x402 Escrow

​

Use x402 escrow when

• An agent needs verified data without a Molpha subscription.
• Payment should be exact USDC per round, priced by quorum.
• The agent can handle 402 envelopes and fund an escrow ATA.
• You want settlement through settle_agent_round.

​

On-chain escrow

#[account]
pub struct AgentEscrow {
    pub authority: Pubkey,   // Ed25519 signer of AgentRequestAuth
    pub status: AgentStatus, // Active | Paused
    pub bump: u8,
}

["molpha_agent", authority, gateway]

authority == payer
ATA(PDA(["molpha_agent", payer, gateway]), USDC)

​

Flow

1. Agent calls POST /v1/agent/execute with exact amount equal to the computed round price.
2. Gateway checks escrow ATA balance (minus reserved unsettled spend).
3. If underfunded, gateway returns a standard x402 402 Payment Required envelope with payTo = escrow ATA.
4. Payer sends USDC to payTo, signs AgentRequestAuth, and retries with the same canonical_timestamp.
5. Gateway serves the round and records it in the settlement outbox.
6. settle_agent_round verifies AgentRequestAuth, transfers the locked price to the treasury, and writes an agent round-record PDA.

​

Request authentication

sha256(
  "MOLPHA_AGENT_REQAUTH_V1" ||
  borsh(AgentRequestAuth{
    agent,                 // escrow PDA
    gateway,               // gateway PDA
    feed_id,
    canonical_timestamp,   // u64
    amount                 // exact settlement price
  })
)

price = agent_round_base + signatures_required * agent_round_per_sig

["molpha_agent_round", authority, gateway, api_config_hash, signatures_required, canonical_timestamp_le]

​

Failure handling

​

vs Delegate

​

Security notes

• Retry the identical request after payment (same canonical_timestamp).
• Treat gateway balance views as advisory until settlement finalizes.
• Verify the returned signed payload before application use.
• Enforce freshness on canonicalTimestamp.