VCR
PROTOCOL
Verifiable Capability Routing
The missing spending policy layer for AI agents
HACKATHON 2026
ERC-8004
ENSIP-25
BitGo
Fileverse
x402
MARCH 2026 · WEB3 AI INFRASTRUCTURE
THE PROBLEM
IDENTITY
EXISTS
ERC-8004 gives agents an on-chain passport — but zero spending limits.
PAYMENTS
EXIST
x402 gives agents HTTP-native payment rails — but zero policy.
POLICY
MISSING
Nothing constrains what an agent is allowed to spend. Nothing.
→ Agents can drain wallets, ignore limits, and make catastrophic trades — with zero public record.
REAL INCIDENT — MARCH 12, 2026
$50M
DISAPPEARED IN SECONDS
$50.4M
started
$36K
received
99.9%
destroyed
$9.9M
MEV profit
"The user confirmed the warning on their mobile device and proceeded."
— Stani Kulechov, Aave founder
HOW VCR WOULD HAVE STOPPED IT
WITHOUT VCR
Agent decides to swap $50M USDT
Transaction signed immediately
Broadcast to public mempool
MEV bot front-runs the order
$50M → $36K. Total loss.
VS
WITH VCR
Agent decides to swap $50M USDT
canAgentSpend() runs FIRST
maxTransaction = $1M — BLOCKED
Nothing signed. Nothing sent.
$50M stays safe. MEV sees nothing.
THIS ISN'T A ONE-OFF — $57M+ IN 6 MONTHS
$50M+
MAR 2026
USDT→AAVE, SushiSwap MEV sandwich
✓ maxTransaction + slippageProtection
$6.2M
NOV 2025
ADA→USDA, illiquid pool, 87% slippage
✓ allowedRecipients + slippageProtection
$800K+
JAN 2025
ENA traders, Jared From Subway sandwich
✓ maxTransaction limit
$215K
MAR 2025
USDC→USDT, 98% loss in 8 seconds
✓ slippageProtection
WHAT VCR PROTOCOL IS
A TypeScript SDK giving AI agents a publicly verifiable spending policy — committed on ENS, enforced by BitGo, readable by anyone.
01
POLICY SCHEMA
JSON on IPFS via Fileverse
Spending constraints: max per-tx, daily limits, allowed recipients, allowed tokens, time windows. Stored via Safe smart account on Gnosis for on-chain provenance.
02
ENS RECORDS
ENSIP-25 + vcr.policy
Two text records on the agent's ENS name. ENSIP-25 links identity to ERC-8004. vcr.policy points to the IPFS CID. Tamper-evident. Public. Verifiable by anyone.
03
VERIFIER LIB
canAgentSpend()
Any service calls this before accepting payment. Reads ENS, fetches IPFS, checks all six constraints. If blocked, BitGo is never called. Zero mempool exposure.
HOW IT WORKS
① SETUP (ONCE)
AGENT OWNER
defines policy
→
BITGO WALLET
Hoodi · MPC
→
FILEVERSE·IPFS
policy on-chain
→
ENS + ERC-8004
identity+pointer
② VERIFICATION (EVERY PAYMENT)
canAgentSpend(ensName, { amount, token, recipient, chain })
ENSIP-25 verified
vcr.policy → IPFS
maxTransaction
allowedRecipients
allowedTokens
dailyLimit
ALLOWED
→ wallet.sendMany() called
BLOCKED
→ BitGo never called
THE STACK
IDENTITY
Who is this agent?
ERC-8004 Sepolia registry
ENSIP-25 text record link
ENS vcr.policy key
STORAGE
What can it spend?
VCR JSON on IPFS
Fileverse Agent SDK v2
Gnosis Safe provenance
CUSTODY
Who holds funds?
BitGo MPC wallet
Hoodi testnet (hteth)
sendMany execution
PAYMENT
How does it pay?
x402 protocol (Coinbase)
PAYMENT-SIGNATURE V2
Base Sepolia USDC
Node ≥20 · TypeScript 5.x · viem ^2.x · @bitgo/sdk-api ^1.63 · @fileverse/agents ^2.0.1 · json-stringify-deterministic
WHY VCR IS DIFFERENT
PRIVATE SERVER
SAFE MODULES
VCR PROTOCOL
Publicly verifiable policy
✗
✗
✓
On-chain commitment
✗
Partial
✓
ENSIP-25 identity link
✗
✗
✓
Third-party can verify
✗
✗
✓
Works before signing
✓
✓
✓
No private server needed
✗
✓
✓
Audit trail on Gnosis
✗
✗
✓
VCR is the first standard for expressing agent spending policy that any third party can verify before trusting an agent.
LIVE DEMO
5 scenarios
2 real txs · 3 real blocks
01
RESOLVE POLICY
Fetch agent policy from ENS → IPFS. Show live public constraints.
VISIBLE
02
ALLOWED PAYMENT
0.001 hteth to whitelisted address → canAgentSpend() passes → real txid on Hoodi.
TX SENT
03
ALLOWED PAYMENT #2
0.001 hteth to second whitelisted address → passes → second confirmed txid.
TX SENT
04
BLOCKED: WRONG RECIPIENT
0.001 hteth to random address → BLOCKED before signing. BitGo is never called.
BLOCKED
05
BLOCKED: OVER LIMIT
0.009 hteth → exceeds maxTransaction → BLOCKED. Mirrors the exact $50M attack scenario.
BLOCKED