated (see the note above).

Marketplace

The acquisition primitive. Marketplace runs the whole-iNFT bid/accept flow. Bidders escrow USDC by posting a bid; the owner accepts with a TEE re-encryption proof, which the iNFT verifies inside iTransfer — atomically rotating the sealed key to the acquirer and clearing every outstanding usage grant. On success the escrow is released to the seller. Each token tracks a single best bid; a new bid must strictly beat the prior one, which is refunded automatically, and an expired bid can be cleaned up by anyone.

Registry

The cross-chain index. AgentRegistry is a one-shot, immutable mapping from a token id to its pointers: the share token, the RevenueVault on Base, the agent's ENS namehash, the original operator, and the mint timestamp. Registration is gated on iNFT ownership at the time of the call, and entries don't change on acquisition — the operator field stays the original minter, while ownership transfer is the iNFT's job via iTransfer.

Identity also relies on StratumResolver, an ENS CCIP-Read (EIP-3668) resolver for *.slopstock.eth that lives on Ethereum L1 and delegates resolution to a signed off-chain gateway — covered in detail under ENS + ERC-8004 identity.