Tabtab.xyz
CREDIT RAIL FOR AUTONOMOUS AGENTS · HEDERA

Agents shouldn’t need a wallet to do business.

Tab is a running balance for autonomous agents. It goes negative when the agent spends, positive when it earns, and settles once per window in a single transfer. The agent never holds USDC and never signs a payment.

Read the docsOpen the app
ZERO SMART CONTRACTS·4 NATIVE HEDERA SERVICES·x402 ON BOTH LEGS

x402 solved how an agent pays. Nobody solved when.

An agent pays for inference, data and APIs before anyone has paid it. Its balance is structurally behind its earning capacity, and the only fix on offer is to fund a wallet first.

01

Cold start

A freshly deployed agent cannot transact at all until a human funds it. Its first act is to fail.

02

Job rejection

The agent declines profitable work because it can’t fund the input cost right now.

03

Human bottleneck

An operator tops up the wallet by hand — which defeats the point of autonomy.

04

Hot float

The operator over-funds "just in case," leaving a large balance in a key an agent controls.

The mechanism · three flows

A gateway on both legs of the agent’s economic life.

Spend leg · agent → gateway → seller
agentno walletgatewaypays from floatdebits the tabsellerplain x402402 → paidTAB BALANCE−0.4821
payergatewayfronts endpointcredits the tabagentendpointATTESTED RECEIPTTAB BALANCE+0.0250
43 CALLS1 TRANSFERnet −0.2160scheduled tx · consensus tickCLEAN · ramp 30% → 45%
State 1 · spend leg

The gateway pays the seller before the agent has any money.

A spend request arrives. The gateway checks six things against cache, writes a hold, pays the seller from house float, and debits the running balance.

The seller sees an ordinary x402 customer. It does not know Tab exists. Nothing on the seller side changes.

The ceiling is arithmetic, not a credit committee.

ceiling =
trailing_attested_revenue_per_window
×tier_multipleA 3.0 · B 2.0 · C 1.0 · Unrated 0
×ramp_factorstarts 15%, +15% clean, −30% missed
,clamped by hard_cap[tier]
Drive it yourself
trailing revenue0.3340 USDC
tierC · 1.0×
ramp30%
Ceiling in force · USDC
1.0000
starter floor 1.0000 — binding
Fast path · every spend · under 50ms · cache only
  1. tab exists and is not frozen
  2. amount ≤ per-call cap
  3. window spend + amount ≤ window cap
  4. outstanding + holds + amount ≤ ceiling
  5. counterparty weight > 0
  6. write hold, then call
Slow path · background
Mirror Node→graph→score→ceiling
writes cache
never calls Mirror Node
We broke it on purpose

The agent bought from a seller it controls.

ZEROCEILING 1.0000
agent 0.0.4482091→0.0.5300118→seller 0.0.5591204
CONTROL_CLUSTER · funding ancestry ≤ 3 hops

Spend of $0.0400 to 0.0.5591204 refused. The agent funded this seller two hops back, so the purchase would be self-dealing and the revenue would not be real.

1755738201.446920113seq 41 894float untouched
REFUSED

The graph caught a seller the agent controls. The ceiling collapsed mid-window and the next spend was refused. The float was never touched.

What still gets through

Publishing the gaps is what makes the caught attacks credible.

Non-reciprocal collusion ringsOPEN

A ring where value never flows back and funding roots are genuinely separate defeats the graph.

Gateway operator misbehaviourOPEN BY DESIGN

The float is custodial. Detectable via published receipts; not preventable in v1.

Seller takes payment, no deliveryOPEN

v1 records the dispute and does not arbitrate.

Why Hedera, in four numbers.

$0.0001
HCS is a clearing ledger you don’t have to write

Append-only, consensus-ordered, per message. This is why Tab ships with zero smart contracts.

< $0.01
Sub-cent USD-denominated fees

Per-request payouts become a product rather than arithmetic that loses money.

3s
Finality matches the settlement tick

Window close to settled transfer inside one agent reasoning cycle.

HIP-423
Scheduled Transactions execute the tick

By consensus, with no keeper process to run, fund or trust.

No Solidity.Contracts replaced by native primitives.
Would normally be a contractReplaced by
Credit registry contractHCS topic — ceiling messages, consensus-ordered
Receipt storage contractHCS topic — one message per leg
Settlement executor contractScheduled Transaction (HIP-423)
Treasury / vault contractPlain Hedera account holding the float
Access control contractAccount keys and topic submit keys
ATTACK SURFACE REMOVED:reentrancydelegatecallproxy storage collisionupgrade keyliquidation MEV
…214.883104227DEBIT0.0.5591204−0.0400attested…211.117640882CREDIT0.0.4410877+0.0250attested…208.402911005DEBIT0.0.5120033−0.0180attested…205.771002944CREDIT0.0.4410877+0.0250attested…201.446920113REFUSED0.0.55912040.0400control_cluster…197.905331276DEBIT0.0.5120033−0.0180attested…193.220884610CREDIT0.0.6002911+0.0120unattested…188.664201773DEBIT0.0.4899120−0.0090attested…214.883104227DEBIT0.0.5591204−0.0400attested…211.117640882CREDIT0.0.4410877+0.0250attested…208.402911005DEBIT0.0.5120033−0.0180attested…205.771002944CREDIT0.0.4410877+0.0250attested…201.446920113REFUSED0.0.55912040.0400control_cluster…197.905331276DEBIT0.0.5120033−0.0180attested…193.220884610CREDIT0.0.6002911+0.0120unattested…188.664201773DEBIT0.0.4899120−0.0090attested

Five verbs is the whole agent surface.

spendquotebalanceceilingreceipts
install
npm i @tab/sdk

Ships as a Hedera Agent Kit v4 plugin, an MCP server, a TypeScript SDK, and a CLI.

What we deliberately did not build

  • —no smart contracts
  • —no seller-side credential
  • —no cross-chain messaging
  • —no price oracles
  • —no LP vaults
  • —no agent deployment platform
reporeceipt topic …ceiling topic …settlement topic …Built for ETHOnline 2026 · Hedera Testnet · No Solidity was deployed at any point.