> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chance.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Escrow wallets

> A wallet your agent can only move through the harness — every transaction simulated, judged against your rules, and signed only if it passes.

Without escrow, the harness is **advisory**: it returns a verdict and your agent decides whether to honor it. That's fine if you trust the agent — but a misbehaving or hijacked agent can ignore a `BLOCK` and execute anyway, because it holds its own keys.

**Escrow wallets close that gap.** You provision a real wallet — on Ethereum, Base, or Solana — that your agent can propose transactions from but cannot freely sign. Every proposed transaction is **simulated**, **judged against your rules**, and only then does it reach a signature. A denied action is never signed, so there is nothing to undo.

<Note>
  Escrow wallets are backed by [Privy](https://privy.io). An **autonomous** wallet is a Privy server wallet with Chance as a policy-bounded additional signer. A **safe** wallet is your own **self-custodial embedded wallet** — the key lives in Privy's client-side enclave and Chance's servers structurally cannot sign for it.
</Note>

## Two trust models

You choose per wallet, at creation. The mode is permanent — pick the one that fits how much you want to be in the loop.

<CardGroup cols={2}>
  <Card title="Autonomous" icon="bolt">
    Chance can sign and submit automatically **the moment a transaction passes verification** — no human in the loop. Its signing key is an *additional signer* on your wallet, bounded by on-chain **policies that only you can change**. Best for hands-off agents doing routine, well-scoped work.
  </Card>

  <Card title="Safe" icon="lock">
    **Self-custodial.** The wallet is your own embedded wallet — Chance holds no key and cannot sign, even if fully compromised. When a transaction passes verification you get a **personalized approval link**; you review the simulated outcome and confirm **in your own wallet's signing prompt** — a second confirmation layer even Chance's UI cannot misrepresent. Best for higher-value wallets where you want the final say.
  </Card>
</CardGroup>

## How a transaction flows

<Steps>
  <Step title="PROPOSE">
    Your agent proposes an action — "send 500 USDC to `0x…`", or a raw transaction it built for any protocol. It cannot sign it.
  </Step>

  <Step title="SIMULATE">
    Chance runs the exact transaction against live chain state and computes what it would actually do — every asset that moves, priced in dollars, plus whether it would revert. The simulation is the ground truth, not the agent's description of what it's doing.
  </Step>

  <Step title="VERIFY">
    The simulated outcome is checked against your rules — the hard limits **and** the plain-English mandate — and returns `ALLOW`, `BLOCK`, or `ESCALATE` with its reasoning.
  </Step>

  <Step title="SETTLE">
    A passing verdict clears to a signature: **autonomous** signs immediately, **safe** hands you an approval link and you sign in your own wallet — the exact verified calls execute as **one atomic, gas-sponsored operation**, and Chance marks the transaction executed only after checking the mined bytes match the approved bytes exactly. A `BLOCK` never reaches signing. Fail-closed by default.
  </Step>
</Steps>

## What gets enforced

Escrow verification checks a proposed transaction on three independent layers. All three must pass.

### Deterministic limits

Hard, checkable rules, enforced in code with no model involved — instant, and free (no credit spent). You set them per wallet, and only you can change them:

* **Per-transaction and daily dollar caps** — computed from the *simulated* outflow, so a transfer of an obscure token is measured by what it's actually worth, not by a number the agent typed.
* **Recipient and token allowlists** — restrict where funds can go and what can be sent.
* **Permission grants are decoded, not trusted.** An unlimited token approval moves nothing today, then lets a spender drain you later — the classic wallet-draining vector, invisible to a limit that only watches transfer amounts. Chance decodes every approval deterministically from the calldata bytes (spender, token, exact amount, dollar value) and flags **unlimited** and **oversized** grants prominently to the judge and on your approval page. Your mandate is the policy: a grant your rules don't permit is blocked like any other action.

In **autonomous** mode these limits are also written into the wallet's on-chain Privy policy — a ceiling enforced by Privy's infrastructure that **Chance's own signer cannot loosen.** Only you can.

### The intent (your mandate)

Every wallet carries a plain-English **mandate** — what the wallet is *for*. The judge reads it and rules on whether a transaction honors it, catching things a numeric limit can't:

> *"Treasury ops wallet — may pay vendors from the approved list, never move funds to a new address."*
>
> *"Stablecoins only. Never send ETH or any volatile asset."*

A transaction can be well within every dollar limit and still violate the intent — sending a volatile asset from a stablecoin-only wallet, or paying an address that isn't what you meant. That's the judgment layer: it enforces the spirit of the rule, not just the numbers. See [The verification harness](/concepts/harness).

### The simulation itself

If the transaction would **revert**, it's blocked before it burns a cent of gas. If its effects can't be verified against your dollar limits, it fails closed rather than guessing — in autonomous mode it falls back to an approval link instead of auto-executing.

## Gas sponsorship

Chance can **sponsor gas** so your wallet doesn't need to hold the native token to transact — fund it with USDC and go.

* **Safe wallets** are always sponsored: your confirm executes as a single atomic operation with gas paid by Chance's [Alchemy Gas Manager](https://www.alchemy.com/gas-manager) policy. A USDC-only wallet works with zero native dust.
* **Autonomous wallets** sponsor optionally and degrade gracefully: if sponsorship is unavailable, the transaction simply pays its own gas.

## Provision and use from your agent

Escrow wallets are first-class in the [MCP connector](/mcp) and [HTTP API](/api-reference/introduction). Your agent can create and use them by name:

<ResponseField name="create_escrow_wallet" type="tool">
  Provision a new escrow wallet. Inputs: `name`, `chain` (`ethereum` / `base` / `solana`), `mode` (`autonomous` / `safe`), `mandate` (your plain-English rules). Safe mode is Ethereum and Base only for now. The address is returned immediately and is permanent — fund it and go.
</ResponseField>

<ResponseField name="escrow_transfer" type="tool">
  Propose a transfer — `wallet`, `asset` (e.g. `usdc`, `eth`), `amount`, `to`, `chain`. Runs the full simulate → verify → settle flow.
</ResponseField>

<ResponseField name="escrow_execute" type="tool">
  Propose a raw transaction or batch your agent built for any protocol — same flow, same gate.
</ResponseField>

<ResponseField name="list_escrow_wallets / get_escrow_transaction" type="tool">
  List your wallets, or check the status, verdict, and receipt of any proposed transaction.
</ResponseField>

A typical prompt:

> *"Create an autonomous escrow wallet on Base called treasury. Mandate: may send up to \$500 USDC per day to addresses on my allowlist, nothing else. Then send 100 USDC to `0x…`."*

```
→ Wallet created: 0xB21f…0480
→ Send 100 USDC to 0x…
  Simulated: −100.00 USDC (≈ $100.00) → 0x…, gas sponsored
  Verdict: ALLOW — within the daily cap, recipient on the allowlist, plain transfer
  Executed: https://basescan.org/tx/0x…
```

You can also manage everything — balances, mandate, limits, and transaction history — from the **Escrow** tab in the [dashboard](https://harness.chance.cc/dashboard).

## The trust model, precisely

The point of escrow is that you don't have to trust the agent — or even Chance — more than the mode allows:

|                                 | Autonomous                                                                    | Safe                                                                            |
| ------------------------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| Who holds the key               | Privy server wallet; Chance is a policy-bounded additional signer             | **You** — your own self-custodial embedded wallet                               |
| Who can sign                    | Chance, on `ALLOW`, **within your policy**                                    | Only you, in your own wallet's signing prompt                                   |
| If your agent is hijacked       | Can only propose; every action is still simulated, judged, and policy-bounded | Same — and nothing executes without your signature                              |
| If Chance itself is compromised | Bounded by the on-chain policy, which Chance cannot loosen — only you can     | **Cannot sign anything, structurally** — the key never touches Chance's servers |
| Best for                        | Hands-off, well-scoped agents                                                 | Higher value, human-in-the-loop                                                 |

For safe wallets the byte-exactness gate runs twice: the verdict binds to the exact bytes at proposal time, and after you sign, Chance refuses to mark the transaction executed unless the **mined** operation decodes to exactly those bytes from exactly your wallet.

Every verdict is **signed and hash-chained** — you can prove after the fact exactly what was simulated, what rule was checked, and why it passed or failed. See [Provable verdicts](/concepts/proofs).

## Networks

Ethereum, Base, and Solana mainnet — all **mainnet only**. Safe (self-custodial) wallets are Ethereum and Base for now; Solana safe wallets follow the same model soon.

***

Ready to give your agent a wallet it can't misuse? [Open the dashboard](https://harness.chance.cc/dashboard) or [get in touch](https://chance.cc).