Redeye

The agent for when Wall Street is closed.

Friday, 4pm, New York. The closing bell rings and every stock price in the country freezes until Monday. On-chain, nothing stops. Tokenized stocks trade straight through the weekend, priced off a reference that has not updated in two days. Anyone can see the gap, and almost nobody has built anything that acts on it.

We built Redeye to act on this gap. It reads a 24/7 price for your stock while Wall Street sleeps, locks its promise on BNB Chain before the bell, acts on it overnight or over the weekend, and at the next open shows on chain whether it kept its word.

Live on BNB Chain mainnet: theredeyed-agent.site · Proof page · Every promise it made · Telegram: @redeyed_bot

▶ Watch the demo video on YouTube · Watch the demo video on X

Check it yourself

Every link below is a real transaction on BNB Chain mainnet. No wallet needed.

What happened	When (UTC)	Check it
A promise acted on with real money, while Wall Street was shut. "If CRCL rises 1% while Wall Street is closed, sell it." At 10:41 pm New York time on Friday, 6 h 41 min after the bell, it was up 1.002%; the agent sold 0.0605 CRCL for 5.156 USDT through the Binance Agentic Wallet.	Fri 9 Oct 10:41 pm New York (02:41 UTC Sat)	promise locked (Fri, 10 h 45 min before the bell) · decision · sale · fill recorded
Re-check it in your browser. Your browser re-hashes the promise and the decision and compares them with the chain. No trust in our server.	any time	open the CRCL sale, press Check it
Agents pay Redeye, Binance settles it (B402). An agent pays 0.002 U for the 24/7 price; Binance's own facilitator settles it on chain before Redeye answers.	10 Oct 21:07 · live on the agent since 11 Oct 01:49	first B402 sale · first through the live agent · filmed live, 11 Oct 09:26 · how we got there
A promise signed by the Binance Agentic Wallet itself, through the Redeye skill, stored under the wallet's own address.	10 Oct 18:47	lock · another, filmed live 11 Oct 09:26
A phone account with no seed phrase. Made inside Telegram, approved with a fingerprint or Face ID; Redeye paid the fee.	11 Oct 05:35	Android, fingerprint · iPhone, Face ID, 11 Oct 09:38
The first promise, graded at the open. Protect half an Nvidia holding overnight; graded: kept.	locked 7 Oct 14:32	lock · result
An agent with an on-chain identity: Redeye is agent #368521 in BNB Chain's ERC-8004 registry.	9 Oct 00:39	registration

From a terminal:

curl -s https://api.theredeyed-agent.site/record              # every promise and its result
curl -i https://api.theredeyed-agent.site/x402/price/NVDA     # 402: pay 0.002 U, settled by Binance B402
curl -s https://api.theredeyed-agent.site/binance             # live calls to the Binance Web3 API

Every x402 and B402 buyer so far is one of our own wallets; we say so rather than count them as customers.

What Redeye does

You hold a tokenized US stock on BNB Chain. At 4pm New York the official price stops, but the token keeps trading all night and all weekend. Redeye lets you decide before the bell what should happen while the market is shut, in plain words:

• Protect: "If Nvidia falls 3% overnight, sell half."
• Buy the dip: "If Tesla falls 1% this weekend, buy $5."
• Sell the rise: "If CRCL rises 1% this weekend, sell it."
• Hold: "Hold through the night and tell me how it went."

Then:

1. Locked before the bell. The promise is written on BNB Chain before the close. After that nobody, including Redeye, can change it. A promise locked too late is refused.
2. Watched every minute. Redeye compares the token with a 24/7 price for the same stock (Hyperliquid's equity market, which never closes; used as a reference only, never traded).
3. Checked by Binance before any money moves. Token status, shares per token, Binance's own price and quote, and a dry run of the exact transaction. If a check fails, Redeye refuses and says which check and why.
4. Acted on. When the trigger is hit, the decision goes on chain first, then the trade.
5. Graded at the open. When Wall Street opens, the result is published next to the promise: kept, refused or broken. Anyone can re-check it.

Three ways in

For	How	State
People with the Binance Agentic Wallet	Redeye trades inside the daily limit you set in the Binance app; the Redeye skill lets the wallet sign promises in its own name	Live: made the CRCL sale
People with their own wallet	A one-trade permission: the agent can make exactly one matching trade, and nothing else	Live: a $2 buy-the-dip on Intel is locked; no trade yet
Newcomers	Open @redeyed_bot in Telegram, approve with a fingerprint or Face ID. No seed phrase; Redeye pays the fee; only your phone can move money out	Live: first account 11 Oct

Why this, and why it is different

• The gap is real, and measured. Across 104 stock-weekends of 13 stocks (data), the price moved a median 0.89% between Friday's close and Monday's open while the token traded all weekend. By Monday 07:00 UTC the 24/7 price was closer to Monday's open than Friday's close in 59 of 97 cases (median miss 0.73% against 0.90%). On Saturday it was about a coin flip, so Redeye acts on the plan you set, not on a forecast.
• A promise you can hold it to. Most trading bots tell you what they did afterwards. Redeye says what it will do before the close, on chain, and is graded against the open in public, including when it refuses.
• Built on Binance end to end. Six Binance Web3 API modules signed with our own key (five that check trades, plus B402 settlement for agent payments), the Agentic Wallet for trading and signing, and a skill so the wallet can use Redeye directly.

What we found building it

We kept a developer log as we built: 86 entries, 1,090 minutes lost, each with the exact page, error, time lost and fix (docs/dx-log.md). Highlights:

• B402 refused four settlements with an undocumented invalid_transaction_state. A dry run that never settled showed why: the Agentic Wallet signs the payment as valid from the signing second, and settling 0.3 s later is too early. Redeye now waits for a block past it. Full write-up: docs/b402-investigation.md.
• Passkeys don't open inside Telegram's in-app browser. Redeye keeps the account key behind Telegram's own fingerprint check and signs in the same format a passkey uses, so the same on-chain account checks it.
• The docs and the live route differ: stock tokens are documented as an RFQ trade; the live answer is a swap routed through LiquidMesh. The Agentic Wallet's quotes matched the Trading API exactly.
• On a Saturday, RWA market status said TRADING with no market state, so Redeye keeps its own clock of when Wall Street is open. On Sunday all 46 stock tokens still said TRADING, and their referencePrice moved with the token instead of staying at Friday's close, so Redeye takes the close from Nasdaq.
• Agentic Wallet EIP-712 signatures come in two pieces (64 bytes plus a recovery byte); the skill joins them and checks both recovery values.
• The token security audit returned no data for all 15 stock tokens Redeye trades; Redeye shows AUDIT_NO_DATA instead of pretending a token passed.

Words we use

Word	Meaning
Promise / plan	What Redeye will do while the market is shut, in plain words, locked on chain before the close
Plan number (e.g. plan #6)	The order in which promises were locked; only needed to find one in the record. The CRCL sale is plan #6
24/7 price	The stock's price from Hyperliquid's equity market, which trades around the clock. A reference, never traded
Window	The hours Wall Street is shut: overnight, the weekend or a holiday
Kept / refused / broken	The grade at the open: did what it promised / did not trade because a check failed, and says which / did not keep its word
PlanBook	The contract that stores every promise, decision and result
PlanAccount	The one-trade permission for your own wallet or phone account
Agentic Wallet	Binance's wallet built for AI agents, with limits set by the owner in the Binance app
x402 / B402	Pay-per-call for agents over HTTP; B402 is Binance's settlement service for it

For developers

Everything below is the technical detail behind the product above.

Status in detail, 11 Oct 2026

• First plan-triggered trade. Plan #6 promised to sell 0.0605 CRCL if its 24/7 price rose 1% over the weekend. At 02:41 UTC on 10 Oct it did: the decision went on chain, the Binance Agentic Wallet sold for 5.156 USDT, and the fill was recorded on PlanBook. Binance's Wallet API and the chain agree on the amount to the last digit (checked after the trade; the pre-trade Binance checks were added later that day).
• Trades are checked by the Binance Web3 API, signed with our own key (five modules; which ones run depends on the route, see below), plus B402 for x402 settlement.
• Spot only. The 24/7 price from Hyperliquid's xyz market is a reference signal only; Redeye never opens a position there. Every trade is a spot bStock trade on BNB Smart Chain mainnet.
• Plans #2 to #5, #7 and #8 are watching the weekend window, graded at Monday's open (13:30 UTC); plans #9 and #10 (Monday night) and #11 (Intel, Monday night, locked live on 11 Oct) are locked. Results publish at the next open.
• Plan #10 was signed by the Binance Agentic Wallet itself through the Redeye skill (skills/redeye, lock --yes): the wallet signed the plan (EIP-712, Developer mode), and PlanBook stores it under the wallet's own address 0xDA11…aae2. A Hold on NVDA for the Monday-night window; no money moves, graded at Tuesday's open.
• x402 sales settle through Binance B402 since 11 Oct 01:49 UTC (see x402 sales).
• Three doors: the Binance Agentic Wallet; your own wallet through PlanAccount (one bounded, owner-signed trade; plan #8 is locked this way); and a phone account for newcomers, created from Telegram. The first real phone account was made on 11 Oct 05:35 UTC (tx, account 0xe40D7AEA…069F), approved with Telegram's fingerprint check. Where the phone's browser supports passkeys, a WebAuthn passkey is used instead; both sign in the format PasskeyOwner checks.

On chain

What	Address or transaction
PlanBook	0xC7B860d561f2208c725ac9a873bf4eA5205e9057
PlanAccount template (bounded permission + ERC-1271 revision)	0x9736a95F6a5c24165Ecf282e3E08016715460AAC
Agent	0xe201bbf3C736a5d188797974a7e4B9464f707eA8
First x402 sale: NVDA 24/7 price, 0.002 U, settled by the agent	settle (team buyer wallet, labelled as our own test)
First B402 sale: Agentic Wallet paid, Binance settled	settle (our own Agentic Wallet as buyer, 10 Oct 21:07 UTC)
First B402 sale through the live agent (Redeye skill)	settle (our own Agentic Wallet as buyer, 11 Oct 01:57 UTC)
PlanJobHook (team jobs)	0x42a7F449e4950524c13deBC96a0549100b516594
Plan 1: Guard on NVDA, 7 Oct overnight window	lock, 5 h 27 min before the close
Plan 6: first triggered trade, CRCL sell on +1%	decision · sale · fill on PlanBook
Plan 10: signed by the Agentic Wallet itself (Redeye skill)	lock, owner 0xDA11FAba6da586c4EEE689b3387Af0b0fd00aae2
Plan 11: Intel guard signed by the Agentic Wallet, filmed live	lock, 11 Oct 09:26:19 UTC
Third B402 sale, filmed live (Redeye skill)	settle, 11 Oct 09:26:37 UTC (our own Agentic Wallet as buyer)
Passkey account factory (with owner-signed withdrawal)	0x5065d3395d365d88870a5a6799c48e8f59f0e9e9
First phone account (Telegram fingerprint), 11 Oct 05:35 UTC	create, account 0xe40D7AEA0860FC87B0352a3e83BeEcB7409F069F
Second phone account (iPhone, Face ID), 11 Oct 09:38 UTC	create, account 0xC4DD774bC8A2F380CF44fe2845f9efaFAF1faAbD
First promise locked from a phone account (fingerprint), 11 Oct 11:51 UTC	lock: buy up to $5 of NVDA if it falls 3%, owner 0xe40D7AEA0860FC87B0352a3e83BeEcB7409F069F

Binance Web3 API

Redeye signs its own requests to five Binance Web3 API modules (packages/clients/src/web3api.ts, HMAC-SHA256 per the authentication page, a fresh nonce per attempt, one clock-skew retry). Which modules run depends on the route (apps/agent/src/binance-gate.ts). A required module that does not answer makes the trade wait; it never trades unchecked.

• Agentic Wallet route: RWA Data, Market and Trading before the trade; the Agentic Wallet trades; Wallet API and BNB Chain transfers after it. No Transaction dry run here: the Agentic Wallet builds its own transaction and does not expose it (see docs/dx-log.md). Plan #6 went this way.
• Own-wallet and passkey route (PlanAccount): RWA Data, Market, Trading and a Transaction dry run of the exact transaction before the trade; the account trades; Wallet API and BNB Chain transfers after it. No trade has gone this way yet.

Module	Endpoints	What it does in Redeye	Refusal
RWA Data	GET /dex/market/rwa/tokens	Token status, shares per token and price before each trade, and the bStock list every 10 minutes	ASSET_PAUSED, MULTIPLIER_MISMATCH, BINANCE_API_UNAVAILABLE
Market	POST /dex/market/price	Binance's token price, stored next to the pool price	evidence
Trading	GET /dex/aggregator/quote	Binance's own quote for the same token, side and size, compared with the Agentic Wallet quote	QUOTE_DEVIATION_EXCEEDED (waits and retries)
Transaction	POST /dex/pre-transaction/simulate	Dry run of the exact PlanAccount transaction; predicted balance changes must stay inside the signed bounds, and the transaction sent must have the same calldata hash	SIM_FAILED
Wallet	GET /dex/post-transaction/transaction-detail-by-txhash	After each fill, Binance's record of what the wallet sent and received, compared with the chain reconciliation	evidence (stored on the run)

What Binance returned is part of the hashed decision input, so it is on the record behind each on-chain decision. Live counts: curl -s https://api.theredeyed-agent.site/binance. Read-only check of all five modules: node scripts/web3-probe.mjs (needs BINANCE_WEB3_API_KEY and BINANCE_WEB3_API_SECRET). What we found along the way, including where the docs and the live answers differ, is in docs/dx-log.md.

Start here

cp .env.example .env
pnpm probe

The source probe performs non-destructive checks against public data and chain endpoints, records raw responses under data/raw/probes/, and writes a machine-readable report to data/raw/probes/latest-report.json. Authenticated wallet, funded-mainnet, and merchant probes run only when their required environment variables and explicit test settings are present.

Execution is disabled by default and must remain disabled during probes.

Current implementation

The current implementation establishes the first proof slice:

• typed source records and fail-loud public-data parsers;
• deterministic overnight, weekend, holiday, Protect, Hold, React, Guard and Buy-the-dip decisions;
• a source-labelled Hyperliquid xyz price client with age and unit checks;
• a frozen off-hours study rebuilt from committed raw records with a Node command;
• quote freshness, address, reference-price and price-impact checks;
• verbatim filing-value verification;
• canonical plan, decision and verdict hashes;
• a no-custody PlanBook contract with uniqueness and lifecycle tests;
• a no-custody PlanAccount permission contract that checks one owner-signed permission, Pancake exact-input calldata, price band, replay, revocation, expiry and standing-run windows;
• a typed agent HTTP boundary and Node 22 SQLite store with explicit empty and unconfigured states;
• a live source-backed price service for the US close, 24/7 price and token price, with raw records and public health counters;
• a plan service that locks a plan in PlanBook before the close, checks it every minute against the 24/7 price and that night's official close, and records the decision and the result (with the official open) on chain.
• automatic post-window reconciliation of Agentic Wallet token and USDT transfers; publication waits if chain evidence is unavailable, and the reconciliation is included in the receipt fingerprint.
• a wallet-signed PlanAccount relay path with EIP-7702 authorization capture, one permission per plan or standing run, and permissionTx receipt evidence;
• a guarded Telegram Mini App passkey onboarding path: server-side initData HMAC verification, deterministic factory preview, durable per-user/day sponsor limits, fee-capped factory deployment, local credential handoff, and WebAuthn ERC-1271 permission signing into the existing PlanAccount lock route;
• /data for the frozen weekend sample and enriched CSV, and /replay for trigger-only replays of the eight latest completed windows. Earnings-night data is not available yet and is kept separate from the weekend sample.

The central story is deliberately narrow: a plan must be frozen before the market-close window, then end as a confirmed action or a visible refusal. The current price view shows the US close, 24/7 price and token price with source timestamps. Until a live plan resolves, replay output must be labeled REPLAY and simulations must be labeled SIMULATED.

Wallet-door boundary

The signed-wallet path uses a direct Pancake V3 quote/simulation adapter because the installed baw CLI exposes no Trading API transaction-data endpoint. The adapter is restricted on chain to Pancake exactInputSingle, binds the owner as recipient, and fails closed when the quote, router or EIP-7702 provider is not available. The deployed and source-verified template above includes these checks; do not call the wallet door live until EIP-7702 wallet support and the first small-value end-to-end trade are confirmed.

Agent identity

The agent serves its ERC-8004 registration file at /.well-known/agent-registration.json (also /identity) once PUBLIC_AGENT_URL is set. The file lists only services that are live today and the two contracts above. pnpm identity:register checks that the file is reachable and simulates the registration; with --send it registers the agent in the identity registry on BNB Chain (0x8004A169FB4a3325136EB29fA0ceB6D2e539a432), or points an existing registration (ERC8004_AGENT_ID) at the current address.

MCP server

POST /mcp is an MCP server (streamable HTTP, stateless, JSON answers) built on the official @modelcontextprotocol/sdk. Its tools are all read-only: redeye_price (the latest checked close, 24/7 and token prices with gaps, ages and sources), redeye_windows, redeye_record, redeye_run (one plan and its receipt), and redeye_plan_draft, which checks a plan against tonight's window and returns its promise, fingerprint and lock deadline without saving or locking anything. A plan locked after a close belongs to the next close; in the last five minutes before a close a lock is refused rather than moved to another night.

A2A

The agent card is served at /.well-known/agent-card.json (A2A protocol 1.0 and 0.3), with JSON-RPC at /a2a. Its skills are read-only: price, windows, record, run and plan check.

Agentic Wallet skill

skills/redeye is a skill for the Binance Agentic Wallet. It answers "what's Nvidia worth right now", turns plain words into a plan, reads the promise back, and with lock --yes has the Agentic Wallet sign the plan (EIP-712, no gas) so PlanBook stores it in the wallet's own name; Redeye pays the network fee. Signing needs Developer mode on in the Binance App. First live run: plan #10, 10 Oct 2026.

cd skills/redeye
node scripts/redeye.mjs price NVDA
node scripts/redeye.mjs check '{"ticker":"NVDA","kind":"hold","heldShares":"0.0202","params":{}}'

Try it from a terminal

curl -s https://api.theredeyed-agent.site/health
curl -s https://api.theredeyed-agent.site/record
curl -s https://theredeyed-agent.site/.well-known/agent-card.json
curl -i https://api.theredeyed-agent.site/x402/price/NVDA   # answers 402 with the payment terms

The MCP endpoint is https://api.theredeyed-agent.site/mcp.

x402 sales

GET /x402/price/{ticker} (0.002 U) sells the live 24/7 price snapshot: the last close, the 24/7 price, the token price, gaps, ages and sources. GET /x402/window/{ticker} (0.01 U) sells the off-hours history against the next open, and GET /x402/record/{id} returns a plan's receipt for free. Payment is the x402 v2 exact scheme in U by EIP-3009 on BNB Chain (EIP-712 domain "United Stables", version "1"), paid to the agent wallet.

X402_SETTLEMENT picks how payments settle:

• self: the official x402 EVM facilitator (@x402/evm) runs inside the agent. It checks the buyer's signature, balance and nonce, simulates the transfer, and the agent wallet submits the buyer's signed transferWithAuthorization to U, paying the gas (about $0.003 at 0.05 gwei, more than a $0.002 sale earns). U's own nonce check stops a signed payment from being used twice.
• b402-web3: Binance B402 through the signed Web3 API gateway (POST /build/api/v2/b402/supported, /verify, /settle), with the same BINANCE_WEB3_API_KEY and secret and the same HMAC signing as the other five modules (packages/clients/src/web3api.ts). Bodies are wrapped as {"body": …} and success is the business code "000000000". The SDK's B402 scheme, a SQLite replay guard and settlement-unknown handling sit on top. Live on the agent since 11 Oct 2026 01:49 UTC; before that, sales settled through self. Once the key had the B402 Payments permission (10 Oct 2026), /supported and /verify worked, and one Agentic Wallet payment of 0.002 U was settled by Binance's facilitator on chain (tx); four later settles were refused before broadcast with errorReason: "invalid_transaction_state", which Binance does not document (docs/dx-log.md). Root cause found by a no-settle dry run: the Agentic Wallet signs validAfter = the signing second and U rejects the transfer until a block is past it; the route now waits for that before settling, and with it a complete sale went through on 10 Oct 21:07 (the Agentic Wallet paid 0.002 U, Binance settled it, tx, Redeye delivered the price). Full account: docs/b402-investigation.md. The Redeye skill buys the same way from the command line: node skills/redeye/scripts/redeye.mjs buy price NVDA shows the cost, and with --yes the Agentic Wallet signs the payment and the reply carries Binance's settlement transaction.
• b402-merchant (or b402): the separate merchant facilitator through @bnb-chain/b402's RSA-signed B402Client, once B402_BASE_URL, B402_CLIENT_ID, B402_ACCESS_TOKEN and B402_PRIVATE_KEY_B64 from the merchant onboarding are set.
• unset: paid routes answer X402_NOT_CONFIGURED.

The answer is prepared before settlement, so nobody pays for a ticker with nothing to sell, and is sent only after settlement succeeds. A price is sold only if it is under two minutes old. src/x402-fork.test.ts settles real payments against a local fork of BNB Chain (REDEYE_FORK_RPC).

Plan jobs (ERC-8183)

When JOB_BUYER_PRIVATE_KEY is set (a team wallet, never the agent's own), every locked plan is also an ERC-8183 job on BNB Chain: before the lock the buyer opens the job with the agent as provider, registers the reference optimistic policy, and pays a 0.01 USDT budget; PlanBook records the job id with the plan. After the result is published the agent delivers keccak256 of the manifest {v, planId, receipt, verdictHash}, and once the policy's dispute window has passed (7 days on 7 Oct 2026) the agent settles the job through the router. A failed job step never blocks the lock; it is kept on the plan and retried every minute, and a lost reply is recovered from the sent transaction rather than opening a second job.

Team jobs: when PLAN_JOB_HOOK_ADDRESS is set, the first TEAM_JOB_LIMIT plans also get a second job that names Redeye's own PlanJobHook instead of the router, with the team buyer as evaluator. The buyer approves it at the open only if the published receipt verifies and the delivered fingerprint matches it, and rejects it otherwise (the budget then returns to the buyer). These jobs are labelled as approved by our own wallet; they exist because the official route cannot complete a job in under seven days.

Contracts: commerce 0xEa4DAa3100A767e86FDed867729ae7446476EBA6, router 0x51895229E12F9876011789B04f8698af06cCD6DA, policy 0x9C01845705b3078aA2E8CfF7520a6376fd766dE5.

Verification

pnpm test
pnpm typecheck
pnpm lint
pnpm format:check
pnpm contract:build
pnpm contract:test

The contract test suite is offline and does not deploy or move funds. The first live PlanAccount-triggered execution is still a release gate; the phone-backed Telegram flow made its first real account on 11 Oct 2026. The signed-wallet code path is covered offline and its mainnet template is deployed and source-verified. Mainnet delegation and plan locking are confirmed; the first plan signed from a phone account is locked (11 Oct 11:51 UTC, fingerprint, lock); browser-provider EIP-7702 support and a triggered small-value mainnet swap through PlanAccount come next.

The PlanAccount path also has an opt-in BSC fork test against the live Pancake SmartRouter, QuoterV2, USDT and INTCB pool. Run it with REDEYE_FORK_RPC=... pnpm contract:test:fork. pnpm plan-account:live builds and signs the same bounded permission as the browser without sending it; add --send only with a dedicated PLAN_ACCOUNT_TEST_PRIVATE_KEY. The team's isolated proof wallet can be used explicitly with --team-test.

The agent process requires Node 22, OWNER_API_TOKEN and WEB_ORIGIN. Build it with pnpm agent:build; it will refuse to start if those values are absent. The filing feed and Binance Transaction API integration remain separate release gates; the PlanAccount adapter returns named quote/router/provider errors instead of simulated success when those prerequisites are unavailable.

The web shell is source-driven and responsive at 360px. Build it with pnpm web:build. With no agent data it shows explicit empty/error states and a REPLAY lead card; it does not render sample prices, hashes or counters.

Receipt verification instructions are in docs/verification.md.

The read-only service checks and the source-derived study rebuild are documented in docs/verification.md.

The source probe validates endpoint reachability, response shape, source timestamps and local prerequisites before implementation depends on external behavior. Findings belong in docs/dx-log.md.

Operations

redeye-backup.timer creates a SQLite-consistent backup every day under /home/ubuntu/redeye-data/backups, verifies the source database first, keeps 14 days, and writes files with owner-only permissions. Install the unit files from deploy/ and test recovery before relying on them. Future minute-level source records use compact JSON; published evidence paths and contents are unchanged. Monitor disk use because raw evidence is intentionally retained.