Start here
The problem
Payments on Arc are final in under a second. That leaves buyers and AI agents with no recourse when something goes wrong.
Finality cuts both ways
On Arc a USDC payment is final in under a second. There is no pending state and no reversal. For a seller this is ideal: the money is there and it stays there.
For the payer it is a gap. If the goods never ship, if the wrong amount is sent, or if a paid API returns nothing, the payer has no recourse. The only way to get money back is to ask the seller and hope.
Card payments solved this decades ago with a dispute process. Stablecoin payments have nothing equivalent built in.
What buyers lose
A buyer paying a seller they do not know takes on all of the delivery risk. In practice this means:
- Buyers avoid new or small sellers, even honest ones.
- Buyers keep order sizes small.
- A seller with a good record cannot prove it, because there is no shared, public dispute history.
Sellers pay for this too. Without a refund path, they lose sales that would have happened on a payment method that has one.
What agents lose
AI agents pay for data, compute and API calls in small amounts, often many times per minute. An agent cannot read a terms page, email support or wait three weeks for a reply. It needs a rule it can check in code.
Today an agent that pays for a call and receives a timeout has lost that money. Across thousands of calls, that adds up, and the agent has no standard way to prove what happened.
Why escrow alone does not solve it
The classic answer is escrow: hold the payment until a refund window ends, then release it to the seller. This protects the buyer, but it removes the main advantage of paying on Arc.
| Plain payment | Classic escrow | UNDO (planned) | |
|---|---|---|---|
| Seller is paid | Instantly | After the window ends | Instantly, while under capacity |
| Buyer can get a refund | No | Yes | Yes |
| Seller's working capital | Free | Locked for every sale | Only the bond is locked |
| Works for per-call agent payments | Yes, without recourse | Not practical | Yes, with signed receipts |
Escrow makes every sale wait. A seller with a 14-day window would have two weeks of revenue locked at all times.
What UNDO changes
UNDO separates the payment from the protection.
The seller posts a USDC bond once. The bond stands behind many payments at the same time. While the seller's open exposure stays under bond x leverage, each payment goes straight to the seller. If a dispute is lost, the refund comes out of the bond.
The money moves, the guarantee stays.
When a seller is over capacity, the payment falls back to classic escrow until its window ends. Nothing is rejected, and the buyer is protected either way.
The design extends Circle Research's open-source Refund Protocol (Apache 2.0). UNDO is an independent project and is not endorsed by Circle. See Architecture for what is reused and what is new.