Who you trust
No system removes trust; it moves it. This page lists every party in an agent payment on Cardano, what you rely on it for, what happens if it is dishonest or compromised, and what it can see.
What you trust, and what happens if they lie
Section titled “What you trust, and what happens if they lie”| Party | You trust it to | If it lies or is compromised |
|---|---|---|
| Turnkey | Keep your keys in its enclaves and sign only requests carrying a valid stamp from your passkey | It could sign anything with your keys. Turnkey is the custody root of trust; ZyroPay verifies each returned Cardano signature, which detects a wrong signature, not a malicious one |
| ZyroPay’s API | Enforce the policy, build the transaction the review describes, and broadcast honestly | In Always Ask it cannot sign on its own. But it writes the review your app shows: it could describe one payment and give your passkey another to sign. See below |
| ZyroPay’s MCP worker | Pass tool calls through and deliver the signed payment to the URL it was bound to | It can create requests, which still pass policy and your passkey. It could withhold a delivery (the payment stays deliverable). It also measures the body for the proof and the receipt check: a compromised worker could alter what the agent sees and report the hash of the original, so the proof assumes this worker is honest |
| Your AI client (Claude, ChatGPT…) | Ask for what you asked for | It can ask for anything within what the tools allow. Policy denies what you did not allow; on Cardano everything else comes to you for approval |
| The seller | Deliver what it sold | Direct payment: you lose the price; its receipt either does not verify or proves what it sent. Escrow: a wrong delivery shows mismatch, no delivery not_delivered, and you can refund before unlock |
| The facilitator (in the seller) | Verify and submit the payment | It can only submit the transaction you signed, which pays exactly payTo the amount; or not submit it, in which case the validity window passes and the reservation is released |
| Masumi escrow script and admins | The script enforces the states and deadlines; 2 of 3 admins settle disputes after the dispute time | The script is public code; ZyroPay locks only into the canonical deployment. Colluding admins could settle a dispute against you, only from Disputed and only after the dispute time |
| The Masumi registry | Be a faithful list of NFTs and their metadata | It is permissionless: an entry proves who controls it, not that they are honest. ZyroPay verifies the binding on chain and refuses on any failure |
| Blockfrost | Report chain state and submit transactions | A lying provider could misreport an escrow’s state or a confirmation; it cannot forge a signature or move funds. Proof and confirmation states depend on it |
| Price sources (CoinGecko, Jupiter) | Report USD prices | A low price could let a payment pass a USD limit. Values round up, stale prices are dropped, and every Cardano payment needs your passkey anyway |
| Cloudflare, Neon | Run the code as deployed and keep the data | The host of the API is in the same position as a compromised API |
| Cardano | Final settlement | Consensus failure is outside ZyroPay’s model |
ZyroPay’s API
Section titled “ZyroPay’s API”The approval checks protect you against the agent, the MCP worker and a tampered app: the API refuses to forward any stamp that is not over exactly the bytes it stored. They do not protect you against the API itself. The app shows the review the API sends, and the passkey prompt shows no transaction details; the app does not decode the transaction on the device. A compromised API could therefore show “2 ADA to the seller” and ask your passkey to sign a body that pays someone else. Decoding the transaction on the device and showing what it pays is the fix; it is not built.
What each party learns
Section titled “What each party learns”| Party | Learns | Does not learn |
|---|---|---|
| Your AI client | Balances, addresses and recent transactions of the wallets you shared with that agent; its own policy; request states; the paid response | Your other wallets, your keys, other agents |
| ZyroPay (API, database) | Your account, every address in it, balances, every request and approval, your agents and policies, the paid URL, the seller, the hash of what was delivered | Your keys; the paid content itself (the MCP worker reports only its hash and status) |
| ZyroPay’s MCP worker | The agent’s tool calls and results, including the paid content in transit | Your keys, your session, the database |
| Turnkey | Your sub-org, wallets and public keys, every request your passkey stamps (for Cardano, a 32-byte body hash, not the transaction) | What the transaction does, beyond what it signs |
| The seller | Your paying address (and so its on-chain history), the amount, the time, the URL and query you paid for (for example the address you asked about) | Who you are, your email, your other addresses |
| Blockfrost | The addresses ZyroPay queries and the transactions it submits, from ZyroPay’s API key | Which user they belong to |
| Everyone (the chain) | Payer and payee addresses, amounts and times; for escrow, the datum: buyer and seller key hashes, the signed terms, deadlines and the result hash | The delivered content (only its hash is on chain) |
There is no payment privacy: a Cardano payment links your address to the seller in public, and an enterprise address carries its whole history. ZyroPay does not try to hide that.