zoldhq.com · shareme.lol · zoldenburg.com · kontakt@zoldenburg.com
Nothing moves without your yes. Zoldenburg builds money that moves only on approval. A person approves each of their own transfers, and nobody else can: not a scammer, not an app employee, not us. In a company, no one person can say yes alone. An agent pays only within the limits its owner set.
That is the story. The technology is the receipt: passkeys, Safe smart accounts, Monerium's euro e-money on Base, and x402 for agents. Our servers prepare payments, relay them and keep the books. None of them holds a key that can move the money.
Zoldenburg UG is based in München. The org has repositories in four fields: fintech, crypto, AI agents and DAO governance. Four products share one architecture.
| Product | What it owns | What it leaves to the others | |
|---|---|---|---|
| 01 | Zold app The euro account you own |
Users, passkeys, each user's passkey-owned Safe, the Monerium euro IBAN, the books and auto-convert | Merchant checkout, agent-payment settlement |
| 02 | Zold Pay Checkout |
Merchants get paid, in stablecoins too, into their bank account without touching crypto | Safes and keys: it asks the Zold app |
| 03 | Agentpay hub Agent payments · private |
x402 v2 and MPP protocol code, the buyer router and its MCP server, @zold/accept seller middleware, hosted settlement |
Merchant onboarding, the books, off-ramping |
| 04 | shareme.lol Agent tools |
An MCP server on the agent's machine and an HTTP host that turns files into expiring links: free for 7 days, paid options beyond | Payment logic: it charges through the hub |
How an agent pays. The agent's wallet signs an EIP-3009 authorization for the exact price, with a spend cap per call and per day. The hub relays transferWithAuthorization, and the USDC goes straight to the merchant's own Safe. Zold pays the relay gas and never holds the funds. The Zold app's books then convert it to EURe per invoice, and Monerium redeems it to the merchant's bank by SEPA.
 |
 |
 |
 |
| Repository | What it is | Stack |
|---|---|---|
| Zold-app | The euro account you own. Each transfer is approved with your face or fingerprint, for that exact amount and recipient. For companies, one person prepares and another approves, and the accountant gets the books, not the keys. Under the hood: a euro IBAN through Monerium, EURe in a passkey-owned Safe on Base, SEPA payouts, USDC ⇄ EURe, payment links and invoicing | TypeScript · Express · Solidity |
| zold-pay | Pay with Zold: the hosted checkout and the merchant OAuth / PKCE handoff. It owns merchants and payment intents; users, keys and balances stay in the Zold app | TypeScript |
| zold | The cross-border reference implementation: SEPA in, EURe in the user's Safe, out as SEPA or MoneyGram cash pickup via CCTP and Stellar | TypeScript · Hardhat |
| sevdesk-monerium | Mirrors a Monerium account's settled orders and on-chain EURe transfers into sevDesk as bank transactions. Read-only on Monerium and the chain; it never books anything itself | TypeScript |
| zold-docs private | User documentation for the Zold app | JavaScript |
| payzold-test private | Test sandbox |
| Repository | What it is | Stack |
|---|---|---|
| Agentic-payment-protocol private | Agentpay hub. One interface for agent payment protocols: point an agent at a paid URL and it detects x402 or MPP, checks the spend policy, pays the cheapest quote and returns the content with a receipt. Also an MCP server and the @zold/accept seller middleware |
TypeScript · viem |
| shareme.lol | share-me. Agents turn local files into expiring, unguessable links (share_file, list_links, extend_link, revoke_link). Longer retention is paid with x402 v2. Works with Claude Code, Codex, Cursor and Claude Desktop |
TypeScript · Akash · Cloudflare |
| zSkills | Agent skills in the SKILL.md format: repo-leak-scan, onchain-review, skill-router, gdpr-compliance, security-fix |
Python |
| Repository | What it is | Stack |
|---|---|---|
| Zogas private | A private gas paymaster. A fresh ERC-4337 account proves in zero knowledge that it owns an unspent deposit, and its gas is paid with no on-chain link to the wallet that funded it. Gas only, no withdrawals, no owner | Solidity · Noir · Foundry |
| totp-guardian private | A recovery guardian for Safes on Candide's SocialRecoveryModule. It confirms a recovery when someone proves they hold the owner's authenticator app, and nobody holds the authenticator secret | Solidity · Hardhat |
| Repository | What it is | Stack |
|---|---|---|
| Safe-MCP | An MCP server that lets agents read DAO proposals and vote as a Safe, off-chain on Snapshot (EIP-1271) and on-chain through OpenZeppelin or Compound-style Governors. It can run on demand or unattended | TypeScript |
| Gov-hub | Governance tooling for DAOplomats: the dao-proposal-writer skill, which drafts proposals in each DAO's own template and checks on-chain facts before writing |
Python |
Plus zoldenburgCom (the company website, private) and .github (this profile).
We label what has not run on real money. A line goes live only when the product does what it says.
| Runs today | Not yet | |
|---|---|---|
| Zold app | Sandbox at zoldhq.com on Base Sepolia: euro IBAN, SEPA payouts, USDC ⇄ EURe, payment pages, invoicing, books | No mainnet deployment. Never run on real money. Cash pickup is closed |
| Zold Pay | Checkout for existing Zold users, tested offline and against a local core | WebAuthn ceremonies and a real SEPA payment are not yet verified |
| Agentpay hub | x402 v2 buyer: one $0.01 test-USDC payment settled on Base Sepolia. Seller settlement is tested against scripted chains | Never run on mainnet. The MPP signer is a mock |
| shareme.lol | File host and MCP server, with paid retention over x402 v2 | The MCP payment flow is moving to the x402 MCP transport |
The promise covers transfers. Two other parties have a role, and we name them.
- Recovery, if you turn it on. Zoldenburg can move your account to a new phone after checking that it's you. It can never send money, and your old phone can cancel during the waiting period.
- Monerium, which issues your euros, can freeze them where the law requires.
- The card is a Gnosis Pay card with its own account. Card taps don't ask for your face or fingerprint, so the "only you" promise doesn't extend to it.
Yours, even without us, on one condition. Add a backup key you keep yourself, such as a hardware wallet, and you can reach your money with free, open tools even if Zold is gone. Without one, your face or fingerprint login works only on zoldhq.com, so the backup key is what lets the account outlive us.
- Nothing moves without your yes. A server may prepare a transfer, but it never holds a key that can approve or block one. That includes ours.
- Every payment leg is visible. Operators can see what moved, where it went and why it failed, without guessing.
- Failures are explicit states. A payment that fails becomes a named state with a reason, never a silent gap.
- Fail closed. When live credentials or compliance requirements are missing, real-world rails refuse to run. They never fall back to something weaker.
- Spend limits for agents. Agents pay from small, dedicated wallets with per-call and per-day caps. Payments are bound to the exact URL and amount.
- No rate, no asterisk. We don't lend customer euros out, so there is no yield to advertise and none to quietly cut. Fees are shown before you approve.
- Copy follows the product. A claim goes on a page only when the product already does it. Public demos never rely on production secrets or fake-money switches.
Focused contributions that make these systems safer and clearer are welcome.
- Keep changes small and reviewable. One concern per pull request.
- Test the money paths. Include tests for any change to money movement, KYC, custody, auth, recovery or payout state.
- No hidden custody. Do not introduce API-held user keys or custody paths.
- Report issues precisely: steps to reproduce, expected and actual results, and which area the issue touches (onboarding, KYC, funding, transfers, payouts, receipts or agent payments).
- Treat operational data as sensitive. IBANs, wallet addresses, payout references and transaction trails stay out of public issues.
Please report suspected vulnerabilities privately to kontakt@zoldenburg.com, not in a public issue.
We especially want to hear about:
- unauthorized Safe debits, or payments signed for terms the user did not see;
- bypasses of KYC, operator authorization or agent spend limits;
- replayable passkey, payout or EIP-3009 signatures;
- double-spend, double-payout, double-settlement or unsafe refund paths;
- leaked secrets, API tokens or operator credentials;
- privacy leaks in receipts, admin views, payment pages or shared links.
Include the affected repository and commit, steps to reproduce, and whether funds, KYC data or user privacy could be affected.
