Create account

How Mandate works. From the first deposit to a veto.

Mandate is a trading account on Robinhood Chain that you own and an AI agent operates, inside rules the contract enforces.

Six parts, one account.

The account, the agent and its session, the relayer, the timelock and the post-quantum key, the private pool and the services around them.

Getting started

  1. Connect a wallet. It becomes the account’s owner.
  2. Make a post-quantum key. It is made in this browser and never sent anywhere; keep its 24 words and its encrypted file where only you can reach them.
  3. Choose the timelock (24 h to 7 days, 48 h unless you change it) and the mandate, then open the account.
  4. Deposit USDG, ETH or a stock token with a Chainlink price feed.
  5. Grant an agent a session: your own, or one from the marketplace.

The mandate

The account checks these limits on every trade and withdrawal. Tightening one takes effect at once; loosening one waits the timelock.

Max trade
The largest single trade, valued in USDG.New accounts: 100 USDG per trade
Daily turnover
All trades together over any rolling 24 hours.New accounts: 1,000 USDG per 24 h
Drawdown limit
Below this loss from the high-water value the agent may only trade into USDG or ETH. 0 to 90%.New accounts: 10% from the high
Max slippage
Against the Chainlink price, or the pool’s price before the trade for tokens without a feed. 0 to 1,000 bps (10%).New accounts: 50 bps per trade
Relayer fee cap
The most a relayer may charge to submit one signed trade.New accounts: 0.25 USDG per trade
Instant withdraw
What you can take out without the timelock. More waits in public.New accounts: 250 USDG per 24 h
Agent launch budget
Token launches and dev buys by the agent. 0: only you launch.New accounts: 0 USDG per 24 h
AI budget
Payments to AI gateways, by you and the agent together. 0: none.New accounts: 5 USDG per 24 h
Timelock
How long loosening actions wait in public before anyone may run them. 24 h to 7 days.New accounts: 48 h

Instant or time-locked

At once
Deposit. Withdraw to your own wallet up to the instant limit. Tighten any limit or deny a token. Lengthen the timelock. Grant, replace, revoke or pause the agent. Remove all guardians.
Waits the timelock
Larger withdrawals, and any to another address. Loosening a limit, allowing a denied token, resetting the drawdown baseline or shortening the timelock. A new owner, post-quantum key or guardian set. A share of launch fees. Moving funds into the private pool above the instant limit.

Once the wait is over, anyone may run a scheduled action within 14 days; after that it expires. Until it runs, your post-quantum key can veto it.

Email and Telegram alerts for scheduled actions are not sent yet. The account page lists every action waiting in the timelock.

Keys and recovery

Post-quantum key

A Falcon-512 key made in your browser. It cannot trade. It can veto a scheduled action and freeze the account, which takes every power from the wallet and the agent. While the account is frozen, it can recover it to a new owner, unfreeze it or withdraw everything to one address. It can also replace itself with a new key. Each action is signed in the browser and anyone may submit it. Try a Falcon key.

Guardians

Up to ten addresses you trust. When enough of them approve a new owner, the change can run after a delay of 36 h to 14 days. Setting guardians waits the timelock; removing them all is immediate. Anything you do as owner, or with the post-quantum key, cancels a recovery in progress.

Agents and trades

One agent at a time holds a session: an operator key that may sign trades until the session ends. Your wallet grants, replaces or revokes it at once.

Your own agent
Any program with a key. You approve its operator address on Connect an agent. No performance fee.
Marketplace agents
A creator registers an operator and a performance fee of at most 20% of profit. A session keeps the fee that was in force when you granted it.

What every trade must pass

  1. The account is not frozen or paused, the session is live, and its operator signed this exact trade.
  2. One side is USDG or ETH, neither token is on your denylist, and a halted stock is not being bought. In de-risk the agent may only buy USDG or ETH.
  3. It fits the max trade and the daily turnover, valued at Chainlink prices.
  4. Its pools use no hook, or one the price oracle allows.
  5. The account swaps itself and keeps the output. It never runs code the agent supplies.
  6. The price is within the slippage limit, and the relayer fee within its cap.

If any check fails, the whole trade reverts and nothing moves.

Fees and caps

Protocol fee
0.1% of each trade.
Hosting fee
0.1% of each trade, for agents Mandate hosts only.
Performance fee
The agent’s rate, at most 20% of profit above the high-water mark, in USDG. Mandate keeps a fifth of it. Settled when you withdraw or replace the agent, or by anyone once 30 days have passed.
Relayer fee
Whoever submits a signed trade may take a fee up to your relayer fee cap.
Deposit caps
An account takes at most 1,000 USDG of net deposits, and all accounts together 50,000 USDG. The caps can only rise.

Who can do what

Owner wallet
Everything immediate, and scheduling the rest.Cannot skip the timelock or act while frozen.
Post-quantum key
Veto, freeze, recover, withdraw everything while frozen.Cannot trade.
Agent
Trade within the mandate until the session ends; spend the AI and launch budgets.Cannot withdraw or change any rule.
Guardians
Recover the account to a new owner at their threshold, after the delay.Cannot get past any action of yours, which cancels the recovery.
Anyone
Submit signed trades and run scheduled actions once their wait is over.Cannot change what was signed or scheduled.
Protocol admin
Raise the caps; add verifiers; curate price feeds, allowed hooks and AI payees. Behind a 48 h timelock.Cannot touch an account, its funds or its mandate.

Post-quantum today: veto, freeze and recovery. Not post-quantum yet: the owner wallet and the agent’s key, which the mandate and the timelock bound, the protocol admin, and Robinhood Chain itself.

Addresses

  • Robinhood ChainChain ID
    4663
  • USDGUnit of account, 6 decimals
    0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168
  • Chainlink ETH/USDPrices ETH in trade limits
    0x78F3556b67E17Df817D51Ef5a990cDaF09E8d3A9
  • Uniswap v4 PoolManagerWhere the account swaps
    0x8366a39CC670B4001A1121B8F6A443A643e40951
  • MandateFactoryCreates accounts, holds the caps
    0xA33dc0Ee1Ccd8335DB2D34f6037d67542364e125
  • AgentRegistryMarketplace agents and their fees
    0xd6FC6baAC8BB27f5A5625c331d450E3c79771a9b
  • PriceOracleFeeds, pool samples, allowed hooks
    0x285d12bD4ab1f3AcbAc7e60e929DBA221b8b5c1a
  • FeeSinkReceives protocol fees
    0xa786D680aAE4d6CBb0889CDCB0CAA3f044EB3f70

For agent developers

Agents sign trades as EIP-712 typed data for the account they trade. Nonces run in order per account, and a trade that reverts leaves its nonce unused.

EIP-712 domain
{
  name: "Mandate",
  version: "1",
  chainId: 4663,
  verifyingContract: <the account's address>
}
Intent type
Intent(address account,uint256 nonce,address tokenIn,address tokenOut,uint256 amountIn,uint256 minAmountOut,PoolKey[] path,uint64 deadline,uint64 relayerFeeUsdg)PoolKey(address currency0,address currency1,uint24 fee,int24 tickSpacing,address hooks)

Post-quantum actions sign this digest with Falcon-512, context mandate/owner/v1. The account’s pqNonce rises with every action.

Post-quantum digest
keccak256(abi.encodePacked("MANDATE/PQ/v1", chainId, account, pqNonce, uint8(action), keccak256(params)))