Security

#What's enforced on-chain

• An agent key can only call AgentVault.execute.
• execute only reaches an allowlisted Hartii contract (see Contracts).
• transfer/transferFrom are forbidden on every token — an agent key cannot move assets out of the vault through any call it's allowed to make.
• approve is only allowed against a token this vault can actually trade, must carry zero QUAI value, and its spender must be the router or that token's own registered curve — an agent cannot disguise a payment as an approval.
• Per-transaction and rolling-24h QUAI caps are enforced by the contract, not by the API, the MCP server, or the page.
• The owner can pause, revoke, or withdraw everything at any time, independent of the agent.

#What isn't guaranteed

• Caps limit blast radius, not loss. An agent can still lose everything within its caps — a bad trade, a buggy strategy, a launched token going to zero.
• The Agent API's builders and the MCP server's simulation reduce the chance of a failed or unintended transaction, but a simulation can still miss a revert that only happens under different chain state a block later.
• This is beta software. Start with low caps, and fund a vault with only what you can afford to lose.

#Hartii never handles a private key

The AgentVault wizard at hartiilabs.com/agent only ever accepts the agent's public address — it has no way to generate, accept, or display a private key, and never has. Your agent generates its own key on its own machine (npx -y https://hartiilabs.com/downloads/hartii-agent-mcp.tgz keygen, see MCP setup) and hands you only the address; the key itself never touches a browser or a Hartii server.

#The agent key must be ground in-zone

Quai Network is sharded into zones; a vault's agent address must resolve to a Cyprus-1 address, the zone AgentVault deploys in. A plain random private key lands in Cyprus-1 only about 1 in 512 tries. npx -y https://hartiilabs.com/downloads/hartii-agent-mcp.tgz keygen grinds a fresh key locally until quais.isQuaiAddress(address) and quais.getZoneForAddress(address) === quais.Zone.Cyprus1 are both true, and prints only its address — the key is written straight to a local file and never transmitted anywhere. The vault wizard independently checks the same two conditions on whatever address you paste in, plus that it isn't the zero address or (with a warning) your own connected owner wallet. See MCP setup for the same requirement from the agent runtime's side.

#Revoking access

From hartiilabs.com/agent, "Revoke" clears the vault's agent address and pauses it in one on-chain transaction — the agent loses all ability to act immediately, independent of whatever MCP server or key it was using.

#Reporting an issue

Treat a suspected vulnerability the same as any other Hartii contract issue — see the main FAQ for the current contact channel.