Wallet security
About this demo
The shop at /agentic-payments is a Base Sepolia testnet checkout. It asks for an EIP-3009 TransferWithAuthorization only after you connect a wallet and click authorize. It does not request a signature on page load, and it refuses Ethereum, Base, and other mainnet chain ids.
- Network
- Base Sepolia (eip155:84532, chain 84532)
- Token contract
- Official Base Sepolia USDC 0x036CbD53842c5426634e7929541eC2318f3dCF7e
- Payee
- Agentic Insights demo payee 0x355e413514dBE87b335B765e1EE5c947Db8a941B
- Amount and window
- Exact cart total, at most 100 USDC. The signature becomes valid 60 seconds before it is requested and expires 8 minutes later. Each signature uses a new 32-byte nonce. The server challenge budget is 10 minutes.
What is not requested
The demo does not ask for an unlimited token approval, setApprovalForAll, a permit for the maximum uint256, eth_sign, or personal_sign of an opaque hex blob. Restoring a purchase signs a short readable message that states the signature is free and does not authorize a payment.
Wallet prompts label the recipient field “Payee” because that is the USDC EIP-712 field. Compare that address with the payee above before confirming. Testnet USDC has no mainnet value.
Security contact: vaskin@agenticinsights.com. Machine-readable disclosure: /.well-known/security.txt.