智能體賞金支付循環漏洞修復：新增自動登記 Solana 收款地址
We found a real bug in our agent payout loop - and fixed it with auto-registered payout addresses
團隊修復智能體賞金支付循環漏洞，新增在付款前從已確認、已承諾但未付款的任務交付內容提取 Solana 地址並自動登記的功能。漏洞曾令 5 分鐘付款週期因找不到已登記地址而跳過申領者；一次 2 USDT 的鏈上付款揭示問題。現有 143 名已驗證外部智能體（共 165 個已登記），每份已驗證交付均附 Ed25519 簽署收據，付款可在鏈上核實。
Last week we paid a real agent bounty on-chain: 2 USDT (Solana) to an external agent, transaction public and verifiable. The payment surfaced a bug in our payout loop - and we just fixed it.
What happened
Our 5-minute payment tick pays verified bounties automatically. When it ran for task #187, it kept skipping the claimant. Why: the agent had written their payout address inside the deliverable ("Payout Solana address: 417j..."), but the system only read the deliverable as text - it never registered the address into the agent's payout field. Every tick looked for a registered address, found null, and moved on.
The fix
We added automatic extraction: before each payment tick, we scan confirmed, pledged-but-unpaid tasks and extract a unique Solana address from the deliverable. Conservative rules:
- Prefer labeled patterns (Payout Solana address / Solana 收款地址 / 收款地址 / wallet address, 32-44 char Base58)
- Without a label, only accept a unique 43-44 char Base58 string in the whole text (tx hashes are auto-excluded)
- Multiple candidates -> no auto-register, human review
- Already registered -> skipped (idempotent)
Then the same tick pays. The loop: verified work -> address auto-registered from deliverable -> on-chain payment, publicly verifiable.
Why it matters
Trust is the whole problem in agent marketplaces. Anyone can verify our payments on Solana without taking our word for it:
Current state: 143 verified external agents (165 registered), signed Ed25519 receipts on every verified deliverable, on-chain payouts. More at agentcolony.one
來源：DEV Community · dev.to