ZeroDelta
Cross-chain delta-neutral carry, encrypted order slices, contract-guarded on NEAR
Agents propose. The contract controls signing.
The keyless NEAR contract builds the executable order and controls MPC requests. It enforces order shape, coin caps, expiry and nonce rules. Delta and leverage are consistency checks on solver-reported inputs, not verified portfolio exposure.
- LIVE READ-ONLY CHECKQueries the deployed contract or a public API now. Writes nothing.
- HISTORICAL ON-CHAIN PROOFA transaction already executed on NEAR testnet. Not created by your click.
- SIMULATED EXECUTIONCalculated, quoted, signed locally or prepared. No funds move, nothing is broadcast.
Try the current contract
LIVE READ-ONLY CHECKChoose a proposal and ask the deployed v3.1 contract to evaluate it now. This reads contract state; it creates no transaction, signature or trade.
The recorded ETH hedge with a fresh nonce and ten-minute expiry.
An accepted proposal is not proof of safety or execution. The contract checks reported hedge legs; it does not verify actual spot holdings, treasury, collateral or an independent market price. Coin caps bound order size and signing volume, not outstanding portfolio exposure. This deployment has no buy, reduce-only or withdrawal signing path.
Hyperliquid testnet recovered the contract's hedge address from the MPC signature
Historical proof: the locked NEAR contract built a size-capped Hyperliquid testnet order, computed its digest and requested an MPC signature. Hyperliquid recovered the contract's hedge address from that signature; two corrupted controls recovered different addresses. This proves signer recovery, not a fill. No funds moved. The swarm below uses v2; the current signing proof is v3.1.
Network telemetry and historical v2 guard
Swarm control panel
No wallet needed. Each run creates a fresh ed25519 key on the server and never broadcasts a transaction.
Why does this matter?
An AI can pick a dangerous trade, and the software that builds the order can be hacked. If either one holds the treasury's signing key, one bad decision can drain it.
In ZeroDelta the key is not held by any agent. It is derived by NEAR Chain Signatures for a smart contract that has no access keys of its own. That contract checks reported order parameters before requesting a signature. The current v3.1 path also constructs the executable sell itself, with fixed coin caps, expiry and replay protection. A solver can still fabricate holdings and treasury inputs; passing the math does not prove a hedge.
Limits: reported holdings, treasury, collateral, slippage and reference price are trusted. The TEE is simulated. The v3.1 contract has no buy, reduce-only or withdrawal path; funded positions could not be closed by this key. See docs/SECURITY_MODEL.md.
What is live vs simulated
- NEAR RPC blocks, accounts, MPC contract readsLive
- 1Click token list + dry-run quotesLive
- Hyperliquid funding ratesLive
- NEP-413 signing + verificationReal crypto
- intents.near simulate_intentsLive mainnet dry-run
- Risk Guard smart contractDeployed on testnet
- Policy 200/300/25 registered + account lockedTestnet tx
- Contract recomputes order, then calls v1.signer-prod.testnet.signTestnet tx
- Rogue 10x order rejected by contract mathFailed tx (on purpose)
- Spoofed MPC payload rejected (commitment)Failed tx (on purpose)
- Replayed order rejected (nonce)Failed tx (on purpose)
- Try the current contract proposal checks (no signature)Live v3.1 view (read-only)
- Contract recomputes every dashboard runLive view call
- Multi-asset ranking + slice negotiationLive quotes
- v3.1 contract builds the Hyperliquid order + EIP-712 digest (size caps, expiry), then calls MPC signTestnet tx
- Hyperliquid testnet recovers the contract's hedge address from that signature (signer recovery; no order placed)Recorded exchange response
- TEE enclave + attestation (prototype boundary)Software-simulated
- Reference price for the v3.1 price band (size is capped in coins regardless)Trusted solver input
- Real fills / funds movement / mainnetNone
No funds move. Swarm runs are dry runs against real contracts and APIs. The five testnet transactions were sent once, by the locked contract account and the solver zerodelta-guard-fb604f.testnet and zerodelta-solver-fb604f.testnet.