TESERASecurity
Tesera lets an AI read Elysium, simulate what a transaction will do and prepare it for you to sign. This page explains the layers that sit around that, what always stays under your control, and what to do if something looks wrong.
Your keys stay with you
The rule everything else is built on
Layers of protection
From the outside in, ending at your own signature
Rate limits
Every connection uses an access key, and each key has a limit on how many requests it can make in a given period. This stops a looping agent or a misconfigured client from flooding the gateway, and it slows down anything that goes wrong before the other layers come into play. You can see each key's usage in the console and revoke it there.
Logging
Every action the AI takes through Tesera is written to an action log in your console. It records which tool was called, what was asked, what was prepared and what was sent, so you can check exactly what the AI did on your behalf. You can export it at any time.
Simulation and preview
Before anything that changes state reaches you, Tesera runs it against live Elysium state. You get the result in plain words: whether it succeeds or the exact reason it would revert, which balances change, which events fire and what it costs in HYPE. If the simulation fails, nothing is offered for signing.
Agent key limits
An agent key is created in your own wallet, funded by you and bound to the limits you set: a cap per transaction and per day, the contracts it may call and the functions on each one. Any request outside those limits is refused, whatever the agent is asked to do.
Expiry
Each agent key has an expiry time that you choose when you create it, and it stops working on its own after that. You can also revoke it from your wallet or the console at any time before then.
Your own signature
By default Tesera only prepares unsigned transactions. Nothing is sent until you review the transaction and sign it in your own wallet. This is the innermost layer, and it applies whether or not you ever use an agent key.
Agent keys are optional. If you never create one, every transaction is signed by you in your own wallet.
If something looks wrong
Three steps, in this order
Revoke the key
If you gave an agent an agent key, revoke it in your wallet or the console straight away. It stops working immediately, and anything left in it stays yours. If you never created an agent key, nothing can be sent without your signature.
Check the log
Open the action log in your console to see which tools the AI called, what it prepared and what was sent. Compare it with the transactions for your address on the Elysium explorer.
Report it
Tell us what happened through the contact page. Include the time, your address and any transaction hashes, and never include a private key or seed phrase.
What these protections cover
The limits worth knowing
Reads need no wallet
Checking balances, blocks, contracts and docs needs no wallet. You can use Tesera for reading alone and never connect anything that can spend.
An AI can misread a request
The model in your client can get things wrong. Read each preview before you sign, and keep any agent key small and short-lived.
Confirmed transactions are final
Once a signed transaction is confirmed on Elysium, Tesera cannot reverse it or recover funds. The layers above exist to stop mistakes before that point.
Reporting a vulnerability
If you find a security issue in Tesera, please report it privately through the contact page and give us time to fix it before sharing details publicly.