Veto
ConnectingDemo

Agent wallets · Solana program upgrades

An upgrade should stop the agent.

Your agent's wallet trusts a program by its address. An upgrade keeps the address and swaps the code. Veto pauses the agent's payments until you approve the new deployment.

You approve code, not just an address.

The operator's wallet owns the protected Swig wallet and is the only key that can approve a new merchant-pay deployment.

01 / operator
Your walletWallet root · sole approver
02 / gate
Veto policyAgent, wallet, program, deployment
03 / delegation
Swig walletAgent role, 500-token limit
04 / program
merchant-payUpgradeable by the protocol team
Reading stateLoading
Approved slot—
Deployed slot—
Veto wallet—Agent pays through Veto
Plain allowlist—Agent key allowed directly
Merchant received—Test tokens, no value
Deployed code—sha256 —

Run the scenario

Preparing

  1. Pay under the reviewed build

    Preparing

    The agent pays 10 test tokens from each wallet.

  2. The protocol ships v2

    Waiting

    Same program address, new code: v2 charges the whole balance.

  3. The agent pays again

    Waiting

    It asks for 10 from each wallet. Watch the balances.

  4. The protocol ships a fix

    Waiting

    The reviewed build is redeployed. Veto still waits for you.

  5. Review and approve

    Waiting

    The code matches the build you reviewed. Your wallet signs.

  6. Payments resume

    Waiting

    The agent pays 10 through the approved deployment.

The slot is the stop sign. The hash helps you review.

  • What Veto enforces on-chainOnly the named agent can use the delegated route, only through this Swig wallet, only into merchant-pay, and only while its deployment slot matches the one you approved.
  • What the console addsA comparison of the deployed code hash with the build you reviewed. It refuses to prepare an approval for code that does not match.
  • What remains outsideWhether the reviewed code is safe, calls made downstream by merchant-pay, and an independent security review.