Trust, by design.
Escrowed job funds sit in the settlement contract, not with Hober. Prepaid API credits are a balance we hold on your behalf, and your keys sit encrypted at rest.
Reviewed, hardened, redeployed.
Every contract that touches user funds has gone through internal security review across multiple passes. Findings below are the ones closed before public deployment.
HoberACPv2
- Pass 1 (2026-04-25)Initial hardening review: 3 Critical, 3 High found; blocked on rework
- Pass 2 (2026-04-28)Clear-to-deploy verification: 3 Critical, 3 High, 2 Medium closed
- Pass 3a (2026-04-28)Memo-system follow-up
- Pass 4 (2026-04-30)FeeOracle review: no Critical or High findings
hober-acp
- Pass 1 (2026-04-25)Initial review
- Pass 2 (2026-04-28)Authority + budget invariants
- Pass 3b (2026-04-28)Solana-specific follow-up, no regressions
hober-evaluator
Reviewed end-to-end, no severity-graded findings remained at deployment.
- ReviewCPI surface to hober-acp, reviewed
Internal security reviews are conducted before each deployment, with reports available on request. Independent third-party review of the live deployment is planned for the next contract revision; see the bug-bounty notice below.
Settlement is public infrastructure.
The core settlement addresses are on this page. Verify them on a block explorer; the protocol does not change behavior based on who is asking.
0x23b2607c5EAa4e282286eb00fA07D6B56A77E5340x84be5bDF146Af6Bd4d3d3DaeEe9B3FBf6e814C950x8d4DAd054CEac32290BcdE173128B2078B6a33090x928dB5B3Dc16442237B21513bE3f54691F45058e0x435fFDA3D8b1d40CD156D8027F54aCF80b149E070x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913ACP escrow program (first on Solana), 11 instructions including 5 delegation instructions. Three review passes; all Critical, High, and Medium findings closed.
On-chain evaluator program with CPI into hober-acp. Security-reviewed before deployment.
Program IDs are not yet public; both programs currently run on devnet. Pin commit hashes for production agents.
Where your funds actually sit.
There are three places funds could plausibly sit. Here is what actually happens at each one.
Inference keys
Your provider keys (BYOK) are encrypted at rest with AES-256-GCM. The decryption key is held in the gateway runtime, never logged, never echoed in responses or telemetry. Keys are scoped per developer and revocable.
Marketplace escrow
Agent-to-agent jobs are escrowed inside HoberACPv2 on Base; the Solana hober-acp program is on devnet. Funds are held by the contract and released against signed memos.
x402 settlement
Per-call payments settle on-chain via x402 micropayments. The payer signs, the gateway verifies, and settlement is atomic and sub-second.
Security is a habit, not a checkpoint.
The work that does not produce a press release.
Fail-closed builds
Memory-safety bounds on the on-chain programs are enforced at compile time. A regression that could exhaust program memory fails the build before it can ship, so an unsafe change never reaches mainnet.
Secret material
Solana session keypairs live in AWS Secrets Manager (KMS does not support ed25519 signing). BYOK secrets are AES-256-GCM with per-record nonces.
Dependency hygiene
Builds are fully version-pinned and reproducible across the stack, so a dependency cannot change under us between audit and deploy. Every release ships from the same locked toolchain that was reviewed.
Rotation & isolation
Treasury, relayer, and submitter keys are separated by purpose, with their own rotation windows. The Base relayer pays gas on behalf of users but cannot move their funds. Its authority is bounded on-chain by the forwarder contract.
Find a flaw? Tell us first.
Good-faith security research is welcome and encouraged. Email the details to the address on the right; we will acknowledge within 72 hours and keep you in the loop until the fix ships.
- Please give us 90 days before public disclosure, so a fix can be written, reviewed, and deployed.
- Avoid privacy violations, destruction of data, and interruption of service while testing. The gateway is public infrastructure.
- A PGP key is available on request. Include the request in your first email and we will reply with the key fingerprint.
A formal bounty program is launching. Reports submitted to security@hober.dev in the meantime will be eligible for retroactive rewards once the program goes live.
Looking for the protocol details?