AgentValve: Sybil-Resilient Payment Authorization for Permissionless AI Markets

What it is

AgentValve is a payment-authorization protocol (paper by Zhang, Luo, Kate; arXiv 2610.12948v1, cs.CR) aimed at agents paying providers in ERC-8004-style permissionless registries. It replaces global reputation scores with personalized capacity in a directed trust graph, enforced by a smart contract. The fetched text cuts off in §3.1, so the full protocol, proofs, and evaluation details are not covered here.

Why it matters

The paper's motivation is concrete. It cites a measurement study (Xiong et al.) of deployed ERC-8004 registries:

• More than 98% of feedback records carry no payment proof or task linkage.
• 73.5%, 59.2% and 90.6% of reviewers on Ethereum, BNB Chain and Base are flagged as candidate coordinated Sybil campaigns.
• One ceiling-valued feedback record lifts the median rated agent above a trust threshold of 90. It costs about $0.055 on Ethereum, $0.0042 on BNB Chain and $0.0027 on Base.

So an agent that maps a global reputation score straight to a payment limit has no protocol-level bound on loss.

How it works

• Cut-bounded exposure. Every path from honest sender to adversarial receiver crosses an edge from the honest region into the adversarial one. Honest exposure is bounded by the total capacity of that cut. Adding Sybils or raising capacities inside the adversarial region does not raise the bound.
• Atomic reservation. The contract checks route capacity, transfers payment and reserves capacity on every edge in one transaction. The sender's later feedback resolves it. Positive or neutral feedback releases the capacity. Negative feedback consumes it permanently.
• Depletion defense. Capacity into the honest region from an adversarial sender is created only after positive feedback on a payment to an honest receiver, and receiving a payment creates no reverse capacity. Paths are capped at Hmax edges. Cumulative depletion is therefore at most (Hmax−1) times cumulative adversarial-to-honest payment value.
• Cost control. Pathfinders discover routes off-chain and are untrusted, and the contract re-validates every route. A route witness aggregates repeated edge loads for linear verification. The contract stores only a constant-size commitment per payment and authenticates the same load table at resolution.
• Parameters. Hmax ≥ 2 caps path length. Kmax caps paths per route. Umax caps unique edges per route.

Preconditions

• A set of honest TrustRoots is assumed. The contract seeds finite capacity on some of their outgoing edges, so trust is bootstrapped from pre-trusted nodes.
• All values and capacities use one fixed payment asset, with a stablecoin suggested. This avoids a price oracle.
• Pathfinders reconstruct the trust graph from finalized public chain data.

Results

• Exposure stayed within the fixed cut bound with up to 10,000 synthetic Sybil identities.
• Constructed depletion workloads reached the amplification bound, so it is tight rather than loose.
• Admission cost was $0.04–$0.21 for common payments at the Ethereum price when the paper was written.
• Witness-commit cut admission cost by up to 40.8% against a baseline that reconstructs and stores per-edge reservation records.
• The graph came from January–August 2026 Ethereum transactions plus synthetic workloads.

Caveats

• The guarantee bounds loss to capacity honest agents extend across the cut. It does not stop that capacity from being lost, and honest agents choose how much to extend.
• Depletion amplification is real: up to Hmax−1 times the attacker's paid-in value.
• The cost and Sybil results are from a prototype on synthetic attack workloads, not a live deployment.
• Sender feedback decides whether capacity is consumed, so the design relies on that feedback signal.