Protocol
Seller guardrails
The rules that limit how much a seller's bond can back, and what happens automatically when a seller crosses one of them.
Why guardrails exist
Leverage lets one bond back several payments at once. That only works if sellers who start losing disputes are slowed down early, by rules and not by people.
Every guardrail below is designed to be enforced by the contracts. None of them requires anyone to review a seller by hand. None of them rejects a buyer's payment: the usual consequence is that payments fall back to escrow, where they are fully backed by their own funds.
The guardrails
| Rule | Value | What happens |
|---|---|---|
| New seller leverage | 1x for the first 14 days | Capacity equals the bond. Every instant payout is fully backed. |
| Growing seller leverage | 2x until day 30 | Capacity is twice the bond. |
| Established seller leverage | 5x after day 30 | Capacity is five times the bond. |
| Capacity limit | bond x leverage | A payment that does not fit in free capacity falls back to escrow until its window ends. Nothing is rejected. |
| Per-payment cap | 2,500 USDC | A single protected payment can be at most 2,500 USDC. This bounds what one dispute can take from a bond. |
| Auto-freeze | above 5% lost disputes over 30 rolling days | Leverage is frozen to 1x. Capacity drops to the bond amount. |
| Seller response deadline | 48h | If the seller does not refund or contest in time, the buyer wins. |
| Bond withdrawal lock | while exposure is open | The bond cannot be withdrawn while exposure is open against it. |
| Commerce refund window | 7, 14 or 30 days | Chosen by the seller and shown on the public profile. |
| Agent session window | 10 minutes to 24 hours | Each session also has a spending cap set by the agent. |
| Signed receipt required | every paid call | In the Agent lane, a missing or late signed receipt means an automatic refund, no arbitration. |
| Seller debt (phase 2) | amount paid by the Guarantee Pool | The seller carries a debt that is repaid from future payouts. |
How the auto-freeze works
The SellerRegistry is designed to track each seller's lost-dispute rate over 30 rolling days.
if lost-dispute rate over 30 rolling days is above 5% → leverage = 1x
A freeze does not stop the seller from selling. It removes the leverage. With a 1,000 USDC bond, an established seller goes from 5,000 USDC of capacity to 1,000 USDC. Payments that no longer fit go to escrow.
The exact definition of the rate, including how refunds made within the 48h response period are counted, will be published with the testnet contracts.
Public profile
Guardrails work better when buyers can see them. Each seller has a public profile, readable by humans and by agents:
| Field | Meaning |
|---|---|
| Protected volume | Amount paid to the seller through UNDO |
| Dispute rate | How often the seller's payments are disputed |
| Lost-dispute rate | How often the seller loses a dispute |
| Bond | USDC currently posted |
| Free capacity | Capacity minus open exposure |
An agent can read these fields before it opens a session. A buyer can read them before checkout.
What guardrails do not do
- They do not judge a seller's products. Only disputes do that.
- They do not remove the shortfall risk that comes with leverage. At 5x, a bond may not cover every lost dispute at once. See Risks.
- They are not set by token holders at will. Governance is bounded to parameters only, never funds. See $UNDO token.