Multi-step DeFi
workflows.

No. The operating account is a smart account you own, derived from your own address and live on every chain at the same address. We never have a key to it, and there is no vault to deposit into.

stuck, not stolen

You withdraw them yourself, directly from the operating account, with your own wallet — no agent, no relayer, no approval from us. The account answers to your signature alone, so recovery is a normal transfer, not a support process.

withdraw any asset, any chain, any time

Never. You hold unilateral control of the account 100% of the time: you can move, withdraw or unwind everything in it whenever you want, and the mandate you granted the agent does not gate any action you take. Revoking the agent needs nobody’s cooperation but your own.

sole owner · unilateral · at all times

Yes, and most of what it can do is this: five of its fifty-two tools spend money and the rest only read. Ask what a price range would have collected day by day on every chain and fee tier, how seventeen ways of managing that position would have done over real history, what nine option structures cost today and cost at every roll since 2021, what perpetuals pay on four venues, who is being liquidated and where, and what prediction markets and the rate curve expect. None of it signs anything.

ask before you act

The agent is a contract your account appoints, not a key we hold. It may call one approved operation on one account, and it refuses the rest on chain: it will not target your account directly, will not install permissions or change who owns it, and will not touch an operation the guardian never approved or that you never switched on. Caps per asset and per period are fixed in your account, and nothing on our side can raise them.

One transaction from your own wallet stands the agent down. You do not open a ticket, and you do not wait for us. The agent checks the appointment on every call, so it stops at once. Your account can also never be re-pointed at a different agent: the first appointment binds, and the only permitted change is to none at all.

A relayer sponsors the calls and is reimbursed from the plan itself, in the asset the plan already holds. You never bridge gas to a chain you have not used before.

zero signatures to reach a new chain

The plan stops at the failed step and reports the state it stopped in. Steps that have not run do not run. Nothing is left half-approved, and the next scheduled run starts from a clean read of your balances.

Not by writing it into a plan, and that is the point. The list of operations is closed, which is what makes it safe to hand to a model: a plan naming anything else is refused when it is written, rather than attempted and failed halfway. Adding to the list is cheap though. A new venue is a new entry, not a change to how plans work, so we can add it in days and your plan does not change shape when we do.

Every plan compiles to the board you saw above: each step, the protocol it calls, the chain it lands on, and where the money moves next. You approve that, not a sentence.

It is self-custody throughout. Positions sit in an account in your name, so your existing custody, audit and reporting posture holds — we add execution, not a counterparty.