Overview
Brain's on-chain surface is intentionally small. Most logic lives off-chain. On-chain contracts exist to anchor state, register identity, enforce session-key scope and spend caps, and route agent execution.
Network
Base L2
Language
Solidity 0.8.x
Toolchain
Foundry
Upgrade pattern
Immutable. No upgrade path in MVP; changes ship as audited redeploys
Audits
External security audit required before mainnet. The escrow + reputation contracts are UNAUDITED and run on Base Sepolia testnet only until that audit clears
Bug bounty
Public coverage
Core Contracts
The six deployed contracts. All are Base Sepolia today; mainnet remains blocked on the external smart-contract audit.
BrainAuditAnchor
Stores Merkle roots of per-tenant audit batches. Immutable after submission.
BrainPolicyRegistry
Registers policy version hashes per tenant, signed via EIP-712.
BrainSmartAccount
Per-tenant session-key smart account; executeViaSessionKey enforces scope, spend caps, and the bound policyVersion on-chain. Immutable.
BrainMCPAgentRegistry
Stores agent identity and scope as agentId/tenantId/scopeHash/behaviorHash hashes. Reputation lives in a separate contract.
Settlement and Reputation (UNAUDITED. Base Sepolia testnet reference contracts)
BrainEscrow
Custodial USDC escrow for conditional M2M settlement: lock against a hashed job commitment, then incremental release/refund. UNAUDITED, testnet only.
BrainReputationRegistry
ERC-8004-style per-agent reputation pointer (Merkle root); read by Policy as a tighten-only threshold input. Never a money gate. Non-custodial. UNAUDITED, testnet only.
x402 Settlement
HTTP-native machine payments (USDC on Base) for per-call API access, settled through the §6 gate.
Deployed Addresses
All six contracts are deployed on Base Sepolia (chain 84532). There is no mainnet deployment; mainnet is blocked on the external smart-contract audit. A brain.proof() result anchors to BrainAuditAnchor; look the anchor tx up on the explorer to verify it independently.
BrainReputationRegistry
pending external audit (UNAUDITED testnet)
(Authoritative copy lives in SECURITY.md.)
Standards Composed
Session-key smart account
Owner-granted scoped, spend-capped, policyVersion-bound keys; executeViaSessionKey enforces the bounds on-chain
EIP-7702
Planned (RFC 0001). Delegated execution for EOAs (single-session lifetime); not shipped in MVP
ERC-8004
ERC-8004-style. BrainReputationRegistry (RFC 0001, UNAUDITED testnet): a per-agent reputation pointer/Merkle root, read by Policy as a threshold input only
BrainEscrow
Custodial USDC escrow for conditional M2M settlement. Incremental release/refund (RFC 0001, UNAUDITED testnet). A custom hash-only contract, not ERC-8183.
EIP-712
Typed-data signatures for policies, scopes, approvals
EIP-4361 (SIWX)
Sign-In With X for agent authentication
x402
HTTP-native machine settlement
Operational Safety
Immutable contracts
No upgrade path in MVP; any change ships as a separately audited redeploy
Anchorer key hardening
Current testnet publisher is a single EOA; HSM-backed signing is a pre-mainnet TODO
Root-uniqueness per tenant
A published root cannot be re-anchored, so history cannot be silently rewritten
External audit
Required before any mainnet deployment, plus a public bug bounty
Most logic is off-chain by design. The on-chain surface is the smallest possible footprint required to anchor truth, register identity, and enforce session-key scope and spend caps.
Threat Model
The user's smart account contract code
Any off-chain backend
BrainPolicyRegistry, BrainAuditAnchor
Any RPC endpoint
The user's owner key
Any UI or hosted service
Future HSM-protected anchorer keys
Any individual extractor or service
Even if Brain's backend were fully compromised, an attacker would still need to produce a valid EIP-712 signature from a key the on-chain contracts recognize. Stale verdicts expire. Reused nonces are rejected.
What's Next
Last updated