Agent payment safety checks for Coinbase AgentKit and CDP wallets

What your agent needs to know about Coinbase AgentKit and CDP wallets

When it counts as settled

AgentKit actions are ordinary onchain transactions, so finality is the chain's. On Base, docs describe L2 inclusion in about 200ms, L1 batch inclusion in about 2 minutes, and L1 batch finality in about 20 minutes. For larger transfers wait for the stage you need.^[5]

Fees

The CDP Paymaster sponsors gas for smart accounts (EOAs only via EIP-7702) on Base mainnet and Base Sepolia only. Docs say you pay the sponsored gas plus a 7% fee, invoiced monthly. You can set contract allowlists, per-user limits and global caps. The AgentKit README mentions fee-free stablecoin payments but gives no mechanism, so do not assume gasless without testing.^[1],[4]

Stablecoins

AgentKit lists Base, Ethereum and Solana with deep support. Circle's docs give the Base USDC contract below. CDP policy rules for sending an EVM transaction can use ethValue, evmAddress, evmNetwork, evmData and netUSDChange criteria. CDP docs say netUSDChange is only evaluated for mainnet transactions.^{[1],[6],[10],[7]}

How agent payments go wrong on Coinbase AgentKit and CDP wallets

1. 1. No built-in spend cap or approval

   The AgentKit README states it does not gate transfers behind human approval, enforce spend caps, or allowlist destinations. A prompt-injected agent can move the whole balance. Add limits in a CDP policy or in your own wrapper.^[1]

2. 2. Prompt injection through external content

   The README warns that LLMs do not reliably separate instructions from data, and names direct and indirect injection, for example social posts or profile data. An agent that reads untrusted text and holds a wallet can be told to pay. Keep wallet-moving tools away from untrusted-content workflows.^[1]

3. 3. Policy precedence across project and account scopes

   Within one policy, a matching reject rule beats a matching accept rule. Across scopes it does not: for API key wallets, CDP docs say the project-level policy takes precedence when any of its rules match, so an account-level reject does not override a matching project-level accept. A broad project-level accept can therefore bypass an account-level denylist. When no rule matches, the request is rejected if either policy has rules for that operation, and accepted only if neither does.^[3]

4. 4. An address allowlist does not limit who receives USDC

   The evmAddress criterion compares the transaction's to field. For an ERC-20 transfer, to is the token contract, not the recipient, so an allowlist that contains the USDC contract lets USDC go to any recipient. ethValue caps only native value, which is zero for a USDC transfer. To limit the USDC recipient and amount, use the evmData criterion, which checks conditions on the function and arguments in the transaction's data field, or a netUSDChange limit.^{[8],[9],[10],[7]}

5. 5. Paymaster sponsors unintended calls

   Docs recommend a contract allowlist to stop unintended sponsorship. Without it, a sponsored account can burn gas budget on arbitrary calls. Set per-user limits and a global cap.^[4]

6. 6. Server wallet credential compromise

   API key wallets are controlled by a CDP API key and Wallet Secret; keys sit in a TEE but your credentials authorize signing. Anyone with them can operate the wallet within policy. Store them in a secret manager and scope the API key.^[2]

Pre-flight checklist for a Coinbase AgentKit and CDP wallets agent

• Limit USDC recipients and amounts with an evmData rule on transfer(to, amount), not an evmAddress allowlist, which only sees the USDC contract.
• Cap ethValue for native ETH, and add a netUSDChange limit or a code-level cap for token amounts.
• If you use both scopes, put deny rules in the project-level policy or keep project-level accepts narrow: a matching project-level accept beats an account-level reject.
• Fund the agent wallet with a small float and top up from a human-controlled wallet.
• Do not give wallet tools to an agent that reads untrusted text without human approval.
• Set a contract allowlist and global cap on the CDP Paymaster.
• Confirm the policy covers sendUserOperation and signEvmTypedData, not only sendEvmTransaction.
• Test USD limits with a small amount on mainnet: CDP docs say netUSDChange is only evaluated for mainnet transactions, so a Base Sepolia test does not exercise it.

Explorers to confirm a payment

• Basescan

Sources

1. [1] coinbase/agentkit README, GitHub (Coinbase)
2. [2] Server wallets welcome, Coinbase Developer Platform docs
3. [3] Policy engine overview (evaluation), Coinbase Developer Platform docs
4. [4] CDP Paymaster, Coinbase Developer Platform docs
5. [5] Transaction finality, Base docs
6. [6] USDC contract addresses, Circle developer docs
7. [7] EVM policies (criteria examples), Coinbase Developer Platform docs
8. [8] EvmAddressCriterion reference, Coinbase Developer Platform docs
9. [9] EvmDataCriterion reference, Coinbase Developer Platform docs
10. [10] SendEvmTransactionCriteriaItem reference, Coinbase Developer Platform docs

Checked against these sources on 9 November 2026. Networks change: confirm against the live docs before you rely on a number. This page is a checklist from public documentation. It is not a security audit, legal, compliance or investment advice.