Caplane
MetaMask Delegation Toolkit 0.13.0EIP-7702 Smart Accounts

Agents redelegate capability budgets. The redeem is the payment.

A treasury smart account delegates a scoped capability to a coordinator, which redelegates a tighter scope to a worker. When the worker redeems, USDC moves and the capability is granted in one atomic transaction. No coordinator in the path. Gas paid entirely in USDC via 1Shot.

Open the consoleSee the chain
1
Treasury delegates to coordinator with caveats: exact target, method, order + 1 hour + 3 calls max.
2
Coordinator redelegates to worker with caveats TIGHTENED: 10 min + single-use. A sub-delegate cannot exceed its parent.
3
Worker redeems via DelegationManager.redeemDelegations. USDC transfers. Slot granted. Any relayer earns the fee.
  • 208Solidity tests
  • 2networks live
  • 0Critical/High audit findings
  • 3contract roles

built withMetaMask Delegation Toolkit 0.13.0EIP-7702 Smart Accounts1Shot Permissionless RelayArbitrum One + Sepolia

Caveats tighten at every hop. A sub-delegate cannot exceed its parent.

The MetaMask Delegation Toolkit enforces the non-widening invariant on-chain. A wider child caveat reverts at the root enforcer. A replay reverts at the call-count enforcer. No coordinator can escalate its own grant.

non-widening proofenforced on-chain, not by convention
  1. revertsA coordinator that tries to pass a widercaveat (e.g. any target) to the worker will revert at the root delegation's AllowedTargetsEnforcer check before any funds move.
  2. revertsA worker that attempts to replay the single-use delegation will revert at LimitedCallsEnforcer. Replay protection requires no nonce from the signer.

Rivalrous capabilities. Truly gas-poor execution.

The x402 field sells copies of non-rivalrous data. Caplane settles a real, scarce slot that only one agent can hold. And on mainnet, USDC is the only token the consumer needs.

  • One slot. One agent. On-chain enforced.

    AllocationAdapter · rivalrous capability

    The AllocationAdaptermaintains a capped vault. When an agent redeems the delegation, it occupies a slot. That slot is unavailable to any other agent until released. Scarcity is enforced by the contract, not by the provider's word. This is categorically different from selling an API key: two agents cannot hold the same slot.

    vault cap
    1 000 slots (Sepolia) / 100 slots (Mainnet)
    enforcer
    CaplaneOrderEnforcer
    fee routing
    tied to the redeemer address; any relayer can earn it

  • Consumer holds only USDC. Zero ETH required.

    1Shot on Arbitrum One · gas-poor proof

    On Arbitrum One, the consumer's 7702 smart account holds only USDC. 1Shot's permissionless relayer relays both the EIP-7702 upgrade transaction and the redeemDelegations call, with gas paid in USDC. The consumer never acquires ETH. This is the gas abstraction proof: the capability purchase and the gas cost denominate in the same token.

    network
    Arbitrum One (chainId 42161)
    consumer balance
    USDC only; zero native ETH at time of redemption
    relayer
    1Shot permissionless relay endpoint

Real transactions. Verify on the explorer.

Audit verdict: 0 Critical, 0 High, 0 Medium findings. 208 Solidity tests. Both transactions are live and permanent.

Audit: 0 Critical · 0 High · 0 Medium208 tests100% core line coverage
deployed contractsMetaMask Delegation Toolkit 0.13.0
Arbitrum Sepolia
Arbitrum One
Shared (both networks)

Redelegation that settles. On-chain, on mainnet, audited.

The 2-hop chain runs on Arbitrum Sepolia. The gas-poor mainnet proof runs on Arbitrum One. Both are verifiable today on the explorer.

Open the consoleView the repository