Meet the Auto-Replenish Agent

Stablecoins are great at sitting still. They are bad at moving themselves. Today that changes: the Auto-Replenish Agent is live in preview at oneliq.xyz/agent. One signature, one rule - your USDC starts moving itself, across chains, on your terms.

What it does, in one sentence per mode

Both modes share the same source-and-target shape. Sources are chains you've pre-authorised the agent to pull USDC from. Targets are destination wallets - each with its own destination chain. If source and destination differ, the agent routes the transfer through CCTP V2 burn-and-mint automatically. Same chain? Straight transfer, no bridge.

How it actually works

Three signatures, then nothing else from you until you want to change something. Here's the whole loop:

1. You sign once (well, twice). One EIP-712 agent rule defines the policy - mode, sources, targets, floor / amount / cap, expiry. Then one EIP-2612 USDC permit per source chain authorises a Circle Programmable Wallet to pull USDC from your EOA up to a bounded headroom (10× your daily cap or send amount, capped). Both signatures live in your wallet's typed-data popup, no transaction needed.
2. Agent watches. A Cloudflare Worker runs the cron loop every minute, scanning active rules. For top-up: it polls the target wallet's USDC balance against your floor. For schedule: it just waits for the next firing time.
3. Funds move. When a rule fires, the agent's smart account assembles a userOp: USDC pull from your EOA via the permit → optional CCTP V2 burn-and-mint to the destination chain (~30s on fast-finality pairs) → final delivery to the target wallet. Gas is sponsored by Circle Paymaster - you pay nothing in the gas token.
4. You stay in control. Pause, resume, run-now, or revoke any agent from the drawer. Revoke is the killswitch - it invalidates the signature server-side and stops every future execution.

Safety rails (the non-negotiables)

The agent moves money on your behalf. That's a serious primitive, and the design assumes things will go wrong in production. Five rails:

• Daily cap, signed on-chain. Top-up mode requires a dailyCap. The agent will never exceed it in any rolling 24-hour window - enforced twice, server-side and at the smart-account level.
• Bounded permit headroom. Your EIP-2612 permit doesn't authorise unlimited USDC; it caps the spender's allowance at 10× your daily cap (or 10× send-amount × target-count for scheduled sends). Bounded blast radius, even in a worst-case server compromise.
• 30-day expiry on everything. Both the agent rule and the USDC permit carry a 30-day expiresAt. Forget about a running agent for a month and it stops on its own.
• Auto-pause after 5 failed runs. If five consecutive cron executions fail (RPC outage, target wallet drained, permit revoked elsewhere), the agent auto-pauses and shows a red banner explaining why. You fix the underlying issue and resume manually.
• Revoke is a real on-chain operation. Hit Revoke and the permit is invalidated server-side; the executor smart account literally cannot pull a single USDC unit afterward. No "trust us, we stopped" - the chain proves it.

Chain coverage

Eight testnets, every pair routable via CCTP V2. The chip selector covers:

You can mix and match freely: pull from Base + Fuji + Arc as sources, fan out to four target wallets each on a different chain, with one agent.

What's actually in the preview

The agent has been on a rapid iteration cycle for two months. Highlights of what shipped:

• CCTP V2 cross-chain delivery. Per-target destination chain selection - the agent burns on source and mints on destination automatically. ~30s fast-finality where Circle supports it.
• EIP-2612 permits as the primary funding flow. No pre-funding the executor wallet - the agent pulls from your wallet at runtime. Arc is a first-class permit source now.
• Cloudflare Workers cron. Moved off GitHub Actions to a proper Worker - sub-minute scheduling, no minute-jitter, no Actions queue.
• Auto-pause + diagnostic surface. Five failures auto-pause with a tailored retry CTA; an admin endpoint exposes the failure log for debugging.
• Bounded ERC-20 approvals. Recent security pass capped permit headroom at 10× - no more "infinite approval" footgun.
• Per-target chain selection + custom AM/PM time picker. Locale-safe scheduling UI.
• Drawer with run-now, retry-failed-provision, force-complete. The "everything stuck for 5 min" recovery paths are surfaced in the UI, not hidden in admin.

Why this design

We could have built a "Oneliq-managed wallet that holds your USDC and sends it on a schedule". We didn't. Custody-style scheduled-send products already exist; they require trusting the operator. Oneliq is non-custodial by construction, and the agent had to stay that way.

The shape that emerged: your EOA stays your EOA. The agent's smart account holds no balance you didn't permit. The permit caps the blast radius. The cron Worker can be compromised tomorrow and the worst case is bounded by what you signed - not "all your USDC drained".

That trade has costs. You sign twice the first time (rule + permit). You re-sign when you change the rule. The agent can't move funds you didn't pre-authorise, ever. We think that's the right trade for a primitive this powerful.

How to try it

1. Get testnet USDC. faucet.circle.com on Arc Testnet or any of the seven other supported chains. The same USDC works as both the agent's funding source and Arc's gas token.
2. Open oneliq.xyz/agent. Connect a wallet. Pick a mode - Auto Top-Up or Scheduled Send. Pick at least one source chain and at least one target wallet.
3. Set the rule. Top-Up: floor + refill amount + daily cap. Scheduled: amount + frequency + start time. The summary card on the right shows you the policy in plain English before you sign.
4. Deploy. Two signatures (rule + permit per source chain), one server registration call, done. The agent appears in your list with a live status pill. First execution lands on the next cron tick if a rule is satisfied immediately.
5. Watch the receipts. Every execution shows up in the agent drawer with state machine, burn-tx explorer link, and final mint hash. The History page surfaces them in your unified activity feed too.

What's next

The agent is the first Oneliq product where reliability matters more than features. The next few weeks are reliability work:

1. Observability. Per-execution traces, public uptime dashboard for the cron worker, alerting on the failure-rate KPI.
2. Edge cases. What happens when CCTP fast-finality is degraded? When a target wallet sits behind a smart contract that reverts? When the user's permit gets revoked outside our UI? We're surfacing all of those clearly.
3. Mobile signing. WalletConnect / Reown AppKit so you can sign from a phone - the agent itself runs server-side, so mobile is purely a signing flow.
4. More rule shapes. Conditional rules ("if A's balance > X, send to B"), webhooks for inbound triggers, and B2B memo references on every transfer.

Past that, mainnet - we ship on Arc Mainnet shortly after Arc Foundation launches it, with the same non-custodial, permit-bounded design.

Try it, break it, tell us

Open oneliq.xyz/agent, sign a rule, and watch USDC move itself. If it does something weird, ping us in Discord with the agent ID - we're triaging preview reports in real time.

Oneliq is a non-custodial frontend currently on Arc Testnet. The Auto-Replenish Agent is in preview - expect rough edges and report them. Nothing here is real money or financial advice. We don't custody funds; you always retain control of your wallet.