GasTanker

Automation with a bounded blast radius.

GasTanker is being built to move value for you, so every movement is constrained before it happens, verified after, and recorded throughout.

Your private keys are not part of the product.

GasTanker never asks for:

  • wallet seed phrases or recovery phrases,
  • your operational wallets' private keys,
  • more exchange access than the current stage uses.

During the preview, GasTanker only needs a dedicated key that can read. It accepts a key that can also trade, transfer, or withdraw, but only reads with it, and tests every new key before it replaces a working one.

Credentials are encrypted individually and can only be decrypted by an isolated component. They never appear in logs, the dashboard, or API responses.

Coming soon

One organization. One relay. No shared pool.

Each organization gets its own relay. No other customer's funds pass through it.

A relay is a transit point, not a treasury. Its balance is capped, attributable to specific operations, and either forwarded or reconciled. Stale balances and slow forwards raise alerts and can pause the relay.

Relay signing happens in dedicated signing infrastructure. Raw relay keys never exist in application configuration.

Coming soon

GasTanker cannot spend without limits.

Every automatic movement passes independent checks.

Per operation
No single top-up exceeds the maximum you set.
Per wallet
One runaway wallet cannot drain the organization's budget.
Velocity
A wallet funded unusually often is stopped before repeated automation becomes a drain.
Organization-wide
Funding across every wallet still respects one business limit.
Human approval
Until automation has been proved on a route, every movement waits for a person to approve it.
Emergency pause
Funding can be paused per organization, network, provider, or globally. A pause stops new movement but never blocks GasTanker from finishing the checks on transfers already in flight.

Funding destinations cannot silently change.

Exchange withdrawals only ever go to your organization's verified relay. GasTanker never sends an exchange withdrawal straight to an address supplied through the API.

Once a wallet is verified, its address is immutable. Changing it means registering a new wallet, so a compromised session cannot quietly redirect funding.

Payouts – EUBase
0x7a2F…c41fVerified

Need a different address? Register a new wallet.

Live

Sensitive changes need a person, a password, and a second factor.

Two-factor authentication (TOTP) is required before any sensitive action. Each verification unlocks sensitive actions for fifteen minutes, in that session only.

That applies to:

  • creating, changing, pausing, or resuming policies,
  • activating alert channels,
  • creating or revoking API keys,
  • changing organization members, roles, and invitations,
  • connecting exchange sources.

There is no “trust this device” bypass, and email cannot be used to skip the second factor.

Confirm it's youEnter the 6-digit code from your authenticator app to revise this policy.
Valid for 15 minutes in this session
Live

API keys stay narrower than people.

API keys belong to your organization and are scoped to the reads and writes an integration needs.

A key can never perform an action that requires a human second factor. It cannot create keys, change policies, or connect exchanges.

A key canwallets:readwallets:writepolicies:readoperations:read
A key can nevercreate or revoke keyschange policiesconnect exchangeschange members

When we're not sure, we stop.

A provider returning success is not enough.

A timeout is not automatically a failure.

A temporary zero balance is not a reason to spend.

  • Failed or suspicious balance readno operation is created.Live
  • Ambiguous withdrawal or forwardmarked unknown and resolved from exchange and chain evidence before any retry.Coming soon
  • Repeated provider failuresnew funding pauses; checks on transfers already in flight continue.Coming soon
  • Destination mismatchstop and escalate.Coming soon
Live

Every sensitive action leaves evidence.

GasTanker records:

  • who created or changed a policy, and every revision,
  • who activated an alert channel or issued a key,
  • every second-factor step-up,
  • every low-balance event and operation.
Coming soon

When automatic funding is enabled: every approval, withdrawal, forward, receipt, fee, and reconciliation.

Evidence is scoped to your organization and redacted. Credentials, private keys, and full webhook URLs are never stored in audit records.

An operation should always be explainable after the fact.