Frost runs on a rail of MetaMask Smart Accounts, ERC-7710 redelegation, x402 payments, Venice AI inference, and 1Shot execution — composed so an autonomous agent can do exactly what you authorised and nothing more.
MetaMask Smart Accounts give every user a programmable account. The user signs once; agents never touch the seed.
Smart AccountsERC-7710 redelegation encodes bounded, revocable mandates. Authority flows down a chain and can only ever narrow.
ERC-7710 / 7715x402 pays per call in USDC. Venice AI supplies native-x402 inference and read-side RPC for the monitor and pricer agents.
x402 · Venice1Shot submits transactions through a private mempool. Every decision is hashed into an on-chain Merkle root.
1Shot · MerkleYou describe a workflow in plain English. The master agent compiles it into a structured authority spec with explicit caveats.
You review the spec and sign one root mandate with your smart account. No standing agents exist yet.
When the trigger fires, the master dynamically issues sub-mandates and spawns specialists — monitors, pricers, executors.
Any action above your HITL threshold pauses the session and fires an OS notification. You approve or deny.
The executor submits through 1Shot's private mempool to avoid front-running. Inference is metered per call over x402.
The full decision tree is hashed and the Merkle root is anchored on Base Sepolia. Revoke any branch at any time.
Frost's on-chain core is deliberately small. Six contracts hold the entire authority, settlement, and audit model — each one auditable in isolation.
Issues root mandates and sub-mandates; validates each operation against the active caveat set and ancestry.
Refill replaces the active mandate and mints a fresh mandateId per cycle (Option A).
Tracks aggregate redelegation state so caps hold across the whole sub-mandate tree.
x402 settlement over USDC. The USDC address is hardcoded immutably per chain.
Whitelists the inference / execution providers an agent may pay and call.
One-call revocation of any delegation — a branch or the master's spawning authority.
Every sub-mandate is a strict subset of its parent — lower caps, fewer calls, shorter TTL, narrower chain scope. A child can never out-scope its parent.
The human-in-the-loop threshold intersects upward: sub-mandates can only lower it, tightening safety. A min here would silently weaken the guarantee — so it is forbidden.
A single rate-limit bucket covers both x402 settlements and sub-mandate issuance, so a runaway agent can't escape the cap by switching channels.