Pact Network

Abstract

AI agents are paying for API calls autonomously via x402. When those APIs fail, the payment settles instantly and irreversibly — there's no refund. Pact Network is an automatic refund layer on top of x402 that gives agents their money back when APIs violate measurable SLA thresholds. We launched mainnet v1 on 2026-05-07; it's running in private beta. Today, Pact operates the coverage pool itself from treasury (a Phase 1 capital model). The refund rate for each API is a market-derived reliability score — no governance token, no committee, no reputation system. A future Phase 2 capital model opens the pool to third-party underwriter capital.

Pact Network is the underlying protocol — the on-chain program, the settlement authority, and the classifier. Pact Market (market.pactnetwork.io) is one curated interface on top of it: a wrapped-provider proxy over curated endpoints, available by request. It's the v1 surface, not the only surface. An SDK, an x402 facilitator, and BYO-provider integrations all plug into the same on-chain program.

1. The Problem

x402 is the HTTP-native payment protocol backed by Coinbase, Cloudflare, Google, Visa, AWS, Circle, Anthropic, and Vercel. It allows AI agents to pay for API calls with a single HTTP header. As of April 2026, there are 75M+ cumulative x402 transactions and 15M daily on-chain agent payments on Solana alone.

The problem: x402 has zero buyer protection. When an agent sends payment and the API returns an error, times out, or serves corrupted data, the money is gone. There is no chargeback, no dispute process, no refund mechanism. In human commerce, Visa and Mastercard protect buyers. In the agent economy, nobody does.

This isn't theoretical. On April 1, 2026, Drift Protocol was exploited for $285M. Every agent that paid for a Drift API call during the attack received compromised data and had zero recourse. In October 2025, a major AWS outage took down thousands of API endpoints globally. Every agent making x402 payments to AWS-hosted APIs during that window paid for calls that timed out or returned 500 errors. Zero refunds.

The agent economy needs buyer protection infrastructure. Not a customer support team. Not a dispute resolution process. Infrastructure that detects failures programmatically and pays refunds automatically.

2. Pact Network

Pact is an automatic refund protocol built on Solana. It wraps x402 API calls with SLA monitoring and automatic refund logic. Today it's a two-sided market; a future Phase 2 introduces a third side (third-party underwriters):

3. Protocol Mechanics

3.1 Premium Pricing

Premiums are calculated as a percentage of the API call cost, dynamically adjusted based on the API's observed failure rate.

Formula: Premium = CallCost × BaseRate × ReliabilityMultiplier × CoverageTier

In the target model, rates recalculate every 10,000 calls or 24 hours, and a smoothing function (0.7 × previous rate + 0.3 × new rate) prevents wild swings from temporary outages.

3.2 Parametric Triggers

Claims fire automatically based on measurable conditions. No human review.

Settlement is batched by design. The off-chain settler classifies calls in real time and submits a settle_batch transaction on a cadence. Refunds land in the agent's USDC ATA when that batch confirms — typically within seconds, not same-slot.

3.3 Coverage Tiers

3.4 Pool Economics

Coverage pools are per-API. In Phase 1 (today), Pact seeds every pool from treasury. In Phase 2, underwriters will choose which APIs to back. Pool size is capped at 20× monthly premium volume to keep utilization healthy and — in Phase 2 — yields competitive.

Premiums are split per endpoint via configurable FeeRecipient entries (Treasury + Affiliates). Today, Pact tunes those splits per endpoint to target a 45-55% loss ratio; the rest accrues to the pool. In Phase 2, the unspent remainder becomes underwriter yield.

Per-event aggregate cap: maximum payout per correlated event is 30% of pool capital. This protects against catastrophic correlated failures like cloud provider outages.

3.5 Refund Mechanics — chargebacks, not policy-style coverage

On a failed call, the agent gets back principal + premium. Pact eats the premium too. We only earn on calls that succeed. On failed calls, our net revenue is $0.000.

That's the difference between Pact and traditional API coverage products: a policy-style product keeps the premium when a claim pays out. We don't. If the call doesn't deliver, you owe us nothing. That's what makes this chargebacks-for-x402, not premium-and-claim coverage.

4. The Refund Rate as Quality Score

The refund rate is the most honest reliability signal in the ecosystem. If it costs 0.12% to cover calls to one provider and 7.8% to cover calls to an unknown API, that price spread tells you everything. No reputation token. No committee vote. Today, the spread reflects observed failure data Pact has paid refunds against with its own treasury — skin in the game. In Phase 2, it'll reflect underwriters putting third-party capital where they believe APIs will perform.

That's the flywheel: agents prefer lower-rate APIs because they're cheaper to cover. Traffic goes to reliable providers. Reliable providers attract more capital (Pact treasury today, external underwriters later), further lowering their rates. Unreliable providers see rates rise, lose agent traffic, and either improve or get priced out. The market self-corrects through refund pricing.

5. Anti-Abuse Mechanisms

Automatic refund protocols are vulnerable to moral hazard and claim farming. Pact implements layered defenses:

• •Circuit breaker: When an API's error rate exceeds 50% in a 5-minute window, new covered calls are halted. Prevents pile-on during known outages.
• •Volume caps: Per-agent covered call volume capped at 2× trailing 7-day average per API.
• •Claim frequency limits: Maximum 10 claims per agent per API per hour. 50 per day.
• •Payment verification: Claims require proof of x402 payment settlement. No payment proof, no refund.
• •Auditable classifier: the classifier rules are public and versioned, every classification is logged in the indexer, and decentralization of this role is on the post-Phase-2 roadmap.

6. Risk Management

The top risks, scored by severity × likelihood:

7. Target Verticals

Not all API verticals are equally coverable. We're prioritizing by pain intensity, measurability, volume, and willingness to pay:

Launch sequence: RPC first (highest measurability, binary SLA), then price feeds (highest pain intensity), then DEX aggregators, then MCP tools.

8. Architecture (mainnet v1)

8.1 On-chain program

The protocol runs as a single Solana program written against Pinocchio (no Anchor in the hot path — we wanted tighter control over CU usage and account layouts).

8.2 Accounts

• •CoveragePool (160 B) — per-endpoint pool holding USDC backing refunds. (Phase 2: also tracks underwriter deposits and LP shares.)
• •EndpointConfig (544 B) — per-endpoint config: SLA thresholds, premium rate, classifier rules, fee recipients, circuit-breaker state.
• •CallRecord (112 B) — per-call record, written when the settler submits a batch.
• •SettlementAuthority (48 B) — authorizes the off-chain settler to submit batches.
• •Treasury (80 B) — protocol treasury account; receives the protocol fee cut.
• •ProtocolConfig (464 B) — global protocol config (e.g. max_total_fee_bps).

There is no per-agent PDA. The agent uses their own USDC ATA and grants SPL Token approval to the program; settlement debits and refunds happen against that ATA.

8.3 Instructions

Bootstrap (operator-only, run once)

• •initialize_protocol_config (disc 12)
• •initialize_settlement_authority (disc 1)
• •initialize_treasury (disc 13)

Endpoint lifecycle (operator)

• •register_endpoint (disc 2)
• •update_endpoint_config (disc 3)
• •pause_endpoint (disc 4)
• •top_up_coverage_pool (disc 9)
• •update_fee_recipients (disc 14)
• •pause_protocol (disc 15)

Settlement (settler-only)

• •settle_batch (disc 10) — the settler submits classified outcomes in batches up to MAX_BATCH_SIZE = 50. Successful calls debit the agent's premium; failed calls refund principal + premium directly to the agent's USDC ATA in the same instruction. No separate claim flow.

8.4 Settlement authority and the classifier

A single off-chain settlement authority (the "settler") signs settle_batch. Before it does, every call goes through a classifier that splits raw error outcomes into:

• •client_error — the agent's request was the problem (bad params, auth failure, missing key). No refund.
• •server_error — the provider failed (5xx, timeout, schema break). Triggers a refund.

That split is the load-bearing piece of trust in the system today. We keep the classifier rules public, version them, and log every classification decision in the indexer so the classifier itself is auditable. Decentralizing this is on the post-Phase-2 roadmap.

8.5 Off-chain stack

• •api — the agent-facing HTTP API. Hosts /health, registration, and the proxy that wraps x402 calls.
• •indexer — consumes program logs, materializes per-pool/per-agent stats, exposes /api/stats.
• •settler — runs the classifier and submits settle_batch on a cadence. Single signer for v1.
• •Pact Market (market.pactnetwork.io) — the curated wrapped-provider proxy over curated endpoints, available by request. One interface to the protocol.
• •Pact SDK / x402 facilitator / BYO-provider — alternative interfaces. They all settle through the same on-chain program.

9. Live infrastructure

What's actually deployed and reachable as of 2026-05-07:

Hosting: GCP, region asia-southeast1.

The settler is running but waiting on protocol bootstrap (initialize_protocol_config, initialize_settlement_authority, initialize_treasury from the operator's keypair) before it processes its first batch. That's a known pre-launch step, not a defect — once the program is initialized, the settler picks up batches automatically.

10. What's next

Near-term, in rough priority order:

11. Key Parameters