Proof of Agent | Known limits

Trust model

Trust model, reproduced verbatim from spec section 4 as amended
Component	Trust assumption in the MVP
Custody	Trustless for withdrawals. The Agent PDA is the Velocity authority; the program's code decides withdrawals. The venue delegate is POA's trader PDA, never the agent's key, and it cannot swap.
Order router	Trustless in code, admin-set limits. Every agent order is checked on-chain against the router limits before it reaches Velocity: price within 50 bps of the oracle, lifetime at most 120 s, notional at most 5x and hourly turnover at most 10x of the equity basis, perp only, no builder fees. The admin sets the limits within hard bounds fixed in code. Within the limits an agent can still lose value to an account it controls; the drawdown rule and the bond backstop that.
Size cap	Bounds POA-accepted capital. Enforced in the `deposit` instruction. On devnet anyone can deposit straight into the Velocity User; the keeper nets such deposits out of equity.
Whitelist rule	Verified on-chain. `enforce` reads the Velocity User account and confirms a position, or unsettled profit or loss from a fill, exists on a non-whitelisted market before acting. A false report reverts.
Leverage rule	Keeper-attested. The keeper computes leverage from Velocity's own SDK math with Velocity's oracle prices and submits the numbers as evidence. The program checks the evidence against the mandate but trusts that the numbers are honest. On-chain recomputation is roadmap (section 13).
Drawdown rule	Keeper-attested. The keeper samples equity every 60 seconds, submits checkpoints on-chain, and the program computes the 24h high-water mark from those checkpoints. The program trusts the sampled values.
Enforcement trigger	Permissioned. Only the registered keeper key can call `enforce`, `checkpoint`, `keeper_cancel_orders`, `process_withdrawal`, `reduce_for_withdrawal` and `retire_idle`, and `close_positions`, `settle`, `unwind` and `sweep_pnl` except for a Retired agent whose permissionless finish has opened (Shutdown). Each agent's keeper is set by the admin, never by the operator. This is the single centralization point of the MVP and is disclosed as such. A compromised keeper key can steal, not only mis-enforce: leverage and drawdown evidence are keeper-attested, so it can slash the bond of any agent it also deposits into and collect the slash as a depositor; and it chooses the limit price of every close, and of every reduction for a withdrawal, inside the close band (default 5%), so its own maker order at the band edge can take up to that share of every closed notional. On mainnet the keeper key must sit in an HSM or behind a multisig.
Withdrawals	Depositors withdraw any time the agent is Active, at the equity of the keeper's checkpoint in the same transaction as the payment (forward priced: a request carries no price). The keeper attests that equity, as for the drawdown rule, so a compromised keeper key that also holds shares could overprice its own withdrawal at the other depositors' expense; the payment goes only to the depositor's own associated token account. If the keeper does not pay a request within `max_withdrawal_wait_secs` (default 24 h), anyone can wind the agent down.
Shutdown	Once the permissionless finish of a Retired agent opens (below), anyone can close, settle, unwind and sweep it with the same state checks as the keeper and a bounded price, and trigger every depositor's claim (`claim_for`), so no keeper is needed to get the capital out. A caller other than the keeper closes positions inside a tighter band than the keeper's (default 0.5% of the oracle, `permissionless_close_deviation_bps`), so whoever finishes a shutdown cannot take more than that from the investors with its own order. The permissionless finish opens at the end of the grace period (`retire_grace_secs`, default 30 minutes after the retirement) only when the keeper has checkpointed the agent since its retirement (the keeper does so only after checking the agent on fresh prices and finding no breach), and in any case `retire_hard_secs` (default 2 h) after the retirement.
Slash proceeds	Trustless. Distribution is fixed in code: depositors first, remainder to the registry's treasury.
Admin	Can rotate the keeper key, set `k` for new agents, pause new registrations, set the router limits, the exit limits and the minimum deposit within hard bounds, withdraw from the program-owned treasury, and pause the router (orders that are not reduce-only stop; reduce-only orders and cancels still work). Cannot touch bonds, capital, or Velocity accounts, and cannot change or close the treasury account.
Venue	Trusted. Velocity's team can upgrade its program, pause markets, set an equity floor for delegated accounts and force-delete idle dust accounts. Oracles are Pyth Lazer prices cranked by Velocity; the router refuses orders on an oracle older than 150 slots.

Source: Proof of Agent Solana Dev Spec v1.0, section 4, as amended for the move to Velocity (approved on 2026-09-26) and for withdrawals, the shutdown anyone can finish after a grace period and the program-owned treasury (approved on 2026-09-27), reproduced verbatim. "(section 13)" points to the roadmap in that spec, summarized under In plain words below. POA is short for Proof of Agent. Words in code style are program instructions or parameters.

In plain words

Disclosure

The keeper key is held by the team. Only that key can trigger enforcement, which makes it the one central point of the MVP. A malicious keeper could pause and slash an honest agent. An offline keeper means breaches go unenforced until it returns. Both are roadmap items, not hidden. The plan, not yet built, is to open the keeper role to anyone, with keepers posting a bond of their own, and to check leverage on-chain instead of trusting the keeper's numbers. The agent's key cannot withdraw and cannot swap: it can only send orders through POA's router, which caps their price, size and lifetime. A dishonest agent can still trade badly on purpose, or against an account it controls, inside those caps; the bond and the drawdown rule cover that loss, not the router. Velocity itself is run by its own team and can change its program. The keeper is trusted with more than timing. If its key were stolen, the thief could take bonds (through false drawdown or leverage reports on agents it has funded) and up to 5% of every position it closes or reduces. That is why, on mainnet, the key must be guarded like a treasury key, and why checking leverage and equity on-chain is on the roadmap. Investors hold shares and can ask for their money back at any time. The keeper pays each request at the agent's value in its own checkpoint, so that price is keeper-attested too: a stolen keeper key that also held shares could overprice its own withdrawal. If a request waits 24 hours, anyone can shut the agent down. An operator can retire its agent at any time and gets the full bond back if no rule was broken. After a grace period, anyone can finish a shutdown and pay every investor their share, to their own wallet, without the keeper: by default 30 minutes after the shutdown once the keeper has checked the agent, or two hours after it in any case. By default anyone but the keeper closes positions within 0.5% of the oracle, and the keeper within 5%.

Terms used above

Agent PDA: An address controlled only by the Proof of Agent program. No person holds a key for it.
Velocity authority: The owner of a Velocity account. Only the authority can withdraw, transfer deposits, change the delegate, change settings or close the account. Here, the Agent PDA.
Delegate: A key Velocity allows to trade an account without withdrawal rights. Velocity also lets a delegate swap, which can move tokens out, so here the delegate is the trader PDA, never the agent key.
Trader PDA: A second address controlled only by the Proof of Agent program. It is the Velocity delegate, it signs only inside the program's router, and Velocity refuses a swap from it.
Order router: The program's instructions through which the agent key places and cancels orders, such as agent_place_perp_order. Each order is checked for theft protection only; the mandate is checked after trades by the keeper.
Equity basis: What the router's size and turnover caps are measured against: the lower of the capital deposited and the equity in the keeper's latest checkpoint, counting only the shares that are not being withdrawn.
Builder fee: An extra fee a Velocity order can pay to a third party. The router refuses any order that carries one.
Oracle: The price source for a market. On Velocity, Pyth Lazer prices that Velocity posts itself.
bps, slot: A basis point (bps) is 0.01%, so 50 bps is 0.5%. A slot is Solana's unit of time, about 0.4 seconds, so 150 slots is about a minute.
Keeper: Our off-chain service that watches each agent's Velocity account, triggers enforcement and pays withdrawals.
Mandate: The agent's hard rules: allowed markets, maximum leverage and a 24-hour drawdown limit.
k: The multiple that sets the size cap. Size cap = k x bond.
Whitelist rule: The allowed-markets rule, called the market rule elsewhere on this site. A position on a market outside the list (a non-whitelisted market) is a breach.
Velocity User account: Velocity's record of one sub-account: its balances, positions and orders. Here, its authority is the Agent PDA.
Checkpoint: A keeper transaction that records the agent's equity on-chain. The drawdown rule and the price of each withdrawal use it.
Shares: What a deposit gives an investor, issued one for one with the amount deposited. A withdrawal or a claim pays in proportion to the shares held.
Retired: The status of an agent that its operator shut down, that was wound down after a withdrawal waited too long, or that the keeper retired for being idle. It takes no deposits or orders, and retiring records no breach.
Close, settle, unwind, sweep: The steps that take the capital out of Velocity after a shutdown or an enforcement: close the positions, settle their profit and loss, withdraw the cash to the program's capital vault, and collect any gain Velocity pays later.
Close band: How far from the oracle the price of a closing order may be. By default 500 bps (5%) for the keeper and 50 bps (0.5%) for anyone else.
Maker order, notional: A maker order rests on the book until another order fills it. Notional is the size of a position or order in USDT: amount times price.
Treasury: A token account owned by the program. It receives what is left of a slash after depositors are credited. Only the admin can withdraw from it, and nobody can close it or point it elsewhere.
HSM, multisig: A hardware security module keeps a key inside dedicated hardware. A multisig needs several keys to sign.

Other limits of the MVP

Mandate checks run after a trade executes. Proof of Agent's router refuses orders that fail its theft checks, but it never blocks a trade on mandate grounds, so losses can land before the pause. The bond is there to backstop that gap, and it may not cover all of it.
Inside the router's limits, a dishonest agent can still trade badly on purpose, including against an account it controls. At the default limits that can cost roughly 10% of the agent's capital per hour, plus price moves while an order is open, until the drawdown rule stops it; the bond pays depositors first.
With the proposed k = 5, a bond equals 20% of a full size cap.
An agent takes deposits only until its first trade. After that it cannot grow, and a new depositor waits for a new agent.
Only a filled position on a market outside the mandate counts as a breach. An open order there does not. This is a proposed default.
A trade on a market outside the mandate that is opened and closed, and then settled by someone else, before the keeper's enforcement lands leaves nothing on-chain to prove it, and is not slashed.
Orders resting when the agent is paused can still fill, at their own price, for at most two minutes at the default order lifetime.
Closing positions happens in separate keeper transactions after the enforcement transaction.
If a winning position closes when the venue's profit pool is empty, depositors get their principal back at unwind and the gain later, when the pool can pay it; they claim twice.
A withdrawal is paid at the keeper's valuation (Velocity's USD value of the account, net of deposits Proof of Agent did not make). If the quote token trades below par, a withdrawal pays slightly less than par per share and the difference stays with the other investors.
A large withdrawal from an agent with open positions first reduces every position by the withdrawing share, at up to the close band from the oracle; the fees and slippage of that reduction fall on the whole pool.
While the keeper reduces positions for a withdrawal, the withdrawal cannot be cancelled and the agent can only reduce risk until it is paid.
After a shutdown's grace period anyone can close the positions, within 0.5% of the oracle (the keeper within 5%), once the keeper has checked the agent, or two hours after the shutdown in any case.
On devnet, the admin key is also held by the team. The admin can rotate the keeper key and withdraw from the treasury. This is a proposed default.
One venue only: Velocity (formerly Drift), perpetual futures only. Velocity is run by its own team, who can upgrade their program and pause markets.
Devnet only, with test USDT (dUSDT). There is no mainnet deployment and no real funds.
The program has not been audited. Audits are out of scope for the MVP.
There is no insurance. A slashed bond is a penalty paid to depositors, not coverage of their losses.

Optional stricter mode

Velocity lets an account's owner cap its leverage at the venue level. The design includes a registry flag that turns this on, which would make the leverage rule limit trades before they happen instead of checking them after. It is off by default and will stay off for the demo, because it goes against our principle of never blocking trades on mandate grounds.

Stricter mode: Off

Proposed parameters

These are proposed defaults, awaiting team confirmation. They may change before launch.

Schedule A | Proposed defaults
Parameter	Proposed default
Size cap multiple (k)	5, so a full size cap is 5x the bond
Allowed markets, demo agent	SOL-PERP, BTC-PERP
Max leverage, demo agent	5x
Drawdown rule, demo agent	Breach if equity falls more than 15% below its rolling 24-hour high-water mark
Equity	Velocity's net USD value of the account, including unrealized profit and loss, net of deposits Proof of Agent did not make
Equity sampling	Every 60 seconds, stored every 5 minutes
Slash, market rule	100% of the bond
Slash, leverage rule	100% of the bond
Slash, drawdown rule	50% of the bond
Open order on a market outside the mandate	Not a breach. Positions only
Bond asset	USDT only (dUSDT on devnet)
Rounding dust on claims	Each claim is rounded down; less than one base unit per investor stays in the vault
Router price band	50 bps (0.5%) of the oracle
Order lifetime	120 seconds at most, required on every order
Per-order size cap	5x the equity basis
Hourly turnover cap	10x the equity basis
Withdrawal wait before anyone can wind the agent down	24 hours
Grace period before anyone can finish a shutdown	30 minutes after a retirement once the keeper has checked the agent, 2 hours in any case
Close band	500 bps (5%) of the oracle for the keeper, 50 bps (0.5%) for anyone else
Stricter venue-level leverage cap	Off