An agent that remembers who burned it

Agents can pay for API calls by themselves now. A server answers 402 Payment Required, the agent signs a stablecoin transfer, and the data comes back. What nothing tells the agent is which sellers are worth paying.

We looked at a public directory of pay-per-call routes on Sui. It lists 46 routes and marks all 46 as passing its probe. We sent each one a single unpaid POST and recorded the reply. 19 of 46 (41%) did not answer with a 402, the same 19 routes across 6 measurements from 12:49 to 16:50 UTC. Some tunnels had vanished, some deployments returned 404, and some origins had stopped responding. All of those were measured on 2026-11-01. That is a snapshot, not a verdict, and a route can come back. But it shows the gap: a listing tells you a seller exists, not that it delivers.

So we built TwiceShy, a buying agent that remembers. It pays real USDC for answers, spot checks them against the chain, stores what it learned on Walrus Memory, and buys differently next time.

What it does

Every round it does six things:

1. Recall its beliefs about each seller from Walrus Memory.
2. Decide who is worth paying: the lowest price per good answer among sellers it trusts.
3. Pay with x402 on Sui mainnet: a gasless USDC transfer the buyer signs and the seller broadcasts.
4. Check the answer when a check is due, against truth it reads for itself through Tatum.
5. Revise its belief about that seller.
6. Remember the verdict and the belief on Walrus Memory.

The new idea is canary questions. The agent asks sellers things it can already verify, using fresh wallets so nothing can be cached. Passing earns trust. It then spends that trust on work it cannot verify: a swap quote is only bought from a seller whose market data has held up against the chain.

Trust also thins out the checking. The better a seller's record, the less often it gets spot checked, down to one purchase in five, and never to zero for work it can verify. A wrong answer costs more trust than a pass earns, and taking money without answering costs the most. Evidence decays, so a seller can fall fast and earn its way back after a cooldown.

How it uses Tatum

Tatum is the agent's only view of the chain, so a seller's claims are never checked against the seller. All chain reads go through the Tatum Sui gRPC gateway:

• Balances, read before and after each purchase, to grade what a seller says a wallet holds.
• Price, from the live current_sqrt_price of the deepest native USDC/SUI pool. A pushed price feed on Sui turned out to be weeks stale, so a live pool is better truth. The Tatum Data API rate is a second source: if the two disagree, nobody gets graded on price that round.
• Fresh canaries, drawn from the newest checkpoint.
• Receipts. The buyer computes the transaction digest before the seller sees the payment, so it reads settlement from the chain whatever the seller reports.

That last one matters. In our run, one independent seller answered all 21 signed payments with HTTP 500. Because we already knew each digest, we could confirm none had settled, so no money moved. Without that, "error" and "took the money" look identical. The same check caught our control seller when it really did take the money.

How it uses Walrus Memory

Memory is the agent's only long-term state. There is no database behind it. Each purchase writes a verdict, and each seller has a versioned belief: trust, evidence, cooldown, and why it last changed.

Recalled beliefs change the product directly. They pick the seller, set how often it is checked, start and end cooldowns, and decide whether unverifiable work gets bought at all.

We proved that with a wipe test: a fresh clone of the repo, with only keys and no local state, recovered all 8 beliefs from Walrus Memory and made the same next decisions.

How it learned over time

We ran a comparison and published the plan and the fault schedule before the first round. Two buyers shopped the same live market with real USDC for 18 rounds. One remembers. The other is blind: it takes the cheapest listing every time and checks nothing.

To test how a buyer handles a seller turning bad, we ran a seller of our own. The control seller is ours, it says so in every response, and it is never counted as independent. It was honest at first, then returned figures inflated by 7% during a published window, then took a payment and returned nothing, then went back to honest.

	Memory	Blind
Correct answers	52	34
Wrong answers accepted	0	11
Charged with no answer	0	2
Paid for wrong answers	$0.05	$0.11
Total spent	$0.95	$0.52
Spent with independent sellers	$0.74	$0.23
Spent with our control seller	$0.21	$0.29
USDC per correct answer	$0.0183	$0.0153

The memory buyer checked 32 of the 57 answers it received and took the rest on trust. The numbers above come from a separate audit that graded every delivered answer in both arms.

Memory caught the fault in round 6, the first round of the window, because a spot check happened to be due. That was partly timing: at that trust level checks came every third purchase, so it could have taken up to two rounds, and the zero depends on it. A fault starting a round or two earlier would have meant 1 to 3 wrong answers accepted. Trust in the control seller fell from 0.79 to 0.53, below the floor. The agent moved market data to PipTradeDex, an independent seller it had already tested, and swap quotes followed without a new check, because quotes are trusted through the same seller's market record. The blind buyer kept paying for answers 7% off, and in round 12 it was charged twice for nothing.

When the schedule turned honest, the agent retested the control seller after its cooldown. It passed every canary from round 15. For market prices it cleared the trust floor in round 18 and won quotes back that same round. For address facts it ended just below the floor. A seller can recover, but it has to earn it.

Memory was not cheaper, and we said it would be. Our prediction, committed before the run, was that memory would cost less per correct answer. It cost about 20% more per correct answer, and 83% more in total. It pays for canaries, and once the cheap seller is out it pays a dearer honest one. For that money it got 18 more correct answers and accepted none wrong. Ten of those 52 were second answers from canaries, so on distinct questions it got 42 of 45 right against 34 of 45, and it was 48% dearer per question. For an agent that acts on what it buys, that may be the better trade, but it is a trade.

Every number is on the proof page, where you can drag through the run round by round. Every payment in the experiment links to Suiscan, and every memory links to its blob.

What went wrong

The parts we would want to read in someone else's write-up:

We nearly accused a seller falsely. Our first grader compared a seller's balances with a chain read taken before and after the purchase, and flagged an independent seller as wrong, twice. It was right. The wallet was a busy bot spending gas during the call, and the seller's figure sat exactly between our two reads. Now an answer is correct if it lies inside that range, and canaries prefer wallets that are holding still. Anything that grades other people needs that kind of humility built in.

It probably happened again, more quietly. During the experiment the same seller's answer was 0.0008% off the chain, most likely on another moving wallet, though we did not record enough to prove it. The preregistered rule counted it as wrong, so we left it in the results. It cost something real: the agent benched what we believe was an honest seller and refused to buy address facts for two rounds. A gap under 1% is now inconclusive and costs a seller nothing, while our control seller's 7% is still plainly wrong.

And a third time. A live round after the experiment marked an independent seller and our own control seller wrong in the same round. Two sellers failing together pointed at us. The wallets held 99 and 105 coin types, and both sellers list only the first 50. An incomplete list is not a wrong answer, so now a page-sized list is judged only on what it lists. We cannot rule out this cause for two earlier audit failures, because we had not yet started recording the wallet.

We stopped our own experiment. A separate security review landed four minutes into the first attempt. It found that a demoted seller could drop out of memory recall within a few rounds, because busy sellers pushed its record out of a shared namespace. The agent would have forgotten exactly the sellers it was avoiding. It also found that a seller could erase its own failed check with a crafted answer, and that one check claimed a probe we had never actually run. We stopped, fixed all of it, published a new schedule, and said so in the experiment file.

The gasless tier seems to have a floor. A transfer of 0.005 USDC failed with InsufficientGas, while 0.01 USDC settles. That is why our control seller costs a cent.

Tatum needs native gRPC. SuiGrpcClient's default gRPC-web transport got application/grpc back from the gateway, so the client needs a GrpcTransport from @protobuf-ts/grpc-transport. Once connected it was solid, though the free plan's 3 requests per second means real backoff.

Limits

This is one run with a small sample, and the fault is synthetic. Only a few independent sellers can be graded against the chain. It shows the mechanism working on live mainnet, not numbers that generalize.

Live rounds ended on 2026-11-01, after one further round beyond the experiment (round 19). The grader fixes made after the experiment have unit tests but no live proof: the 1% rule was active in round 19 and nothing triggered it, and the page-size fix has never run in a live round. So the agent's last beliefs still carry that round's two false verdicts.

Try it

• Proof page
• Source (MIT)
• Control seller

The README starts with "do X, see Y" steps that need no keys.

Built for Total Recall, the Tatum x Walrus Memory hackathon.