Companies as NEP-171 NFTs on NEAR
A company you can sellin one NFT transfer.
Each Incorpr token is an AI service with its own NEAR sub-account, USDC revenue ledger, and Bitcoin, Solana and EVM addresses. The sub-account has no access keys, so there is no seed phrase for a seller to keep.
01The problem
An operating wallet cannot be safely sold.
Whoever generated a private key still has it after the sale, and a buyer cannot prove otherwise. That is why revenue-generating on-chain accounts are hard to sell or lend against.
| Selling a wallet | Selling an Incorpr company | |
|---|---|---|
| Who holds the key | Whoever generated it, indefinitely | Nobody. MPC nodes sign when the vault contract asks |
| Seller access after the sale | Cannot be ruled out | Ends when the vault records the new shareholder |
| Signatures issued before the sale | Invisible to the buyer | Counted on-chain. A company with any this epoch cannot be listed |
| Revenue figures | Seller-supplied | Booked from USDC transfers. No account can report revenue |
| Financing | Off-chain, or none | USDC loans against the NFT, with signing frozen until repayment |
02How it works
From incorporation to exit.
Five stages, each a contract call you can read. The registry holds the NFT and the market. Each company's vault holds its money and signing rights.
- 01
Incorporate
incorporate_companyCreates c-<id>.<registry>, deploys the vault with no access keys, and mints the NFT only if that succeeds. A failed deployment refunds the deposit. The founder sets the per-call price, a treasury target across BTC, SOL and USDC, a royalty of up to 10%, and a compute reserve of at least 1%.
- 02
Earn
ft_on_transferCustomers pay per call in USDC on NEAR with ft_transfer_call. The vault checks the amount against the price, splits it between compute reserve and retained earnings, and stores the payment. Paying a call does not depend on the operator, and the service route checks the on-chain payment before it runs inference.
- 03
Compound
agent_swap_intentThe treasury agent proposes a swap as structured fields. A model in a NEAR AI Cloud TEE approves or rejects a request the vault wrote. The vault verifies that signature on-chain, applies its firewall, then builds and requests signing of a token_diff intent for intents.near. One swap has settled on mainnet: 0.5 USDC to SOL on intents.near. The hosted app only quotes rebalances unless INCORPR_ALLOW_MAINNET_REBALANCE is true.
- 04
Finance
accept_offerLenders post funded USDC offers against a specific company. When the owner accepts, the vault freezes first and the principal is sent second. Repayment unfreezes it. After a default, a Dutch auction runs from 200% down to 50% of the debt. With no bid, the lender can claim the company.
- 05
Sell
list_companyThe owner lists at an ask in USDC. The listing activates only after the vault accepts the freeze. On purchase, shareholder rights are suspended, the NFT and funds move, the founder royalty is paid, and only then does the buyer become shareholder. If the vault step fails, the buyer is refunded.
03Company state
Three states decide who can do what.
Listing or pledging freezes the owner's rights. The company keeps taking payments and serving calls, so it keeps earning while it is for sale or in debt.
| Action | FREE | LISTED | PLEDGED |
|---|---|---|---|
| Raw L1 signing by shareholder | Allowed | Frozen | Frozen |
| Dividend claims | Allowed | Frozen | Frozen |
| Policy and operator changes | Allowed | Frozen | Frozen |
| Agent swaps and deposits | Allowed | Frozen | Frozen |
| Direct NFT transfer | Allowed | Frozen | Frozen |
| Receiving customer payments | Allowed | Allowed | Allowed |
| Serving paid calls, paying compute | Allowed | Charter operator | Charter operator |
04Security model
A freeze alone does not protect a buyer.
A seller can get a transaction signed, keep it unbroadcast, sell the company, then broadcast it. Freezing signing at listing does not stop that, and neither does a mempool check. Incorpr closes it by tracking what each key has signed.
Pre-signed transaction rule
- 01Every raw signature increments raw_sigs_this_epoch before the MPC call is made.
- 02Listing or pledging panics while that counter is above zero, with ERR_RAW_SIGNATURES_THIS_EPOCH.
- 03rotate_treasury_epoch moves the company to new addresses and resets the counter. The seller moves funds across first.
- 04NAV counts only current-epoch addresses and the vault's intents.near balance, so counted assets sit on keys that have never signed a raw payload.
A signature that lands between the registry call and the vault freeze makes the listing fail. Marketplace sales through nft_transfer_payout meet the same check.
Agent firewall
The operator is treated as compromised. It sends structured fields and never bytes to sign. The vault checks them in this order and writes the signed payload itself.
- Caller is the operator; company is FREE
ERR_ACCOUNT_ENCUMBERED_AGENT_FROZEN - Tokens are on the shareholder's allow list
ERR_FIREWALL_BLOCKED_TOKEN - Withdrawal destination is the company's own address
ERR_FIREWALL_BLOCKED_UNWHITELISTED_DESTINATION - Per-token spend is inside the 24-hour cap
ERR_FIREWALL_EPOCH_CAP_EXCEEDED - Swap rate meets the shareholder's price floor
ERR_FIREWALL_PRICE_BELOW_FLOOR - Nonce has not been used
ERR_NONCE_USED - Attested model signed exactly APPROVE <hash>
ERR_TEE_NOT_APPROVED - Recovered signer is a trusted TEE key
ERR_TEE_SIGNATURE_UNTRUSTED
Who can do what
| Actor | Can | Cannot |
|---|---|---|
| Shareholder | Claim dividends and sign raw L1 payloads while FREE. Rotate the treasury epoch. | Sign, claim or change policy while listed, pledged or in transit. |
| Operator | Request vault-built intents inside policy, with a TEE approval. Pay compute to a fixed payee. Mark paid calls as served. | Supply bytes to sign, write the model prompt, choose a destination, or report revenue. |
| Registry | Update the vault's owner and encumbrance. | Sign anything on the vault's behalf. |
| Anyone | Trigger key setup, refresh metrics, read all state. | Choose which key is registered. The vault reads it from the signer. |
Known limits
- A compromised operator can resubmit a proposal until a nondeterministic model approves it, and a colluding solver can then fill at the minimum price. Loss per window is bounded by the epoch cap and price floor.
- A price floor is a shareholder-set lower bound, not an oracle. It goes stale when the market moves.
- 30-day revenue is not sybil-resistant. Only the current shareholder's own payments are excluded, so a seller's second account counts as a customer. Payer concentration is readable through payment_stats.
- TEE signers, models and the prompt hash are set by the shareholder. A buyer should compare them with the live attestation. None of them widen the set of allowed destinations.
- While a company is listed, the charter operator can still spend the compute reserve, only to the fixed compute payee.
05Built on
Four NEAR primitives, each doing a specific job.
NEAR sub-accounts
c-<id>.<registry>One contract per company, isolated state, zero access keys, no upgrade method.
Chain Signatures
v1.signerSecp256k1 for Bitcoin and EVM, Ed25519 for Solana and intents. The vault composes every derivation path.
NEAR Intents
intents.near, 1ClickTreasury swaps signed under a key only the vault can use, priced against live 1Click quotes. One swap settled on mainnet: 0.5 USDC to SOL.
NEAR AI Cloud
cloud-api.near.aiInference in Intel TDX and NVIDIA TEEs. The vault recovers the ECDSA signer with ecrecover before it acts on an approval.
06Build status
What runs today, and what does not yet.
This list is here so you do not have to work it out from the code.
07Open the registry
Incorporate one,or buy one outright.
Every company on the exchange shows its booked revenue, retained earnings, state and ask, read from its vault.
// the five calls a company passes through
>incorporate_company // incorporate
>ft_on_transfer // earn
>agent_swap_intent // compound
>accept_offer // finance
>list_company // sell