AgentValve: Sybil-Resilient Payment Authorization for Permissionless AI Markets

What it claims

AgentValve replaces global reputation scores with personalized capacity in a trust graph. It proves two properties:

• Cut-bounded exposure. The total value honest clients can lose to adversarial providers never exceeds the capacity on the edges crossing from the honest region into the adversarial one.
• Bounded depletion amplification. Cumulative honest capacity destroyed by malicious senders is at most (H_max − 1) times the value those senders actually paid to honest receivers.

The motivating problem is concrete. Per a cited study of deployed ERC-8004 registries on Ethereum, BNB Chain and Base, more than 98% of feedback records carry no payment proof or task linkage. Between 59.2% and 90.6% of reviewers are flagged as part of coordinated campaigns. A single ceiling-valued review pushes the median agent past a trust threshold of 90 for $0.0027–$0.055.

How it works

• Seeding. A set of honest TrustRoots is assumed, and their outgoing edges get initial capacity at setup. All values and capacities are in one fixed asset, such as a stablecoin, so no price oracle is needed.
• Routing. Untrusted, independently run pathfinders rebuild the graph from finalized chain data and propose routes. The contract re-validates every route. Three parameters keep verification cost independent of graph size:
• H_max (≥2): maximum edges per path.
• K_max: maximum paths per route.
• U_max: maximum unique edges per route.
• Admission. In one atomic transaction, the contract checks capacity, transfers the payment, and reserves capacity on every edge of the route.
• Resolution. The sender's later feedback settles the reservation:

flowchart LR
  P[Payment admitted<br/>capacity reserved] --> F{Sender feedback}
  F -->|positive / neutral| R[Reservation released<br/>capacity reusable]
  F -->|negative| C[Reserved capacity<br/>permanently consumed]
  F -->|positive, adversary→honest| I[Creates ingress<br/>capacity into honest region]

• Anti-depletion rule. Capacity into the honest region from an adversarial sender is created only by positive feedback on a payment to an honest receiver. Receiving a payment creates no reverse capacity. An attacker therefore has to pay before they can burn honest capacity, and with path length capped at H_max each unit of ingress can deplete at most H_max − 1 honest edges.
• Witness-commit. A route witness aggregates repeated edge loads, so verification takes linear rather than repeated array searches. The contract stores only a constant-size commitment per payment, and the same load table is re-authenticated at resolution. Unresolved witnesses are recovered from finalized on-chain data.

The design builds on Bazaar's reservation-and-feedback semantics for centralized marketplaces. It borrows its off-chain routing / on-chain execution split from Circles and Trustlines.

Evidence

• Data. The trust graph is derived from January–August 2026 Ethereum transactions, plus synthetic workloads.
• Exposure. It stayed within the fixed cut bound with up to 10,000 Sybil identities and chosen attackers.
• Depletion. Constructed depletion workloads reach the amplification bound. The bound is tight, not loose.
• Admission cost. Up to 40.8% lower than a baseline that reconstructs and stores per-edge reservation records. A common payment costs about $0.04–$0.21 at Ethereum prices at the time of writing.

Limits

• Trust assumption. Security depends on the TrustRoots being honest and on capacity actually reflecting trust. The bound is only as good as how much capacity honest agents choose to extend across the cut.
• Depletion is bounded, not prevented. An attacker willing to pay can destroy up to (H_max − 1)× their spend in honest capacity. Choosing H_max trades routing reach against this amplification.
• Admission constraint. Payments can only be admitted where enough path capacity exists. The fetched text does not quantify how often honest payments are refused.
• Cost depends on the chain. Cost figures are Ethereum-specific and tied to current gas and ETH prices.
• Truncated page. The fetched text stops in the system model, before the full evaluation section. No code release, licence, or deployment address is given in the visible text.