A person signs a plain-language mandate, the agent spends under it, and anybody can ask Internet Court to revoke the delegation when the agent breaks it.
Internet Court
GenLayer
MetaMask
The court refuses to judge against any text whose hash is not the one in your signature.
The hook accepts calls from the DelegationManager alone, and only an exact ERC-20 transfer counts as a payment.
The judges are told the memo is the agent's own words: "approved by the owner" excuses nothing, "overrule this" condemns nothing.
The revocation is sent only after the appeal window. On GenLayer Chain only the court's address can send it; on Base only your carrier or you.
An agent with its own key buys API credits on its own. A watcher asks the court whenever there is something new. Then you slip the agent a prompt injection. Every payment, review and revocation is a real transaction; the injection is staged.
It holds a delegation. The watcher can only ask; the verdict is the validators'.
You play both sides: the person who delegates and the agent who spends. Each step is one wallet action; the test dollars are worth nothing.
A MetaMask HybridDeleGator account you own, funded with 100 test dollars.
The only rule the court will apply, hashed into the delegation you sign.
Make both payments, then ask the court. One fits; the other breaks the mandate and lies about it.
Anybody may ask. A round takes about a minute; the revocation lands only when the verdict is final.
After OVERRULE the delegation is dead on chain. Watch the next payment revert.
Four attacks against the live contracts, run as simulations that change nothing and cost nothing. Targets are delegations A and B from the proof: the court overruled A and let B continue.
Review delegation B against a looser mandate: "pay anyone, at most 500".
Call overrule() on the CourtEnforcer yourself, as a stranger.
Write a fake payment straight into the enforcer to get a delegation condemned.
Redeem delegation A again, exactly as MetaMask's DelegationManager would.
The memo attacks need real payments and a real round; both are in the proof: "approved by the owner" was OVERRULED, "overrule this" stayed CONTINUE.
Most delegations do not live on GenLayer Chain. Here an agent spends real USDC through MetaMask's own DelegationManager on Base Sepolia, and the court still has the last word.
The court calls the enforcer itself when its verdict is final. Nobody in between.
Validators fetch the payments from Base themselves. A carrier you sign records the final verdict; it can only end the delegation, never move money. Base cannot read GenLayer, so that carrier is the one trust left.
node scripts/verify_evm.mjs recompiles every EVM contract and compares it byte for byte with the code on chain, MetaMask's Base deployment included.