Countersign

Your AI agent pays your bills. Someone just told it your landlord changed wallets. It won't believe them.

Countersign pays your regular payees in USDC on Sui. It remembers where every address came from, and only pays the ones that were proven. Try to scam it.

The lab assumes the worst: the AI is fully fooled and proposes exactly what the attacker wants. The decision is made by code. Sandbox only: test wallets, no real money.

    How it decides

    Said isn't proven

    Every address in memory is marked verified or stated. Messages, emails and invoices can only ever add a stated address, and stated addresses can't be paid.

    The old wallet signs for the new one

    A change goes through only when the payee's current wallet signs it, or you confirm it and a waiting period passes. The new wallet must prove it's in control too. Anyone can prove control of their own wallet, so that alone is never enough.

    Memory that can't be forged

    Records live in Walrus Memory and are signed by the agent. Text shaped like a record is ignored. If memory can't be read completely, or the chain doesn't answer, nothing is paid.

    Proof

    What's proven so far, generated from CLAIMS.md
    ClaimStatusEvidence
    CL01 Countersign's change logic never makes an attacker address payable, even when the model proposes exactly what the attacker wants (K1–K8, 1,000 random sequences)PROVENpackages/core/test/adversarial.test.ts (M1, P1)
    CL02 Our Sui personal-message verification matches Mysten's published vectors byte for bytePROVENfeasibility/evidence/f1-signatures.json
    CL03 Tatum verifies payee signatures for usPROVENevidence/acts/onboarding-wallet-b/records.json (owner's Slush wallet B signed on /sign; VERIFIED record carries scheme ZKLOGIN, maxEpoch 1271, checked at epoch 1269); pnpm test:live (Ed25519 through the adapter)
    CL04 Payee records live in Walrus Memory on mainnet and are rebuilt completely on startNOT PROVENneeds pnpm test:live restore on a payee namespace; see CL09 for the relayer itself
    CL05 Payments execute through TatumPROVEN (testnet)evidence/live/testnet-payment-2026-10-30T21-22-23-883Z.json (pnpm testnet:pay, REALITY_SPIKES P1)
    CL06 Attack block rate with a real model on testnetNOT PROVENPRD "Preregistered measurement"
    CL07 ≥10 memories on mainnet from real useNOT PROVEN (6 of 10 on 2026-10-31 17:29 UTC)evidence/acts/act3/records.json (memoryCounts: payee:rent 2, receipts 4)
    CL08 Tatum's Sui gateway verifies an Ed25519 personal-message signature and rejects it for a different address or an altered message (mainnet gRPC `VerifySignature`, 2026-10-30)PROVENevidence/spikes/spikes-2026-10-30T20-48-55-762Z.json (S10)
    CL09 A Walrus Memory mainnet write returns a blob id in about 20–23 s, and recall returned all 3 records of a 3-record namespace with none dropped (2026-10-30)PROVENevidence/spikes/spikes-2026-10-30T20-46-45-854Z.json (S2, S12)
    CL10 Our Walrus Memory adapter writes agent-signed records and a fresh adapter reads them back complete: namespace count, full listing and recall agree, nothing dropped, and a retried write adds nothing (3 records, 2026-10-30)PROVENevidence/live/memwal-2026-10-30T21-08-15-263Z.json (pnpm test:live, V18)
    CL11 Tatum verifies a zkLogin signature from a real Slush wallet and rejects it for another address or an altered message (mainnet and testnet, 2026-10-30)PROVENevidence/spikes/s10z-2026-10-30T21-01-30-353Z.json (S10z)
    CL12 Act 1: the agent rebuilds its payee book from Walrus Memory, the model proposes a payment, code checks and converts it, 0.01 test USDC settles through Tatum, and an agent-signed receipt citing the payee-version blob and the Sui digest is stored on Walrus Memory (2026-10-30)PROVEN (testnet money, mainnet memory)evidence/acts/act1-2026-10-30T21-53-37-449Z.json and .txt
    CL13 Walrus Memory recall returns every record of a namespace holding 100 records (the cap): count, full listing and recall all equal 100, none dropped (2026-10-31)PROVENevidence/live/s12-scale-2026-10-31T05-57-57-893Z.json (REALITY_SPIKES S12b)
    CL14 Acts 2–3 on the deployed agent: a message asking to pay a look-alike of Rent's verified address (same first and last 4 hex characters) is refused with the grouped comparison, and the same message again is refused as a known attack citing the first receipt; both receipts are stored on Walrus Memory mainnet (2026-10-31)PROVENevidence/acts/act2/records.json, evidence/acts/act3/records.json (receipts, blob ids answering 200 from the mainnet aggregator, screenshots of the live /r pages)