Trading agent evolution: funding-rate arb on L2 (post-hackathon roadmap)

[fritzschoff]

Tracking the post-hackathon evolution of Tradewise from an x402 quoting agent into an autonomous trading agent whose capital is raised via AgentShares IPO and whose revenue flows back through RevenueSplitter.

Full design rationale in TRADING_AGENT_BRIEF.md. Highlights:

• Edge: funding-rate arbitrage. Low MEV competition, mechanical revenue, easy to attest. Capacity ~$50K with ETH-only — fine for IPO-scale capital.
• Venues: Hyperliquid (perp) + Aerodrome on Base (spot). GMX v2 is the backup if HL trust profile or bridge latency flunks M1.
• Stack: new TradingTreasury contract becomes the SharesSale deployer. AgentShares/RevenueSplitter/SharesSale untouched. x402 demoted to optional read-side surface.
• KeeperHub: load-bearing for capital safety. funding-poll, rebalance, kill-switch (6h dead-man's-switch), dividend-distribute.

Milestones

M0 — Today ✅

• x402 quoting agent live
• AgentShares + RevenueSplitter + SharesSale deployed
• ERC-8004 reputation loop closes
• RevenueSplitter double-pay bug fixed + redeployed on Base Sepolia (#TBD)

M1 — Testnet plumbing (~2 weeks)

• `TradingTreasury` contract: holds capital, executes trades via delegated EOA, streams realized fees to splitter
• Funding-rate simulator that emits ticks (stubbed exchange on Base Sepolia)
• Agent opens/closes mock positions, P&L flows through `RevenueSplitter`
• Kill-switch via KeeperHub heartbeat (6h timeout)
• Every state transition emits a clean event for the trade log
• Verify before M2: Hyperliquid mainnet maker/taker fees, funding rate distribution, withdrawal latency under stress
• Gate to M2: Treasury contract audit-clean, kill switch tested by pausing the agent EOA

M2 — Live with $100 personal capital, no IPO (~4 weeks)

• Real Hyperliquid mainnet account funded
• Real Aerodrome on Base mainnet integration
• Owner is sole shareholder for ≥30 days
• On-chain attested trade log via 0G Storage
• HL withdrawal stress-tested
• Gate to M3: 30-day P&L positive, matches attested trade log within 1bp, zero unexpected kill-switch events

M3 — Open IPO (~8 weeks)

• Mainnet SharesSale at $0.50/share × 10k shares = $5K initial cap
• M2 P&L data published
• Treasury contract audit complete
• Kill switch demoed publicly
• RevenueSplitter has paid out at least one real dividend during M2
• Gate to M4: 60 days running with no significant drawdown, ≥3 distinct shareholders bought at IPO (at least one not founder-adjacent)

M4 — Multi-strategy (~16 weeks)

• BTC pair (HL ↔ Base spot)
• SOL pair
• Basis trades (funding-sign flipping)
• Cap raise beyond $5K

Honest cuts (if we commit to this direction)

Things to remove from the current repo since the pivot makes them noise or worse:

• Pricewatch agent (fake data labelled `source: "uniswap-mainnet"`)
• MCP stub at `app/api/mcp` (advertised in agent-card, returns 501)
• AgentMerger / AgentBids contracts
• ReputationCredit (actively misleading once real capital is at risk)
• ComplianceManifest (front-runnable, not load-bearing for this thesis)
• The three test-client crons that exist to drive the demo

KeeperHub round-two pitch

Existing: KH used for `heartbeat`, `reputation-cache`, `compliance-attest` — cosmetic.

Proposed: KH becomes load-bearing for capital safety. The kill-switch is the killer demo: shareholders verify on-chain that if the agent operator vanishes, their capital comes home automatically.

[fritzschoff]

Tradewise — status as of 2026-05-13

TL;DR: M1 done + live kill-switch verified. M2 contracts + off-chain client built, signing wire verified on HL testnet, not yet deployed to HyperEVM (waiting on HYPE for gas). Honest-cuts pass complete: ~7,400 lines removed, repo is now strictly the funding-rate-arb thesis. D1 of cross-chain dividend shipped; D2/D3 wait on a bridge-choice from the operator.

---

✅ Done

M0 — pre-pivot scaffolding

• x402 quoting agent live, AgentShares + RevenueSplitter + SharesSale deployed
• RevenueSplitter rewritten with per-share accumulator (the double-pay bug fixed + redeployed)

M1 — testnet plumbing, kill-switch demoed

• TradingTreasury + MockPerpExchange deployed; agent EOA opens/closes; emergencyExit drains to splitter
• 0G storage trade log; every state-changing tx writes a tamper-evident audit record
• One real dividend cycle proved (0.4 USDC, tx 0x9c9a6afb…)
• Off-chain control loop: pure decide() strategy + heartbeat ping + on-chain execution
• Dashboard surface for treasury + funding rate + trade log on /
• M1 → M2 gate cleared 2026-05-12 21:00 UTC: disabled heartbeat trigger, waited 6h, KH TreasuryKillSwitch autonomously called emergencyExit("keeperhub dead-mans-switch") via Turnkey, treasury drained to splitter, killed=true. End-to-end verifiable on-chain.

M1 → M2 transition work (2026-05-13)

• emergencyExit try/catch fix: TradingTreasury + HyperliquidTreasury now wrap external venue calls so a paused/under-funded/reverting exchange can't wedge the kill. Redeployed: TradingTreasury 0xDF24367b83B3C4d484ea88537197a28C2A0b6A07, MockPerpExchange 0xd951bBdA9666c9917a9eB0594d82fBab1805fd08. Edge Config patched, KH workflows re-pointed.
• DeployHyperliquidTreasury.s.sol script ready; just needs HYPE on the broadcaster.

M2 — contracts built, off-chain client verified

• HyperliquidTreasury + L1Read + HyperliquidActions (HL-native treasury talking to HyperCore via 0x3333 CoreWriter + 0x0800 precompiles)
• TS HL client (read + write signing verified end-to-end on HL testnet)
• Off-chain HL strategy adapter (lib/treasury-strategy-hl.ts) wired same shape as M1
• HL_FACTS.md + M2_VERIFICATION_BRIEF.md document architecture decisions
• 123/123 Foundry tests, typecheck clean, build clean

M3 — design + first leg shipped

• M3_DIVIDEND_DISTRIBUTOR_BRIEF.md: three architecture options analysed, recommended KH-orchestrated 3-step (HL→Arbitrum→Base)
• D1 shipped: DividendStep1Withdraw KH workflow (id 800s7vxzq7q8kwcm2eqsf) + /api/keeperhub/dividend-step-1-withdraw endpoint. Weekly Sundays 00:00 UTC, signs HL withdraw3 with AGENT_PK, settles to Arbitrum in 3-4 min via Bridge2. 1h Redis debounce. Trade-log entry on success.

Honest-cuts pass complete

• Contracts gone: AgentBids, AgentMerger, ReputationCredit, SlaBond, ComplianceManifest
• Routes/lib gone: /api/mcp, /api/cron/client-tick, /api/cron/compliance-attest, /api/a2a/pricewatch/jobs, lib/pricewatch.ts, lib/bids.ts, lib/merger.ts, lib/credit.ts, lib/compliance.ts
• UI gone: /credit, /merger, /compliance, /marketplace, INFT bid-controls + transfer-modal
• Scripts gone: commit-tradewise-manifest.ts, register-pricewatch.ts, test-inft-oracle-e2e.ts
• ~7,400 lines deleted. Forge: 123/123.

Polish

• README rewritten around the agent-as-equity-issuer thesis
• /keeperhub page: stale recipes trimmed
• .claude/agents/tradewise-memory.md §5/§7 refreshed with all decisions + lessons

---

⏳ Blocked on you

	Item	What it unblocks
1	HYPE for HyperEVM gas	Deploying HyperliquidTreasury → every M2 step after
2	$20 for HL bridge round-trip test	p99 withdrawal latency → V3 capital decision
3	Bridge choice (Across / Hop / CCTP) for D2	D2 + D3 of cross-chain dividend distributor → M3 fully ready
4	Audit firm + start date	4-8 week lead time; M3 gate
5	Tokenized-equity legal posture	Required before opening to outside capital
6	Capital cap for M2 ($100 brief — enforce at contract level?)	M2 V3 deploy parameters
7	Wood-tier HYPE staking (10 HYPE ≈ $500, 5% fee discount, yes/no)	M2 deploy cost calculation

---

🛠 Could still do without you (if you want more progress this lap)

1. End-to-end smoke on the redeployed TradingTreasury — fund 1 USDC, run open → close → distribute via /api/treasury, verify 0G trade-log entries. Proves the try/catch fix works under live operation. ~$1.5 testnet USDC.
2. Bridge comparison brief for D2 — Across vs Hop vs CCTP at $5–$500 Arbitrum→Base USDC. Concrete fees, latency, API shape. Converts the M3 bridge decision from gut to data.
3. More HyperliquidTreasury tests — fuzz position-size bounds, rotateAgent-mid-position, double emergencyExit. Lifts confidence before mainnet.
4. D2 dry-implementation against Across (default per the brief). Swappable if you pick differently.

If you want any of these, say so. Otherwise the next move is yours on items 1–7 above.

---

📦 Reference

KeeperHub workflows (10 active, 0 disabled — kill-switch + heartbeat-trigger re-enabled post-test against the new treasury)

id	name	role
0zuje21a39euf7ow86f2s	Heartbeat	ENS heartbeat
x3x1yxn1i9fi6qs63v4lu	ENSPrimaryNameSetter	ENS infra
iosfz5m65htyd18be78sp	ENSAvatarSync	ENS infra
3tzmhfpvsnom1bnkeieoz	GatewayCacheInvalidator	ENS infra
xbsxr90axg3s6rhzbtyko	TreasuryKillSwitch	M1 capital safety
lztdq78elnuue6l6ipa74	TreasuryFundingPoll	M1 strategy input (5min)
j4ps9vb2gslap7c0gvzt1	TreasuryDividendDistribute	M1 weekly payout
lfbib2e3kqq9drksxdzp2	TreasuryHeartbeatTrigger	M1 KH-driven cron (30min)
df6e8swe9a9ax5a2k9ju6	TreasuryStrategyTrigger	M1 KH-driven cron (15min)
97cd7hif10whqny6tket3	TreasuryStrategyHLTrigger	M2 KH-driven cron (15min)
800s7vxzq7q8kwcm2eqsf	DividendStep1Withdraw	M3 cross-chain step 1 (HL → Arbitrum)

Live contract addresses (Base Sepolia)

Contract	Address	Status
AgentShares (TRADE)	0x64D708f88bBA23BB4cA0D5063C5de97F0f89b519	live
RevenueSplitter	0x3B1Ae95aDA500e8B73dc153063F9F5C175e87268	live
SharesSale	0x507807eA4Dd32D2f1f8D83e1F475CB9F978Ec7dE	live
TradingTreasury	0xDF24367b83B3C4d484ea88537197a28C2A0b6A07	live (post try/catch fix)
MockPerpExchange	0xd951bBdA9666c9917a9eB0594d82fBab1805fd08	live

Old TradingTreasury 0x3d4243930F3aE7648D34f5775AfAc2699C7Fc5e2 is permanently killed=true after the M1 kill-switch test.

Lessons logged in .claude/agents/tradewise-memory.md §7

• 7.1 emergencyExit external calls must be try/catch'd — addressed in 2026-05-13 redeploy
• 7.2 heartbeatTimeout of 6h is fine for prod, painful for demos
• 7.3 KH workflow disable via update_workflow({enabled:false}) is non-destructive

Reference docs: TRADING_AGENT_BRIEF.md, M2_VERIFICATION_BRIEF.md, HL_FACTS.md, M3_DIVIDEND_DISTRIBUTOR_BRIEF.md, .claude/agents/tradewise-memory.md.

[fritzschoff]

2026-05-13 — audit fix-now batch + docs scrub

Four commits landed on main (52c5134..ae9c838):

Code

• 03535a5 fix(treasury): drop synthetic positionId, lift HL_OPEN_SIZE, warn on poisoned rate — Audit M1 + M3 + L11.
  • M1: HyperliquidTreasury no longer keeps a parallel positionId / positionOpenedAt. HL is the only source of truth via L1Read.position2. openPosition returns void; close + emergencyExit read the precompile directly. Removes the partial-fill divergence class that flagged in audit.
  • M3: decide() is actually pure now. HL_OPEN_SIZE env read moved out of the strategy into the cron caller (HlStrategyInput.openSize). The cron parses the env once and passes it through.
  • L11: parseRate() console.warns when BigInt(s) throws instead of silently collapsing to 0n. A malformed funding-poll snapshot used to be indistinguishable from "rate below threshold."
  • Forge: 129/129 passing. pnpm typecheck clean. pnpm build clean.
• b49e2c5 chore: clear lint errors and unused imports — 2 ESLint errors + 6 unused-var warnings gone. react/jsx-no-comment-textnodes in docs/page.tsx, react-hooks/rules-of-hooks in reveal-panel.tsx, dead imports in 4 routes/scripts.
• 6390817 chore(inft): wire AgentINFTVerifier address through Edge Config — Closed the stale TODO(M7) in /api/inft/oracle/key. AddressMap.inftVerifierAddress is now first-class; write-edge-config.ts picks agentInftVerifier out of sepolia-inft.json and propagates it. Pushed to live Edge Config — the oracle key endpoint now serves the verifier.
• ae9c838 docs: scrub references to deleted AgentBids/Merger/Credit/SLA/Compliance — The /docs page still narrated the original AgentLab pitch (bidding, reputation-credit, SLA bonds, M&A, compliance manifests), all removed in the honest-cuts pass. 188 lines deleted. Broken anchors (#credit/#sla/#merger/#compliance) gone. tl;dr rewritten to describe the funding-rate-arb + dividend model. §04 inft rewritten to describe ownership/reveal (not bidding). Contract ledger pruned of AgentBids + AgentMerger. outstanding-bids dropped from /api/ens TEXT_KEYS.

Subagent audit pass — clean

Ran a focused audit across:

1. Stale references to deleted contracts/Edge Config keys/Redis keys — clean.
2. Inconsistent assumptions in the off-chain agent layer post-M1 — clean.
3. Auth gaps on mutating routes — clean (all 8 cron GETs verify cron auth; all 5 KH webhook POSTs verify KH webhook; INFT oracle routes check INFT_ORACLE_API_KEY).
4. Try/catch error swallowing in on-chain-affecting paths — clean.
5. bigint serialization bugs — clean.

What's left (operator-bound, not code)

• HYPE for HyperEVM gas so DeployHyperliquidTreasury.s.sol can broadcast to chain 999. M2 treasury exists in Foundry but not on chain yet.
• $20 round-trip bridge test through HL Bridge2 → Arbitrum before D1 fires on real capital.
• Bridge choice for D2 + D3 (Across / Stargate / CCTP for Arbitrum → Base). Dividend cycle stops at step 1 until decided.
• Capital cap + leverage target drives audit's M2/L8/L9 (position sizing, MAX_COLLATERAL, pollForTxHash backoff). Deferred to the M3 capital-decision conversation because they're risk decisions, not code defects.
• Audit firm engagement + regulatory take on the TRADE IPO before real capital moves.

Live state unchanged

Contract addresses, KH workflow IDs, agent wallet — all as listed in the previous status comment. M1 strategy continues running on Base Sepolia; M1 kill-switch live-test PASSED 2026-05-12. Old TradingTreasury 0x3d42…c5e2 remains permanently killed. New TradingTreasury 0xDF24367b83B3C4d484ea88537197a28C2A0b6A07 is the active one.