Documentation
A 72-hour build for EasyA Consensus Miami 2026. Below: the architecture, the design choices that surprised us, and the four on-chain proofs.
TL;DR
PayPhone is per-second video billing on Base. A buyer-side AI agent authorizes “up to $5” via x402’s upto scheme; when the call ends, on-chain settlement transfers only the actual amount used in one Permit2 USDC transfer. Built for EasyA Consensus Miami 2026 — Agentic Track, Coinbase + AWS sponsored.
Architecture
The settlement amount is floor(duration_sec) × $0.01, capped at the signed maximum. The unspent allowance simply expires on-chain — no refund path, no leftover state.
Why these choices
The `exact` scheme requires the buyer to know the price in advance. We don’t — duration is whatever the call ends up being. With `upto`, the buyer signs a "I’ll spend at most $5" witness; the proxy contract enforces `amount <= permitted.amount` on-chain via `AmountExceedsPermitted`. Unspent allowance never moves; the chain doesn’t care that we asked for less than we authorized.
CDP’s `paymentMiddleware` / `withX402` settles at request-time. We need to defer settlement until the call hangs up — that’s the entire pitch. Hand-rolling the 402 → verify → settle dance lets `verify` run when the buyer signs (synchronous, fail-fast on bad payment) but `settle` run from the Daily.co `meeting.ended` webhook (asynchronous, with the actual duration in hand).
Two USDC schemes are available on EVM: EIP-3009 (`transferWithAuthorization`) and Permit2 (`signatureTransfer`). EIP-3009 is fixed-amount: signing for $5 means $5 moves, period. Permit2 supports underspend: the witness says "up to $5," the actual transfer can be any value $0 ≤ x ≤ $5. There is no other primitive on EVM that lets a single signature authorize a range and the chain enforce the cap.
The buyer-side agent signs without holding ETH. CDP’s facilitator declares `eip2612GasSponsoring` + `erc20ApprovalGasSponsoring` extensions in the 402 challenge; the buyer signs an EIP-2612 permit + the Permit2 witness, and the facilitator combines them into a single sponsored transaction. The buyer wallet stays gas-free. This is what makes "no-wallet AI agents" work for the consumer side — they show up with an api key, not a funded EOA.
On-chain proofs
Hand-rolled 402 → verify → settle with the `exact` scheme. Single $0.10 USDC transfer.
Asymmetric verify/settle: signed up to $5, settled $0.30 — proxy enforces the cap on-chain.
Real video room, meeting.ended webhook drives settle for floor(duration_sec) × $0.01.
Mock-auth login, expert cards, in-call billing ticker, streamed Haiku summary, follow-up chat over the transcript.
Tech stack
| Group | Package | Version |
|---|---|---|
| Runtime | Next.js | 16.2.4 |
| React | 19.2.4 | |
| TypeScript | 5.x | |
| Tailwind CSS | 4.x | |
| Payments | @coinbase/cdp-sdk | 1.48.2 |
| @coinbase/x402 | 2.1.0 | |
| @x402/core | 2.11.0 | |
| @x402/evm | 2.9.0 | |
| viem | 2.48.8 | |
| Video | @daily-co/daily-js | 0.89.1 |
| Cloud | @aws-sdk/client-dynamodb | 3.1043.x |
| AI | @anthropic-ai/sdk | 0.94.0 |
| ai (Vercel AI SDK) | 6.0.x | |
| UI | motion | 12.38.0 |
| lucide-react | 1.14.0 | |
| shadcn/ui CLI | 4.7.0 |
Mitigations
CDP mainnet `/settle` returns "unable to estimate gas" ~40% of the time. We wrap settle in retry-with-backoff (3 attempts: 2s, 5s, 10s) in `lib/x402.ts:settleWithRetry`. Pre-warming the buyer wallet with a tiny dry-run before stage cuts the rate further.
A buyer’s first `upto` payment requires `approve(Permit2, max_uint256)` on USDC. We declare `erc20ApprovalGasSponsoring` in `PaymentRequirements.extensions`, so the facilitator pays the gas for the approval. Done once per wallet during dress rehearsal #1; subsequent calls skip it.
USDC’s `name()` differs by network: `"USD Coin"` on mainnet, `"USDC"` on Sepolia. Hardcoding the wrong value silently produces a signature the facilitator’s on-chain `staticcall` rejects with revert. `lib/constants.ts:USDC_DOMAIN` is keyed by network, derived empirically from `probe-usdc.ts`.
Daily’s webhook retries on non-2xx (3 attempts before circuit-open). `lib/db.ts:markSessionCompleted` is conditional on `status = AUTHORIZED`; the second call fails with `ConditionalCheckFailedException`, which the route catches and returns 200 to stop further retries. The Permit2 nonce inside the witness is consumed on first settle and prevents a duplicate transfer at the contract level too.
No cloud recording (billable, no free tier). No live streaming, no telephony. Rooms set `exp = now + 30 min` and `eject_at_room_exp: true`; transcription stops when the last participant leaves. Webhook signatures are HMAC-SHA256 verified against `DAILY_WEBHOOK_SECRET` using `crypto.timingSafeEqual`.
Every line is on GitHub. The README walks through running it locally with seeded credentials and a Sepolia faucet drip.
Buyer wallets are seeded testnet keys. Don’t paste a real private key into a hackathon demo. Ever.