Security
We assume the agent will be compromised. That's why the contract, not the AI, is the authority.
Threat model
Threat, mitigation, residual risk
| Threat | Mitigation | Residual risk |
|---|---|---|
| Prompt injection | Contract enforcement, allowlists, schema-only agent input | Loss up to your limits |
| Agent key stolen | The key can only propose; limits, breaker and owner freeze | Loss up to limits before freeze |
| Spam of blocked proposals | Breaker freezes the agent; the agent pays gas | Owner must unfreeze after false trips |
| Rule-setup manipulation | Structured diff signed by the owner; tightening easy, loosening gated | A user could still sign a bad policy |
| Bad trades within limits | Not preventable | Loss stays bounded; no promise of a perfect AI |
| Frontend tampering | Safety doesn't depend on the UI; the contract enforces | User could be shown a misleading screen |
| Compromised owner wallet | Out of scope | Owner key is root |
- Prompt injection
Contract enforcement, allowlists, schema-only agent input
Residual: Loss up to your limits
- Agent key stolen
The key can only propose; limits, breaker and owner freeze
Residual: Loss up to limits before freeze
- Spam of blocked proposals
Breaker freezes the agent; the agent pays gas
Residual: Owner must unfreeze after false trips
- Rule-setup manipulation
Structured diff signed by the owner; tightening easy, loosening gated
Residual: A user could still sign a bad policy
- Bad trades within limits
Not preventable
Residual: Loss stays bounded; no promise of a perfect AI
- Frontend tampering
Safety doesn't depend on the UI; the contract enforces
Residual: User could be shown a misleading screen
- Compromised owner wallet
Out of scope
Residual: Owner key is root
Trust boundary
Who can do what
- Agent key
Untrusted. Can only call propose. Cannot change rules, approve, or withdraw.
- Vault contract
Trusted. Non-upgradeable. Decides every proposal and records it.
- Owner
Root. Withdraw and freeze are never blockable by the agent or the policy.
What we don't claim
Limitations
- We don't claim funds are safe. We claim loss is bounded by the limits you set.
- We don't prevent bad trades inside your limits.
- The contract is unaudited and runs on Fuji testnet only.
- The demo app runs on a simulated engine that mirrors the contract. The engine also models a max-%-of-vault cap, a fee cap and split over-limit reasons that the current contract does not have yet.
- Real x402 payments and real DEX swaps are not integrated. Both are simulated and labeled.
- Known contract edge cases: daily limits use a fixed UTC day (up to ~2x across midnight); an AVAX send to a reverting allowlisted contract reverts the whole proposal.