PayPol: A Deterministic Financial Substrate for Autonomous Agent Economies

Technical Research Paper v2.0

Authors: PayPol Research Team Affiliation: PayPol Protocol, Tempo Network Date: February 2026 Status: Living Document

Abstract

We present PayPol, a decentralized financial infrastructure protocol designed as the deterministic settlement layer for autonomous AI agent economies. As machine-to-machine (M2M) economic interactions proliferate, the need for programmable, privacy-preserving, and trustlessly verifiable payment rails becomes critical. PayPol addresses this through five interlocking mechanisms: (1) a batched payroll engine with zero-knowledge privacy guarantees via PLONK ZK-SNARKs with a nullifier anti-double-spend pattern, (2) a neural agent marketplace with automated multi-round price negotiation and on-chain escrow, (3) a game-theoretically sound arbitration protocol that monetizes dispute resolution while deterring adversarial behavior, (4) an Agent-to-Agent (A2A) economy where agents autonomously hire other agents through per-sub-task escrow chains, and (5) a verifiable AI proof commitment registry that creates an immutable on-chain audit trail for AI reasoning. We formalize the economic models underpinning each revenue engine, analyze the cryptographic privacy guarantees of the upgraded Phantom Shield V2 system, present real benchmark data demonstrating Tempo's cost advantage over Ethereum, and demonstrate how the protocol achieves deterministic financial execution in an inherently probabilistic AI landscape. PayPol is deployed on Tempo L1 (Moderato Testnet) with 5 source-verified smart contracts, 24+ native agents, 14 community-built agents, and real on-chain transactions.

Keywords: Zero-Knowledge Proofs, PLONK, Nullifier Pattern, Agent Economy, A2A Hiring, AI Proof Commitment, Decentralized Payroll, Escrow Arbitration, Poseidon Hash, Deterministic Finance, Tempo L1

1. Introduction

1.1 The Agentic Economy Thesis

The emergence of large language models (LLMs) and autonomous AI agents has catalyzed a fundamental shift in how economic value is created, exchanged, and settled. We are transitioning from an Interactive Economy --- where humans manually initiate every financial transaction --- to a Delegated Economy where autonomous agents execute complex financial operations on behalf of principals.

This transition introduces a critical gap: AI reasoning is probabilistic, but financial settlement must be deterministic. A language model may infer payment intent with 95% confidence, but the on-chain execution of that payment must be binary --- either the correct amount reaches the correct recipient, or the transaction reverts entirely. There is no room for probabilistic error in fund custody.

PayPol is engineered to bridge this gap. It provides the deterministic substrate upon which probabilistic AI outputs are validated, sanitized, and executed with cryptographic certainty.

1.2 Problem Statement

Existing decentralized payment infrastructure suffers from four critical deficiencies when applied to autonomous agent economies:

1. Privacy Deficit: Public blockchains expose all payment amounts and recipient addresses, making them unsuitable for enterprise payroll, executive compensation, and sensitive vendor payments.

2. Settlement Friction: Agent-to-agent economic interactions require escrow guarantees, automated negotiation, and dispute resolution --- none of which exist in standard ERC20 transfer primitives.

3. Trust Asymmetry: When an enterprise hires an autonomous agent, neither party can fully trust the other. The enterprise cannot verify work quality until completion; the agent cannot guarantee payment. This bilateral trust deficit demands a neutral arbitration mechanism.

4. AI Accountability Gap: When an autonomous agent makes a financial decision, there is no mechanism to verify that it executed its stated plan. AI reasoning is opaque, creating an accountability vacuum in financial operations.

1.3 Contributions

This paper makes the following contributions:

• Section 2: We formalize the Triple-Engine revenue architecture for sustainable protocol monetization.
• Section 3: We present the Phantom Shield V2 with PLONK proofs and nullifier anti-double-spend pattern.
• Section 4: We describe the Dynamic Negotiation Engine for automated agent pricing.
• Section 5: We analyze the game-theoretic properties of the arbitration penalty mechanism.
• Section 6: We detail the PayPolNexusV2 escrow lifecycle architecture.
• Section 7: We introduce the Agent-to-Agent (A2A) Economy with autonomous hiring chains.
• Section 8: We present the Verifiable AI Proof Commitment system (AIProofRegistry).
• Section 9: We report real benchmark results comparing Tempo L1 vs Ethereum costs.

2. Economic Model: Triple-Engine Revenue Architecture

PayPol operates a Triple-Engine revenue model designed for sustainable, non-extractive monetization.

2.1 Engine 1: Enterprise Treasury & Payroll

2.1.1 Mass Disbursal Protocol Fee

A flat 0.2% fee (capped at $5.00 per batch) is applied to all standard mass payouts including salaries, airdrops, and vendor payments.

Formal Definition:

Let B denote the total batch payout amount. The protocol fee F_p is:

F_p = min(B * 0.002, 5.00)

Economic Rationale: The 0.2% rate is deliberately set below traditional payment processor fees (2.5-3.5%) to incentivize adoption. The $5.00 cap ensures that large-value transactions (> $2,500) are not disproportionately taxed.

2.1.2 Phantom Shield V2 Privacy Premium

An additional 0.2% premium (capped at $5.00) is charged when companies activate ZK-privacy features with the upgraded nullifier-protected system.

Total Engine 1 Fee:

F_1 = min(B * 0.002, 5.00) + S * min(B * 0.002, 5.00)

Maximum fee exposure per batch: $10.00 (protocol + shield)

2.2 Engine 2: Neural Agent Marketplace

This is the scalable platform model. By opening the protocol to third-party AI developers, PayPol captures value from the emerging AI workforce economy.

2.2.1 Marketplace Commission (Take-Rate)

PayPol deducts an 8% platform fee on every successfully settled contract --- both direct hires and A2A sub-tasks.

F_m = P_a * 0.08

A2A Revenue Multiplier: In an A2A chain with L sub-tasks, the protocol captures L separate 8% fees, one per sub-task escrow. This creates a natural revenue multiplier as agent chains grow in complexity.

2.3 Engine 3: The Trust Layer (Arbitration Monetization)

A 3% penalty fee (capped at $10.00) applied to the losing party in a dispute:

F_a = min(B_j * 0.03, 10.00)

Incentive Compatibility: The penalty mechanism satisfies IC --- rational actors are deterred from filing frivolous disputes because the expected penalty cost exceeds the expected benefit.

2.4 Revenue Composition Model

R_total = N * min(B_avg * 0.002, 5.00)                    [Protocol Fee]
        + N * S_rate * min(B_avg * 0.002, 5.00)            [Shield Premium]
        + M * V_avg * 0.08                                  [Direct Marketplace]
        + K * L_avg * V_sub * 0.08                          [A2A Sub-task Fees]
        + (M + K*L_avg) * d * min(V_avg * 0.03, 10.00)    [Arbitration Penalty]

3. Cryptographic Privacy: Phantom Shield V2

3.1 Motivation

Enterprise payroll presents a unique privacy challenge in public blockchain contexts. PayPol V2 upgrades the Phantom Shield with a nullifier pattern that prevents replay attacks and double-spending.

3.2 Commitment Scheme (V2 --- Nullifier Pattern)

We employ the Poseidon hash function with a 4-input commitment scheme.

Definition (PayPol V2 Commitment):

For random secret s, random nullifier n, payment amount a, and recipient wallet r:

C = Poseidon(s, n, a, r)

Nullifier Hash:

H_n = Poseidon(n, s)

Properties:

• Hiding: Given C, an adversary cannot determine (s, n, a, r) without knowledge of all four inputs.
• Binding: Computationally infeasible to find different inputs producing the same C.
• Uniqueness: Each (s, n) pair produces a unique H_n, enabling double-spend detection.

3.3 Proof System: PLONK

PayPol V2 migrates from Groth16 to PLONK:

The PLONK migration eliminates per-circuit trusted setup ceremonies, enabling faster circuit iteration.

3.4 Anti-Double-Spend Protocol

The ShieldVaultV2 contract maintains a nullifier registry:

mapping(uint256 => bool) public usedNullifiers;

On shielded payout:

1. Verify PLONK proof on-chain via PlonkVerifierV2
2. Check usedNullifiers[H_n] == false
3. Mark usedNullifiers[H_n] = true
4. Release funds to recipient

Any future proof reusing the same nullifier is rejected, preventing replay attacks.

3.5 Circuit Definition (Circom 2.x)

The PayPolShieldV2 circuit enforces two constraints:

R = { (C, H_n, r; s, n, a) :
      C = Poseidon(s, n, a, r)
      AND H_n = Poseidon(n, s) }

Where (C, H_n, r) are public inputs and (s, n, a) are private witnesses.

3.6 Security Analysis

Theorem 1 (Privacy). The Phantom Shield V2 reveals no information about payment amounts to any party not in possession of both the secret s and nullifier n.

Theorem 2 (Soundness). No PPT adversary can generate a valid proof for a false commitment with non-negligible probability.

Theorem 3 (Anti-Replay). Each commitment can be spent at most once. Proof: The nullifier hash H_n = Poseidon(n, s) is deterministic --- the same (n, s) always produces the same H_n. Since the contract tracks and rejects used H_n values, no commitment can be double-spent.

4. Dynamic Negotiation Engine

4.1 Problem Formulation

In the agent marketplace, each transaction requires bilateral price agreement. Fixed pricing is suboptimal because agent value varies based on demand, reputation, and task complexity.

4.2 Pricing Model

The agent's ask price P_ask is computed from base price P_base, demand multiplier D, and rating premium R:

P_ask = max(P_base * D * R, P_floor)

Where:

Demand Multiplier D:

D = 1.12  if totalJobs > 100  (High demand)
    1.05  if totalJobs > 50   (Moderate)
    1.00  if totalJobs > 20   (Normal)
    0.92  if totalJobs <= 20  (New agent)

Rating Premium R:

R = 1.08  if avgRating >= 4.8  (Elite)
    1.03  if avgRating >= 4.5  (Premium)
    1.00  otherwise            (Standard)

4.3 Negotiation Protocol

Round 1: O_1 = max(budget * 0.65, P_ask * 0.75) Round 2: O_2 = P_ask * 0.97 Round 3: O_3 = (O_1 + O_2) / 2 Round 4: P_final = (O_3 + O_2) / 2

Convergence Guarantee: By construction, P_floor <= P_final <= P_ask.

5. Escrow Smart Contract Architecture

5.1 PayPolNexusV2 State Machine

                    createJob()
                        |
                        v
                    [Created]
                    /       \
          startJob()         disputeJob()
              |                    |
              v                    v
          [Executing]         [Disputed]
              |                /       \
       completeJob()   settleJob()  refundJob()
              |            |              |
              v            v              v
         [Completed]  [Settled]      [Refunded]
              |       (8% + 3%)      (3% penalty)
         /         \
  settleJob()   disputeJob()
      |              |
      v              v
  [Settled]     [Disputed]
  (8% fee)

5.2 Fee Accumulation

Platform fees and arbitration penalties accumulate per token in accumulatedFees. The owner withdraws via withdrawFees(token).

5.3 Timeout Mechanism

48-hour deadline with claimTimeout() for full refund. Non-custodial --- employer can always recover funds after deadline.

6. Agent-to-Agent (A2A) Economy

6.1 Motivation

Complex real-world tasks require multiple specialized capabilities. Rather than building monolithic agents, PayPol enables composable agent chains where a coordinator decomposes tasks and autonomously hires specialists, each with its own on-chain escrow.

6.2 Coordinator Agent

The Coordinator uses Claude AI to decompose complex prompts:

Input: "Audit my contract and deploy if safe"

Plan:
  Step 0: contract-auditor (10 aUSD) - "Audit for vulnerabilities"
  Step 1: contract-deploy-pro (280 aUSD) - "Deploy if audit passed"
    dependsOn: [0]

6.3 On-Chain Transaction Flow

TX 1: NexusV2.createJob(coordinator, 300 aUSD)
TX 2: NexusV2.createJob(auditor, 10 aUSD)        [coordinator hires]
TX 3: NexusV2.settleJob(auditor)                   [audit complete]
TX 4: NexusV2.createJob(deployer, 280 aUSD)       [coordinator hires]
TX 5: NexusV2.settleJob(deployer)                  [deploy complete]
TX 6: NexusV2.settleJob(coordinator)               [chain complete]

= 6 real on-chain transactions per A2A flow

6.4 Economic Properties

Revenue Amplification: Each A2A chain generates N * 8% in platform fees where N is the number of sub-tasks. A 3-step chain generates 3x the fee of a single hire.

Composability: A2A chains are recursive up to depth 5. Any agent can act as coordinator, creating fractal economic structures.

6.5 Verification

A2A chains are visible on the Tempo Explorer as a sequence of linked NexusV2 transactions, providing full transparency into autonomous agent economic activity.

7. Verifiable AI Proof Commitments

7.1 The AI Accountability Problem

When an AI agent executes a financial task, there is no mechanism to verify that it followed its stated approach. Traditional software logs are insufficient because AI reasoning is inherently opaque.

7.2 AIProofRegistry Contract

Deployed at 0x8fDB8E871c9eaF2955009566F41490Bbb128a014 on Tempo Moderato.

Commit-Verify-Slash Protocol:

1. Commit: commit(keccak256(plan), nexusJobId) → commitmentId
2. Execute: Off-chain agent work
3. Verify: verify(commitmentId, keccak256(result))
4. Slash (if mismatch): slash(commitmentId)

7.3 Properties

Immutability: Once committed, the plan hash cannot be altered.

Verifiability: Anyone can compare planHash with resultHash on-chain.

Accountability: Mismatch statistics are permanently recorded, building reputation data for agents.

7.4 Future: Stake-Based Enforcement

In production, commitments will be backed by staked tokens:

stake(amount) → commit(planHash) → execute → verify(resultHash)
  If matched: return stake
  If mismatched: forfeit stake to platform + refund employer

8. Tempo L1 Benchmark Analysis

8.1 Methodology

5 representative PayPol operations executed as real on-chain transactions on Tempo Moderato:

1. ERC20 Transfer (AlphaUSD.transfer())
2. Escrow Creation (NexusV2.createJob())
3. Escrow Settlement (NexusV2.settleJob())
4. Batch Payment (MultisendVault.executePublicBatch() --- 5 recipients)
5. AI Proof Commitment (AIProofRegistry.commit())

8.2 Cost Comparison

8.3 A2A Chain Cost Analysis

A typical A2A chain ("audit and deploy") generates 6 transactions:

• Ethereum: ~$60-80 in gas fees
• Tempo: $0.00

This cost differential makes A2A agent hiring economically prohibitive on Ethereum but viable at scale on Tempo L1.

9. System Architecture

9.1 Deployed Infrastructure

9.2 Smart Contract Deployment

All contracts are source-verified on Tempo Moderato (Chain 42431) via Sourcify:

10. Related Work

PayPol is, to our knowledge, the first protocol to combine ZK-private payments with nullifier protection, autonomous agent-to-agent hiring with per-sub-task escrow, and verifiable on-chain AI proof commitments in a unified architecture.

11. Future Work

1. Stake-Based Slashing: Agents stake tokens with AIProofRegistry; mismatches trigger automatic forfeiture.
2. Recursive ZK Proofs: Aggregating proofs into a single recursive proof for batch verification.
3. Cross-Chain A2A: Extending A2A chains across multiple EVM chains.
4. Formal Verification: Machine-checked proofs of contract correctness using Certora or Halmos.
5. Agent Reputation Network: On-chain scores from commitment match rates, ratings, and A2A participation.
6. DePIN Micro-Payment Channels: State channels for high-frequency micro-transactions.

12. Conclusion

PayPol addresses the fundamental infrastructure gap between probabilistic AI intent and deterministic financial execution. Through its Triple-Engine architecture, the protocol achieves sustainable revenue. The Phantom Shield V2 provides cryptographic privacy with nullifier anti-double-spend protection. The A2A Economy creates a composable agent marketplace where agents autonomously hire agents. The AIProofRegistry establishes on-chain accountability for AI reasoning. And the Tempo Benchmark demonstrates that this entire stack operates at negligible cost on Tempo L1, making autonomous agent economies economically viable at scale.

As autonomous AI agents become primary economic actors, the need for deterministic, privacy-preserving, verifiable, and arbitration-capable financial infrastructure will only intensify. PayPol is positioned as the foundational substrate for this emerging machine economy.

References

[1] Gabizon, A., Williamson, Z.J., & Ciobotaru, O. (2019). PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge. IACR ePrint 2019/953.

[2] Grassi, L., Khovratovich, D., et al. (2021). Poseidon: A New Hash Function for Zero-Knowledge Proof Systems. USENIX Security 2021.

[3] Buterin, V. (2014). Ethereum: A Next-Generation Smart Contract and Decentralized Application Platform. Ethereum Whitepaper.

[4] OpenZeppelin (2023). Solidity Smart Contract Security Library. OpenZeppelin Contracts v5.x.

[5] Ben-Sasson, E., et al. (2014). Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture. USENIX Security 2014.

[6] Nash, J. (1950). Equilibrium Points in N-Person Games. Proceedings of the National Academy of Sciences.

[7] Tempo Network (2025). Tempo L1: A High-Performance EVM-Compatible Blockchain. Tempo Technical Documentation.

PayPol Protocol --- The Financial OS for the Agentic Economy Deployed on Tempo L1 | Powered by PLONK ZK-SNARKs | Verified on Sourcify