Misthos

Launch a campaign. AI pays your community for real work.

Fund a USDC vault and set the rules. People create threads, articles and code about your project. An AI agent checks every submission, scores it and pays them automatically, never above the limits your vault enforces. (In the app a campaign is a "program" and the people taking part are "contributors".) People submit links to their posts, pull requests and articles. An AI agent checks that the work is theirs, original and inside the round, scores it against the program's rubric, and explains its decision. Payouts go out from a vault contract whose limits the agent cannot exceed, and every decision is a signed record anyone can verify against the chain.

Live on Arc Testnet and Arc Mainnet (pick the network in the header): https://misthos.world · Docs · A real program's audit page

Built for the Tameion Agents Hackathon (Canteen × Circle × Arc). Status and decisions: PROGRESS.md.

Try it in 2 minutes

No account, no keys. You need Foundry (cast) for step 2 and Node 22 + pnpm for step 3.

1. See money move under the vault's rules (30 s). Open the live-round vault on the Arc explorer: every PayoutExecuted event carries the decisionHash of the signed records it paid.

2. Check a decision signature yourself (30 s). docs/examples/decision.json is a canonical decision record (an example, not a real submission) signed by the real agent wallet, a Circle smart-contract account. From the repo root:

   cd docs/examples
   H=$(cast keccak "$(cat decision.json)")      # the decision hash: 0x40d2040e…027072
   D=$(cast keccak "$(cast concat-hex "$(cast from-utf8 $'\x19Ethereum Signed Message:\n32')" "$H")")
   cast call 0x74a60caa5e6c14a33be4ebf1507a209ac61b78a1 "isValidSignature(bytes32,bytes)(bytes4)" \
     "$D" "$(cat decision.sig)" --rpc-url https://rpc.testnet.arc.io
   # 0x1626ba7e = valid (ERC-1271). Change one byte of decision.json and it isn't.
   

3. Run the guarantees (1 min). The vault's caps, cooldowns and exactly-once payouts (unit, fuzz, invariant, gas), and every flag and decision rule against adversarial fixtures, including a recorded real X thread:

   pnpm install && pnpm --filter @misthos/contracts test && pnpm --filter @misthos/agent test
   

Then try the live app at https://misthos.world (Arc testnet):

1. Public audit page /p/kency-arc-creators: totals, every payout with its transaction, and the agent's reasons. Its first round paid a 4-post X thread 0.36 USDC (tx).
2. Verify a decision: click Verify next to any decision. The page re-hashes the record, checks the agent's signature (ERC-1271 for the Circle smart-contract wallet) and matches the PayoutExecuted event on Arc.
3. Launch a campaign /app: connect a wallet (RainbowKit: MetaMask, Rabby, Coinbase, Rainbow, OKX, Trust, Phantom, Bitget, any browser wallet or WalletConnect), sign in with one free signature (SIWE), create a campaign, deploy and fund its vault, share the join link.
4. Take part /join/<slug>: sign in with X, prove your wallet with a signature, submit links, and watch the agent decide.

Everything on Arc testnet is real and checkable on the explorer (see On-chain).

How it works

contributor link ──► fetch (X / GitHub / article, SSRF-guarded) ──► deterministic checks ──► Claude judge
                                                                                   │
              signed decision record ◄── decision engine (pure rules) ◄────────────┘
                     │
round closes ──► re-check ──► plan payouts within caps ──► proposeRound ──► executeRound (or owner approves)
                                                              MisthosVault on Arc: USDC transfers + events

• Fetching reads exactly what was linked. For an X post that includes the author's own thread (their self-reply chain, up to 25 posts), so a "3+ post thread" rule judges the whole thread.
• Deterministic checks catch what code can prove: someone else's post, reposts, duplicates, copied text (pg_trgm + SimHash), out-of-window work, unmerged PRs, deleted content, engagement anomalies, a missing required mention, and prompt-injection attempts (including hidden text in articles). Minimum X followers and account age apply to every kind of work; the owner picks what happens below them: send to review, reject automatically, or can't join.
• The campaign brief (the owner's About text, up to 3 links read once, key facts the owner checks) is trusted context for the judge: off-topic work and claims that contradict it are flagged, each contradiction quoted as "Says X; the brief says Y".
• The judge (Claude Haiku 4.5) scores only the rubric, through a strict tool schema. Submission content is untrusted and fenced with a random per-request boundary.
• The decision engine is plain TypeScript. Hard flags reject; prompt injection always goes to a human, even when the model is fooled; low confidence, soft flags or large amounts go to review; clear spam is rejected automatically and can be overridden. Points come from the criterion scores in code, and work the judge would reject is never priced above 0.
• Decision records are canonical JSON (sorted keys), hashed with keccak256 and signed by the agent's Circle smart-contract wallet. Each payout's on-chain decisionHash commits to the records it pays. A reviewer override or a re-process is a new signed record that names the one it supersedes; nothing is rewritten.
• The vault enforces per-payout, per-round and rolling 24h caps, an owner approval threshold, a cooldown for new or changed payout wallets, pause, and owner withdrawal at any time. A payoutId can never be paid twice. If the agent itself were compromised, the most it could pay out is maxPerDay per day until the owner pauses: the approval threshold is checked per round on-chain (the honest agent also applies it to its last 24 h of payouts).

Audits: release audit, independent audit (all High/Medium fixed) and the Oct 10 delta audit of the final changes by a separate reviewer (no Critical/High; the one Medium, an open redirect, fixed): all in docs/SECURITY_AUDIT.md and docs/INDEPENDENT_AUDIT.md. Wallet requests and MetaMask warning disputes: docs/WALLET_WARNINGS.md.

More: ARCHITECTURE.md · SECURITY.md · docs/TEST_REPORT.md

Circle and Arc, and where they are used

Tool	Use	Code
USDC on Arc	All payouts, 6-decimal ERC-20 interface; gas paid in USDC	packages/contracts/src/MisthosVault.sol, packages/shared/src/money.ts
Circle Developer-Controlled Wallets	The agent is an SCA on ARC-TESTNET, and a separate SCA on ARC (mainnet) (executor + record signer)	apps/worker/src/circle.ts, apps/worker/scripts/circle-setup.ts, circle-setup-mainnet.ts
Circle Gas Station	Sponsors both agent SCAs' gas (testnet default policy; ARC mainnet policy with daily and per-transaction caps)	apps/worker/src/circle.ts (balances stay 0)
Circle Contracts API (contract exec.)	registerPayee, proposeRound, executeRound with idempotency keys	packages/agent/src/rounds/job.ts, apps/worker/src/circle.ts
ERC-1271 signatures	Decision records verify against the agent SCA on Arc	packages/shared/src/signatures.ts, apps/web/src/lib/verify.ts

On-chain

Arc testnet (chain 5042002):

Contract	Address
MisthosVaultFactory (verified)	0x19afd6fCeb49A333B3b3b455A26e6ee43db8849b
MisthosVault implementation (verified)	0xbB016FeB193c9F1151e77444a2145c5dfAA965D7
Agent SCA (Circle)	0x74a60caa5e6c14a33be4ebf1507a209ac61b78a1
Live-round vault	0x09138198c0056189727dfe809E67934c1B7fD973

Live rounds on that vault: an auto-executed round (execute) and a round above the approval threshold that waited for the owner (approve, execute).

Arc Mainnet

Arc Mainnet (chain 5042) runs the same contracts with real USDC. Owners pick the network when they create a campaign, and each campaign, its vault and its records stay on that network. Mainnet campaigns get their own Circle agent wallet, never the testnet one. Setup and the security model: docs/MAINNET.md.

Contract	Address
MisthosVaultFactory	0x9075CbB50639216C2e4E32013514baa01f2b0C1b
MisthosVault implementation	0x36E677De57Ce0f59eFed05a748B07c7Bb07d5dBb
Agent SCA (Circle, ARC)	0xea208f9c9a7f06fff8a4c4afa8bddaa23d3c1f8c
USDC	0x3600000000000000000000000000000000000000

Deployment

Part	Where	Notes
Web app	Vercel, misthos.world	apps/web (Next.js 16.3.8), built from main on push; no signing keys; in-memory fixed-window rate limits per server instance (by IP on sign-in, Verify and public records; by session on submit, appeal and wallet linking); misthos-iota.vercel.app and www redirect (308) to misthos.world
Worker	Railway, always on	apps/worker/Dockerfile + railway.json (restart always), deployed with railway up --service worker; the only process with the Circle entity secret
Database	Neon Postgres	migrations in packages/db/migrations (pnpm --filter @misthos/db db:migrate)
Contracts	Arc Testnet and Arc Mainnet	addresses above

Screenshots

All screens, light and dark: docs/screenshots. They show a demo program (labeled as such and excluded from metrics) whose decisions are signed by the real agent wallet and whose round was paid on Arc testnet.

Run it locally

Requires Node 22+, pnpm 12 and Foundry.

pnpm install
cp .env.example .env                     # fill in; every variable is documented
pnpm --filter @misthos/db db:migrate     # Neon / Postgres with pg_trgm
pnpm --filter @misthos/worker circle:setup   # once: entity secret + agent SCA (testnet)
pnpm --filter @misthos/worker dev        # agent worker (pg-boss); the only process holding signing keys
pnpm --filter @misthos/web dev           # app on http://localhost:3000

Tests

pnpm test                                # everything: Vitest + Foundry
pnpm --filter @misthos/contracts test    # unit, fuzz (1,024 runs) and invariant tests
pnpm --filter @misthos/agent test        # every flag, every engine rule, adversarial fixtures, round job
pnpm --filter @misthos/web e2e           # browser e2e + axe on a throwaway in-memory Postgres (26 tests)
ARC_RPC_TESTS=1 pnpm --filter @misthos/shared test   # live ERC-1271 checks on Arc testnet

Re-process decided submissions with the current agent (fresh fetch, new signed decision that supersedes the old one): pnpm --filter @misthos/worker reprocess <submission id | URL> --reason "why".

Live checks (real APIs, small cost): pnpm --filter @misthos/agent live-check -- <urls>, pnpm --filter @misthos/worker live:round, and the demo of the contract refusing an over-cap payout, pnpm --filter @misthos/worker demo:cap-revert.

Repository

misthos/
├── apps/
│   ├── web/                 Next.js 16: landing, owner app (/app), contributor pages (/join, /c), public audit (/p),
│   │                        verify tool, docs (content/docs); API routes under src/app/api; no signing keys
│   └── worker/              pg-boss worker: agent pipeline, rounds, payees, overrides; Circle wallet adapters;
│                            ops scripts (circle:setup, reprocess, live:round, seed:showcase)
├── packages/
│   ├── contracts/           MisthosVault + MisthosVaultFactory (Foundry): unit, fuzz, invariant, gas and fork tests
│   ├── agent/               fetchers (X incl. threads, GitHub, SSRF-safe articles), checks, injection pre-check,
│   │                        Claude judge, decision engine, signed records, round planner and job
│   ├── db/                  Drizzle schema and SQL migrations (Postgres + pg_trgm, append-only audit log)
│   └── shared/              chain config (with citations), schemas, ids and hashing, signature verification
└── docs/                    SECURITY_AUDIT.md, TEST_REPORT.md, QA and UX reports, screenshots, examples/