CosignHow Cosign works
How Cosign works
Exchain co-signs agent payments from the owner's own wallet.
Every agent payment from a guarded wallet needs two signatures: the agent's and the attested quorum's. Exchain co-signs only payments that fit the wallet's mandate.
| Term | Meaning |
|---|---|
| Guarded wallet | A wallet the owner holds, where an agent payment needs the agent key and every member of the attested quorum |
| Attested quorum | Exchain's signing enclaves. Each member runs attested code and checks every payment itself: Trust model |
| Mandate | The limits the owner sets: caps, rolling windows and seller rules |
| Node Token | The bearer token for every API call. It also decides the network |
A refusal stops at the service and nothing is signed; the contract still enforces the owner's ceiling.
Guarded wallets per chain
| Cardano | EVM chains | |
|---|---|---|
| Wallet | Masumi smart wallet | Stock Safe 1.4.1, no custom contract |
| Signers | Agent key and every attested quorum key, threshold 3 | Agent address and one address per attested quorum member, threshold = all owners |
| Owner | Owner key, outside the quorum | Owner address, installed as the only module |
| Assets | Up to 16 per wallet: ADA, USDM, USDCx | Several per Safe: USDC, EURC, PYUSD, USDG, USDT, by chain |
Chains per network: Networks.
Who enforces what
| Rule | Cardano | EVM chains | Exchain |
|---|---|---|---|
| Agent and quorum signatures | Contract | Safe | Yes |
| Per-period ceiling | Contract, per asset | None. The Safe balance is the limit | Cardano: checked before signing |
| Payee pinning | No | No | Service and each quorum member |
| Mandate limits and seller rules | No | No | Service |
| Owner exit and on-chain policy | Owner key only | Owner module only | Not involved |
If the agent key and every quorum key were compromised together:
- Cardano: at most the rest of the current on-chain period ceiling could move, to any address.
- EVM chains: never more than what the owner chose to put at risk: the Safe's balance, plus any treasury allowance and Permit2 approval the owner set. Everything else stays out of reach, and the owner can withdraw at any time without Exchain.
GET /v1/wallets/{walletId}/bound reports this as worstCase: Bound statement.
Rails
| Rail | Endpoint | Guide |
|---|---|---|
| Cardano layer 1 | POST /v1/cosign | Cardano |
| Cardano Hydra head | POST /v1/cosign with a snapshot | Hydra in-head payments |
| EVM direct, to any address | POST /v1/evm/cosign | EVM chains |
| EVM inside x402 | POST /v1/x402/cosign | EVM chains |
Steps at a glance
| Step | Guide |
|---|---|
| 1. Create and register the guarded wallet | Create and register a wallet |
| 2. Co-sign each payment before it is sent | Co-sign a payment |
| 3. Handle refusals and retries | Refusals and retries |