Shade

An autonomous trading agent buys data per call (the x402 "HTTP 402 → pay → read" pattern). With bare on-chain payments, every purchase is a footprint: a competitor indexing the chain reconstructs which oracles it queries, how often, its remaining budget, and the wallet that funds it — its entire strategy, for free.

Shade runs the same agent over two rails and makes the difference visible:

• Transparent rail — pay-per-call settles on-chain via Circle Gateway (x402). A "spy" indexer rebuilds funder, oracles, budget and strategy. • Private rail (Unlink) — the agent pays each oracle through Unlink private accounts; funding and spending are decoupled inside a privacy pool. The spy sees only noise.

The split-screen demo at /spy makes the contrast literal: press Run agent live, watch real transactions stream — the left panel reconstructs everything, the right stays dark. Tx hashes link to ArcScan, and a public withdrawal proves value moved without ever revealing who paid whom.

What stays hidden: the agent's funding source, which data it buys, how much, how often, and the strategy those payments imply. Built for the Dynamic × Unlink × Circle private-nanopayments track, on Arc Testnet (USDC).

Shade is a Next.js (App Router) + TypeScript app, stateless (no database), running on Arc Testnet where gas is paid in USDC.

Dynamic handles wallet creation and onboarding — an embedded-wallet, no-seed-phrase flow. The connected wallet signs one canonical message, and that signature deterministically derives the agent's private Unlink identity (fromEthereumSignature): so 1 wallet = 1 bot, with no account database. Dynamic also signs the on-chain deposit/withdraw, while per-call private payments need no popup — the derived Unlink account signs them off-chain.

Unlink (@unlink-xyz/sdk) derives a shielded account, deposits the budget into the privacy pool, and routes each oracle payment as a private transfer — amounts, balances and counterparties stay confidential. A real private transfer runs on every demo, and a real withdrawal serves as trustless proof: each oracle cashes out to a public address, verifiable on ArcScan, without exposing the payer. A stateless wallet-signature proof (ShadeSig, two signatures: identity + freshness) lets any self-custody user run an external bot with Unlink tokens scoped to its own address — the admin key never leaves the server (bring-your-own-bot, no admin key).

Circle + Arc settle the transparent rail: each call returns HTTP 402, the agent signs an EIP-3009 authorization, and @circle-fin/x402-batching (BatchFacilitatorClient) verifies and settles it gaslessly in batches — real sub-cent settlement, not one large transfer.

Hacky bit worth mentioning: deriving the entire private identity from a single wallet signature means there's no user database at all — the whole per-user auth model is stateless and deploys to Vercel as-is. Tested with 65 unit tests (vitest). Stack: viem · @dynamic-labs/* · @unlink-xyz/sdk · @circle-fin/x402-batching.