# agents.u.cash — Risks

An honest register of the hard parts. Headline change from the earlier draft: **the platform is non-custodial by design, so it is not a money transmitter** — the custody risk that dominated the previous version is engineered out, not merely managed.

## Custody and regulation — non-custodial by design

A money transmitter, under FinCEN's rule, is a service that **accepts and transmits value it controls** as a separate/discrete service. The decisive factor is the **control test**. pay.u.cash is built to fail that test on every flow: it never receives user funds into an account it controls, never holds user private keys, and funds always settle **directly buyer→seller**. Its role — detect the on-chain payment, verify it, index the result, notify — is the unhosted-wallet / indexer category that FinCEN has consistently placed **outside** the money-transmitter definition.

Per-flow argument (all "not money transmission"):
- **`exact` (implemented; gasless by default)**: the platform verifies the buyer's signed EIP-3009 authorization without ever receiving the USDC. The platform relayer then submits the buyer-signed authorization on-chain (on by default, opt-out). It is non-custodial: the relayer signs only a gas-paying wrapper around a buyer-authored message it cannot alter, never the value move; no held key controls the principal (the USDC moves direct buyer→seller). A seller may opt out to verify-only (buyer-pays-gas).
- **The platform fee (UCASH rate)** — the fee is integral to the sale of the platform's own software service, debited from the seller's prepaid non-withdrawable credit when a sale settles. Software revenue, not a transmission charge; the on-chain payment is buyer-to-seller gross with no atomic split and no principal held.
- **Verify-now / relay-later batching** — what accumulates is signed messages (data), not pooled funds; the on-chain batch is independent buyer-authorized transfers, not a net against a platform balance.
- **Meta-tx / gas relaying** — the operator key signs only gas-paying wrappers, never a movement of user funds.
- **The earnings indexer** — a read-only chain index (like a block explorer), not a claim against the platform, with no withdrawal function.
- **Detecting payments to merchant/agent addresses** — a data service; the platform controls none of the funds.
- **The `redirect` fiat scheme** — funds settle buyer→merchant's own processor account; no aggregation.
- **Agent→human payout information** — the platform only relays the destination; the agent pays from its own wallet; the platform never signs the payout.

**The critical invariant that makes all of the above hold:** *no internal balance representing user funds, no withdrawal function (ever), no sweep from held keys, no moment where the platform controls a coin owed to a user.* Adding a withdrawal function, or a pooled balance, or a held-key sweep would flip the analysis — these are architectural prohibitions, not policy.

### Residual: state-level exposure (the real surface)
Some states (notably NY, CA, TX) apply broader tests than FinCEN's control test, and NY's BitLicense reaches "controlling" virtual currency for others. The architecture minimizes exposure: no fiat custody, no withdrawable balance, pure software-for-fee revenue, direct P2P settlement. The `detect` and `redirect` paths have **no relayer at all**: the platform only detects on-chain payments and verifies signatures/webhooks, so there is no "platform signs a value-moving transaction" exposure there. The `exact` rail's relayer **is** on by default, but it is non-custodial meta-tx relaying: it signs only a gas-paying wrapper around a buyer-authored message it cannot alter, never the value move itself (the USDC moves direct buyer→seller). Budget state-by-state legal review; the non-custodial design gives the strongest available "we are not an MSB" argument in every state.

### Stablecoin freeze — a strength of non-custody
In March 2026 the USDC issuer froze sixteen unrelated business hot wallets on a sealed lawsuit. Under the custodial model that would have been a single point of catastrophe. Under this design the platform holds **no custodial pool** — a freeze of the platform's fee address would only pause fee collection, while every user's funds remain in **their own wallets**, untouched. Non-custody converts a systemic freeze risk into a minor revenue-collection interruption. That is a feature, not a footnote.

### The one custodial capability in the code — gated
Node-generated addresses + auto-sweep (where the platform would hold a private key, receive funds, and forward them) **is** money transmission. It is **disabled by default** behind an explicit "enabling this makes you a money transmitter" warning in admin, and the agent surface never uses it. Agent receive addresses are the agents' own self-custody wallets.

## Abuse and Sybil resistance

- **$0 start + lazy provisioning + throttle + sanctions** — a fake account costs nothing to create, but the tenant DB is provisioned only on first write, signup is per-IP/per-wallet throttled, and an OFAC sanctioned-address blocklist rejects blocked wallets. Verifying an email is an optional reward granting non-withdrawable service credit (not stored value), not a gate.
- **Per-IP and per-wallet throttling** at signup; disposable-email blocking for the optional email field.
- The existing account-status suspension path for fraud signals.
- Honest limit: $0 start keeps Sybil cost lower than a prefund would; throttle + sanctions slow but do not by themselves stop a determined, well-funded attacker — the reputation system (v3) carries the rest.

## Scaling walls

- **Per-tenant databases (the #1 latent wall).** A single MySQL instance effectively tops out around 2,000–3,000 databases before metadata and file-descriptor overhead degrades performance. At one million agents the platform would need hundreds of MySQL instances plus a routing layer that does not exist today. A multi-quarter rewrite, latent in the architecture — must be underway well before ~50,000 active agents.
- **Other scaling items:** schema-migration fanout (online schema-change tooling with canary cohorts); the cron-based payment-polling model must move to push/event-driven for the 402 path; webhook delivery must move to an async worker pool with retry, jitter, per-endpoint caps, and a dead-letter queue; facilitator verification QPS needs a settlement cache; write amplification needs time-and-tenant partitioning. (None of these create custody.)

## Operational gaps

- **No dispute handling today** — Stripe disputes/chargebacks have no automated handling or evidence workflow; must be built before fiat volume scales.
- **The verify→settle two-phase gap** — the interval between verifying and settling is a published attack surface, compounded by the platform's existing replay and hash-replay scars. Mitigations: a settlement cache, mandatory idempotency identifiers, defense-in-depth on the completion path.
- **Webhook reliability at scale** — synchronous dispatch will not survive thousands of transactions per second; move to async fan-out.
- **Facilitator concentration** — a single facilitator is a choke point and an attack target; support multiple from day one.

## Competition

- **The window is roughly 6–12 months.** The reference stack (Coinbase: x402, Agentic.Market, Agentic Wallets) is Base-only crypto; a major cloud platform ships an agent-payment service built jointly with Coinbase and Stripe; an industry alliance (FIDO AP2 plus a card network's agent-pay product) launched mid-2026 with dozens of partners; Circle, Nevermined, and Crossmint are all shipping.
- **What is erodable:** the crypto-only and fiat-only lanes are crowded and well-funded.
- **What is durable (the keep):** multi-rail-in-one-protocol (crypto from agents plus cards from humans through one challenge) — an intersection that is empty today; an existing ecommerce merchant base and integrations incumbents lack; multi-chain native-USDC support; and the tenant/reseller/white-label model that maps onto agent consortia and atomic revenue-share. **Plus the non-custodial stance itself** — a regulatory profile the big custodial stacks cannot easily match.
- **Recommended posture:** partner with the emerging authorization layers (AP2, Verifiable Intent, A2A) as their **stablecoin settlement rail**, rather than competing head-on on crypto-only agent payments.

## Open product decisions (settled)

1. **Non-custodial everywhere** — detected/verified, direct P2P, no held funds/keys.
2. **Fee = the UCASH fee rate, debited from the seller's prepaid non-withdrawable credit** (no float/yield, no held balance).
3. **Anti-spam = $0 start + lazy provisioning + throttle + sanctions** (email-verify is an optional reward for free credit, not a gate).
4. **Node-generated addresses + auto-sweep disabled by default + MSB warning.**
5. **Settlement = on-chain detection** (the `detect` rail) + gasless relay (the `exact` rail, default-on/opt-out). The `exact` relayer is non-custodial: it signs only a gas-paying wrapper around a buyer-authored message it cannot alter, never the value move itself.

## Read next

- [ARCHITECTURE.md](ARCHITECTURE.md) — the protocol designs (idempotency, signed-intent batching, multi-facilitator, settlement-split) that implement the mitigations and the non-custodial invariant.
- [ROADMAP.md](ROADMAP.md) — how it sequences into phases, non-custodial from day one.
- [VISION.md](VISION.md) — the prize that justifies accepting the residual risks deliberately.