Web3 security · payment rails for autonomous agents
I audit smart contracts and build the infrastructure that lets AI agents pay for what they use. Most of my work sits where those two meet: agent-to-agent payments over HTTP 402 (x402), on-chain identity and reputation (ERC-8004), and the guardrails that stop an autonomous system from doing something expensive and irreversible.
39 repositories saw work in 2026, across Casper, 0G, Starknet, Midnight, BNB Chain and X Layer.
| Project | What it does | Stack | Status |
|---|---|---|---|
| AgentGate | Turns any HTTP API into a paid on-chain service in one command — HTTP 402 micropayments in CSPR, with a service registry and payment-backed reputation | Casper · Odra · TypeScript | Live demo · @mdlog/agentgate · Casper testnet |
| AgentDock | Marketplace for ERC-8004 agents — find one that does a specific job, see evidence it works, hire it from your own wallet. No custody and no token approvals: every payment is an EIP-3009 authorization you sign in your browser | BNB Smart Chain · Python | Live |
| ExitGuard | The seatbelt a trading agent calls before it becomes exit liquidity — answers whether it can actually exit at that size, returning BLOCK / WARN / OK plus an auditable depth curve, billed per call | X Layer · x402 · USDT0 · MCP | OKX.AI Agentic Service Provider |
| ShadowAgents | Private payroll — pay a whole team in one transaction without publishing the org chart: who is on it, what each person earns, or when they were paid | Starknet · STRK20 privacy pool | Mainnet |
| aegis-vault | Verifiable-AI risk manager with autonomous execution guardrails | 0G Aristotle mainnet · Solidity | Contract |
| eip7702-rescue | Claims and evacuates assets from a wallet running an attacker's EIP-7702 sweeper — atomically, in one transaction, without ever funding the compromised address | Solidity · Foundry | Recovery tool |
| alibi | Proves an agent refused an order without revealing the order, the policy, or where the policy lives | Midnight · Compact · ZK | In progress |
Smart contract auditing and bug bounty hunting, mostly DeFi.
- What I hunt — accounting desync, invariants broken across coupled state, incomplete code paths, oracle and flash-loan assumptions, signature replay, proxy and upgrade footguns
- How I report — proof of concept first. If I cannot write a Foundry test that fails against the vulnerable contract and passes against the patched one, it does not get submitted
- Where it shows up in my own code —
eip7702-rescueandExitGuardboth exist because the attack came first and the tool came second
| Contracts | Solidity · Rust · Cairo · Compact · Odra |
| Application | TypeScript · Next.js · Node · Python |
| Security | Foundry · Slither · Hardhat |
| Chains | Ethereum · BNB Chain · Starknet · Casper · 0G · Midnight · X Layer |
Audit enquiries, agent-infrastructure work, or questions about anything above: