Whitepaper

A revenue-underwritten lending protocol on Stellar Divyanshh Kalra · Kundan Kumar — Version 1.0, August 2026 The full text follows, and is the same document as the PDF.

---

​

Abstract

An autonomous software agent can now earn money. It sells inference, research and data over machine-payable APIs and is paid in stablecoins, on-chain, without a human in the loop. It still cannot borrow. No bank underwrites a process, and collateralized lending requires it to already hold the capital it is trying to raise. The result is a class of economically productive actors that can generate income but cannot finance the inputs that income depends on. We propose a lending protocol that underwrites an agent’s verifiable trailing revenue rather than its assets. The central difficulty is not reading revenue — inflows are public — but establishing that revenue represents genuine third-party economic activity rather than an operator paying themselves from wallets they control. We show that this cannot be decided, only priced, and we give a continuous discount model that converts raw inflows into effective independent revenue by weighting each payer on account age, external counterparty diversity, funding-graph independence and net-flow reciprocity, then penalising concentration. Credit is sized as a tier multiple of that figure, and further restricted by a repayment-history ramp that begins at 15% of the sized limit. Each borrower’s lenders occupy an isolated vault, so a default is contained to the parties who chose that borrower. Defaults are triggered permissionlessly, absorbed first by a reserve funded from interest, and otherwise socialised pro-rata through share price. The system is implemented in three Soroban contracts settling in USDC and is live on Stellar mainnet.

---

​

1. Introduction

Machine-payable APIs made agents into economic participants. An agent can hold a keypair, receive stablecoin payments for work performed, and pay for its own inputs. Payment is solved. Credit is not. Consider an agent that reliably earns $5 for a research task requiring a$2 data purchase. It is profitable. If its balance is below $2 at the moment work arrives, it cannot begin, and the profit is lost. Traditional finance cannot serve it: underwriting assumes a legal person, a jurisdiction, and recourse. Collateralized DeFi cannot serve it either — a protocol that requires$150 of collateral to lend $100 is useless to a borrower whose defining characteristic is having no capital and a real income stream. The gap is not liquidity. It is underwriting. What is missing is a way to convert observable income into a credit decision that a contract can enforce. Three properties make this newly tractable. Agent revenue arrives on a public ledger, so it is observable without self-reporting. Agents are programs, so borrowing and repayment can be automated to a degree no human borrower matches. And settlement on a low-fee, fast-finality chain makes loans of a few dollars economically coherent, where elsewhere gas alone would exceed the interest. This paper describes the resulting protocol. Section 3 states the underwriting primitive. Section 4 addresses the adversarial core: distinguishing independent revenue from manufactured revenue. Sections 5 through 9 give the credit, custody and default mechanics. Section 11 analyses the economic security of the construction, and Section 13 states its limits plainly.

---

​

2. Prior approaches and why they do not apply

Collateralized lending. Over-collateralized protocols avoid underwriting entirely: the loan is safe because the collateral exceeds it. This is robust and useless here, since it presupposes the capital the borrower lacks. Credit scoring from wallet history. Several systems score addresses on transaction history, protocol interaction or asset holdings. These measure activity, not income, and activity is cheap to manufacture. A score that can be farmed is not an underwriting signal. Off-chain underwriting with on-chain settlement. Real-world credit protocols underwrite legal entities off-chain and settle on-chain. This works, and does not generalise to agents: there is no entity to underwrite, no jurisdiction, and no recourse. Reputation and staking. Requiring a bond makes misbehaviour costly but again requires capital up front, reproducing the original problem. Our approach differs in what it treats as the primitive: not the borrower’s assets, identity or reputation, but the cash flows arriving at its address, and the degree to which those flows can be shown to originate from parties the borrower does not control.

---

​

3. Revenue as an underwriting primitive

Let an agent hold address $a$. Over a trailing window we observe the set of stablecoin transfers into $a$. Each transfer has a payer, an amount and a timestamp, all publicly verifiable. Define raw revenue as $R_{raw} = \sum_{i \in P} r_i$ where $P$ is the set of distinct payers and $r_i$ the total received from payer $i$. $R_{raw}$ is worthless as an underwriting input. It is trivially inflated: an operator creates $n$ addresses, funds them, and cycles capital through them. The entire problem is converting $R_{raw}$ into a figure that reflects only revenue the operator could not have manufactured cheaply. We additionally admit off-chain revenue proven by zero-knowledge TLS attestation — an agent proving a payment-processor balance without revealing credentials — verified by an on-chain verifier contract. Proven off-chain revenue is weighted at $1.5\times$ relative to raw on-chain revenue, since it carries an external attestation on-chain revenue lacks.

---

​

4. The independence problem

​

4.1 Statement

An underwriter must answer: is this revenue genuine independent economic activity, or the operator paying itself? This admits no proof. Nothing distinguishes, at the ledger level, a payment from a real customer from a payment by the operator’s second wallet. Both are valid transfers of real value. The distinguishing fact — common control — is not observable. We therefore restate the goal. We do not attempt to detect fake revenue. We attempt to make manufacturing counted revenue more expensive than the credit it unlocks. The protocol is solvent by construction if $\text{cost\_to\_fake}(R) > \text{value\_unlocked}(R)$ Since credit is at most $3\times$ counted revenue and the ramp restricts a cold borrower to 15% of that, an attacker must cycle real capital repeatedly through apparently unrelated wallets to extract a small multiple. Every mechanism below exists to raise the left side.

​

4.2 Threat model

We assume an adversary who can create unlimited addresses at negligible cost, move their own capital freely between them, wait to age accounts, script plausible activity, and obtain genuine external payment-processor accounts. We assume they cannot cheaply obtain other people’s independent economic activity. That single asymmetry is the foundation of the model. The attacks we defend against:

​

4.3 Per-payer weighting

Each payer $i$ receives a weight $w_i \in [0,1]$, the product of four independent factors. A product, not a sum: any single factor going to zero eliminates that payer’s contribution entirely, which is the correct behaviour when a payer is provably circular. $w_i = \alpha_i \cdot \delta_i \cdot \phi_i \cdot \rho_i$ Age $\alpha_i = \mathrm{clamp}_{[0,1]}\left(\frac{\text{age}_i}{A}\right)$, where $\text{age}_i$ is the payer’s account age and $A$ a maturity threshold. Defeats A2: a wallet created to pay the agent contributes nothing. External diversity $\delta_i = \mathrm{clamp}_{[0,1]}\left(\frac{d_i}{D}\right)$, where $d_i$ is the number of distinct counterparties the payer transacts with excluding the agent and the agent’s other payers, and $D$ a diversity threshold. Defeats A1 and weakens A7: a wallet that only ever deals with this agent is a puppet; one that deals only with the agent and its co-payers is a ring member. Both show zero external out-degree. Funding independence $\phi_i \in \{0,1\}$, zero if the payer’s funds trace back to the agent within $K$ hops of the transfer graph, one otherwise. Defeats A3 directly. We perform a breadth-first traversal of funding sources to depth $K=3$. Reciprocity $\rho_i = \mathrm{clamp}_{[0,1]}\left(1 - \frac{p_i}{r_i}\right)$, where $p_i$ is what the agent paid back to payer $i$. Mutual cross-payment nets toward zero, attacking A7: a ring in which members pay each other in both directions produces little counted revenue.

​

4.4 Concentration

Even with genuine, independent payers, revenue concentrated in one or two counterparties is fragile and easier to fabricate. Two mechanisms apply. First, each payer’s contribution is capped at a maximum share $\theta$ of raw revenue before weighting: $c_i = \min(r_i, \theta \cdot R_{raw})$ Second, we compute a normalised Herfindahl–Hirschman index over capped shares $s_i = c_i / \sum_j c_j$: $H = \sum_i s_i^2$ and derive a concentration factor that is $1$ for well-diversified revenue and decays to $0$ as revenue concentrates: $\gamma = 1 - \mathrm{clamp}_{[0,1]}\!\left(\frac{H - H_0}{1 - H_0}\right)$ where $H_0$ is a tolerance floor below which no penalty applies. This addresses A4.

​

4.5 Temporal organicity

Genuine demand is irregular. Scripted payments are not. We compute a factor $\omega \in [0,1]$ from the dispersion of inter-payment intervals, penalising distributions that are implausibly uniform. This raises the cost of A5 without claiming to defeat a patient adversary who deliberately randomises.

​

4.6 Aggregation

Effective independent revenue is $R_{eff} = \gamma \cdot \omega \cdot \sum_{i \in P} w_i \, c_i$ $R_{eff}$, never $R_{raw}$, is what enters scoring. The ratio $R_{eff} / R_{raw}$ is published as an independence score, making the discount auditable rather than opaque. The output is a discount, not a verdict. A payer is not accepted or rejected; it is worth some fraction of its face value. This matters: a binary classifier has a decision boundary an attacker can probe and cross. A continuous discount means that as an attacker’s construction approaches indistinguishability from real revenue, its cost approaches that of real revenue.

---

​

5. Scoring and credit sizing

$R_{eff}$ and the count of independent counterparties map to a composite score $S \in [0, 850]$ via revenue bands plus a diversity bonus of 5 points per independent payer up to 10 payers. On-chain revenue counts toward the score only if the agent clears a minimum counterparty threshold; below it, and absent proven off-chain revenue, the score is capped below the lending threshold. The score bands into a tier, and the tier fixes both the credit multiple and the base interest rate: The sized limit is $L_{base} = R_{eff} \times m(\text{tier})$ An agent with no revenue scores Unrated and receives a zero limit. This is the correct output, not a failure state. The multiple is deliberately small. At $3\times$ for the best tier, an attacker must manufacture \1$of *counted* revenue to unlock at most$$3$ of exposure, before the ramp reduces it further.

---

​

6. The credit ramp

A score derived from revenue says what an agent could support. It says nothing about whether it repays. We therefore separate the sized limit from the enforceable limit. Let $n$ be on-time repayments and $k$ missed. The ramp factor is $f = \mathrm{clamp}_{[0,1]}\big(f_0 + n \cdot \Delta^{+} - k \cdot \Delta^{-}\big)$ with $f_0 = 0.15$, $\Delta^{+} = 0.15$ and $\Delta^{-} = 0.30$. The enforced limit is $L = L_{base} \cdot f$ Three consequences. A cold agent, however well-scored, draws at most 15% of its sized limit, which bounds what a freshly-fabricated identity can extract. Trust is earned linearly and lost at twice the rate. And a degrading agent manifests as a ramp that stops advancing — an observable leading indicator that precedes default rather than following it. This is the mechanism that makes the system robust to the volatility of its borrowers. An agent’s competence may change without warning: its underlying model may be swapped, its market may move. We do not attempt to predict this. We bound exposure at any moment and let history move the bound.

---

​

7. Isolated vaults

Each agent has its own vault. A lender does not deposit into a protocol-wide pool; they deposit against a specific borrower, receiving shares in that vault alone. For a vault with total assets $A$ and total shares $T$, a deposit of $x$ mints $\Delta T = \begin{cases} x & T = 0 \\ x \cdot T / A & \text{otherwise}\end{cases}$ Share price $A/T$ therefore rises with accrued interest and falls with realised loss, and every lender’s position tracks the performance of the borrower they selected. Isolation is a deliberate rejection of capital efficiency in favour of containment. A shared pool is more efficient and spreads yield; it also spreads loss, and for a borrower class where high default rates are expected rather than exceptional, that is the wrong trade at this stage. A pooled layer can be added above isolated vaults once loss rates are empirically characterised; it cannot be safely removed later.

---

​

8. Interest, reserve and yield

A draw starts a term. Interest accrues linearly on outstanding principal at $\text{APR} = \text{APR}_{base}(\text{tier}) + \pi \cdot u$ where $u = \text{principal} / \text{assets}$ is vault utilisation and $\pi$ the maximum utilisation premium (10 percentage points at full utilisation). Scarce liquidity is priced upward, which both compensates lenders and dampens demand before a vault is drained. Repayment applies to interest before principal. Interest is split: a fraction $\sigma = 20\%$ accrues to a first-loss reserve, and the remainder becomes claimable lender yield. $\text{reserve} \mathrel{+}= \sigma \cdot I, \qquad \text{yield} \mathrel{+}= (1-\sigma) \cdot I$ The reserve is the mechanism by which performing loans pay for failing ones. It is funded by borrowers, not lenders, and accumulates in the specific vault whose borrower generated it.

---

​

9. Default

If principal remains outstanding past the due date, any party may call mark_default. Permissionlessness matters: the protocol operator is not a required participant in loss realisation, and cannot delay recognition of a bad loan. On default, with outstanding principal $D$ and reserve $V$: $V_{used} = \min(D, V), \qquad \Lambda = D - V_{used}$ The reserve is consumed first and returns to withdrawable liquidity. The remainder $\Lambda$ is written off as realised loss. Because total shares are unchanged while assets fall by $\Lambda$, the loss is socialised pro-rata through share price automatically — no iteration over lenders, no privileged distribution step. Accrued interest is written off, the agent is frozen from further borrowing, and the miss enters its repayment record, collapsing the ramp by $\Delta^{-}$ and reducing its score at the next underwriting pass. The loss is bounded by the vault. Other agents’ vaults are untouched, by construction rather than by policy.

---

​

10. Incentives

Borrowers repay because the ramp is the only path to a larger line, and because default freezes borrowing permanently and is recorded on-chain against the address. For an agent whose business depends on working capital, the option value of future credit exceeds a single stolen draw once the ramp has advanced. The system’s weakest moment is a cold agent’s first draw, which is precisely what $f_0 = 0.15$ bounds. Lenders earn tier-priced interest plus a utilisation premium, choose their borrower explicitly, and are protected by a reserve their borrower funded. They are not asked to trust agents in general — only the one they selected. Attackers face the inequality of Section 4.1. Each mechanism raises cost_to_fake: aging wallets costs time, building external counterparty diversity costs genuine relationships, avoiding the funding graph costs an unlinked capital source, and defeating concentration costs breadth. None is individually insurmountable; the model’s claim is that jointly they cost more than $3 f$ per unit of counted revenue.

---

​

11. Security analysis

Consider an adversary targeting the simplest complete attack: fabricate revenue, draw the maximum, and abscond. To be counted at all, each fabricated payer must be aged past $A$, transact with $\lceil D \rceil$ external counterparties that are not the agent’s other payers, and be funded from a source not traceable to the agent within $K$ hops. To avoid the concentration penalty the adversary needs several such payers, since a single payer is capped at $\theta$ of raw revenue and drives $H \to 1$, sending $\gamma \to 0$. Suppose they assemble this and achieve $R_{eff} = R$. Tier A requires a high score, so realistically they land in tier B or C, giving $L_{base} \le 2R$. Cold, the ramp restricts them to $0.15 \cdot L_{base} \le 0.3R$. To do better they must repay — returning capital and paying interest — several times, each cycle advancing the ramp by 15%. Reaching the full limit takes six on-time repayments. The adversary’s maximum theft is therefore bounded by roughly $2R$ after sustained good behaviour, having cycled real capital through independent-looking wallets throughout, and having paid interest that funded the reserve now absorbing part of their default. Whether this inequality holds in practice is an empirical question that only mainnet loss data can settle; we state the target rather than claim it is met. The open weakness. A sophisticated, non-reciprocal collusion ring — several genuinely distinct operators, with real external activity, each paying one direction only — is not distinguishable from real customers at the graph level. Reciprocity nets out mutual rings; external diversity catches closed ones. A ring that is neither mutual nor closed defeats the current model. We believe this requires either staking, which reintroduces a capital requirement, or global community detection over a longitudinal graph. We consider this unsolved and state it rather than obscure it.

---

​

12. Implementation

The protocol runs as three Soroban contracts on Stellar, settling in USDC via its SEP-41 contract interface. score_registry stores each agent’s published score, tier, revenue basis and repayment record. Publication is signer-authorised; reads are open. It is the single source of truth other contracts consult. credit_line is a read-only view deriving terms — tier, ramped limit, APR — from a published score, using the same shared policy library the vault enforces. Quoted terms and enforced terms cannot diverge, because they are the same code. lending_vault holds custody. Deposits, share accounting, borrows, repayment waterfall, reserve, yield, permissionless default and loss socialisation all live here. It independently re-derives the limit from the registry rather than trusting a caller. A shared revenue_math library holds all policy — banding, multiples, APR, ramp, interest split, utilisation — and is compiled into every contract that needs it. This is the invariant that keeps the system coherent: there is one definition of each credit rule. Underwriting itself is off-chain: indexing transfer events, traversing the funding graph, computing $R_{eff}$, and producing a signed score. The computation is heavy and iterative, and is not a good fit for on-chain execution. Its output is on-chain and its inputs are public, so any third party can recompute a published score from ledger data and detect a dishonest underwriter. Trust is minimised by verifiability rather than by execution location. Stellar is load-bearing here, not incidental. Loans in this system are often under ten dollars. On a chain where a settlement costs more than the interest on such a loan, the product does not exist. Sub-cent fees and roughly five-second finality are what make per-draw on-chain settlement coherent at this size.

---

​

13. Limitations

We state these plainly, since a credit protocol that hides its failure modes is not one worth lending through. A single-signer trust root. Scores are published by one authorised signer today. A compromised signer could publish fraudulent scores. Scores are recomputable from public data, so fraud is detectable, but detection is not prevention. Multi-signature attestation is the necessary next step. Collusion rings are unsolved, as described in Section 11. Off-chain revenue is partially trusted. A zkTLS proof establishes that a balance exists, not that it represents independent income. An operator charging their own cards produces a valid proof (A6). We weight proven off-chain revenue above raw on-chain revenue, which is defensible for authenticity and generous for independence. Parameters are calibrated on thin data. The thresholds $A$, $D$, $\theta$, $H_0$ and the ramp constants are chosen from reasoning and adversarial testing, not from observed default behaviour at scale, which does not yet exist. Agent behaviour is not modelled. We deliberately do not attempt to predict whether an agent will keep performing. Our protection is exposure bounding — short terms, small multiples, a ramp — not forecasting. If a genuinely earning agent degrades, the loss is real and lands on that vault’s lenders.

---

​

14. Conclusion

We have described a lending protocol that underwrites autonomous agents on verifiable revenue rather than collateral. The contribution is not the vault, the interest curve or the default path — those are standard. It is the treatment of counterparty independence as an economic quantity rather than a classification problem: revenue is discounted continuously by how expensive it would have been to manufacture, and credit is sized against what survives that discount. We claim no proof of independence. We claim a construction in which faking counted revenue costs more than the credit it unlocks, bounded further by a repayment ramp and contained by per-borrower isolation. Whether the inequality holds under a real adversary with real money is the question the next phase must answer, and it can only be answered on mainnet. The system is live. The contracts are deployed on Stellar mainnet and testnet, the loop has executed end to end in real USDC, and a default has been triggered and absorbed on-chain exactly as specified here.

---

​

References

1. S. Nakamoto. Bitcoin: A Peer-to-Peer Electronic Cash System. 2008.
2. Coinbase et al. x402: An HTTP-native payment protocol. 2025.
3. Stellar Development Foundation. Soroban smart contract platform.
4. Stellar Development Foundation. SEP-41: Token Interface.
5. Reclaim Protocol. zkTLS attestations for web data.
6. A. Hirschman. The Paternity of an Index. American Economic Review, 1964.
7. Fianza. Sybil and counterparty-independence model. docs.fianza.space/sybil-model
8. Fianza. Credit engine. docs.fianza.space/credit-engine

---

​

Appendix A: Parameters

Age and diversity thresholds $A$ and $D$ are network-calibrated; the values used on testnet are deliberately lower than mainnet targets because the chain and the agents on it are young, and are documented in the Sybil model reference.

---

​

Appendix B: Worked example

An agent has received \120$from four payers:$$60, $30, $20, $10$. Capping. $R_{raw} = 120$, so $\theta R_{raw} = 48$. The largest payer is capped: $c = (48, 30, 20, 10)$, $\sum c = 108$. Weighting. Payer 1 is mature and externally diverse, $w_1 = 1$. Payer 2 was funded by the agent two hops back, so $\phi_2 = 0$ and $w_2 = 0$. Payer 3 is fresh at half the age threshold with adequate diversity, $w_3 = 0.5$. Payer 4 is mature but the agent paid \4$back, so$\rho_4 = 1 - 4/10 = 0.6$and$w_4 = 0.6$. $\sum w_i c_i = 48 + 0 + 10 + 6 = 64$ Concentration. Shares over capped total: $(0.4444, 0.2778, 0.1852, 0.0926)$, giving $H = 0.3176$. With $H_0 = 0.15$: $\gamma = 1 - \frac{0.3176 - 0.15}{0.85} = 0.8029$ Aggregation. Assuming organicity $\omega = 1$: $R_{eff} = 0.8029 \times 64 \approx 51.38$ The agent presents \120$of inflows and is underwritten on$$51.38$ — an independence score of 0.428. Sizing. Suppose this scores into tier C: $L_{base} = 51.38 \times 1.0 = 51.38$. With no repayment history, $f = 0.15$, so the enforceable limit is $L = 51.38 \times 0.15 \approx \$7.71$ From \120$of raw inflows, a cold agent may draw under eight dollars. Six on-time repayments bring the ramp to 100$$51.38$ becomes available. That gap between apparent and extractable credit is the protocol’s primary defence.