Metraipolis › archive › dc_eb4e59829cb0

Proof-Gated Signing: Solver-Checked Transaction Guards that Hold Under State Drift for Onchain AI Agents — arXiv:2610.00354

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.00354
License (as archived): CC0-1.0
Archived: 2026-10-06T12:08:51.415Z
SHA-256 of the archived text: 5511a5db01e1c0ed65076e19c313bb3128e227963b1919073d22c712863e44a4
Stable URL of this page: https://metraipolis.com/documento/dc_eb4e59829cb0

How to cite

Proof-Gated Signing: Solver-Checked Transaction Guards that Hold Under State Drift for Onchain AI Agents — arXiv:2610.00354 — arXiv (en), https://arxiv.org/abs/2610.00354 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_eb4e59829cb0 (Metraipolis archive dc_eb4e59829cb0, sha256 5511a5db01e1c0ed65076e19c313bb3128e227963b1919073d22c712863e44a4)

BibTeX

@misc{dceb4e59829cb0,
  title = {Proof-Gated Signing: Solver-Checked Transaction Guards that Hold Under State Drift for Onchain AI Agents — arXiv:2610.00354},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.00354},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_eb4e59829cb0; sha256 5511a5db01e1c0ed65076e19c313bb3128e227963b1919073d22c712863e44a4},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.00354. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

AI agents that control wallets read attacker-reachable content, so they can be steered into proposing harmful transactions. The usual last line of defense is a pre-signing check: a static allowlist, an LLM reviewer, or a transaction simulation. All three share a gap: the check describes the chain state at check time, but the transaction executes in a later state that an adversary can shape through front-running, contract upgrades or token-parameter changes. We call this state drift. We present Proof-Gated Signing (PGS), which simulates a proposed transaction, extracts its effects, and uses an SMT solver to check a declarative value-and-permission policy for every price in an oracle-uncertainty band. It then compiles on-chain post-conditions (wallet balance bounds, payee receipts, allowance caps and ownership) and proves that every execution satisfying them also satisfies the policy. The agent's smart-contract wallet enforces them atomically, so the guarantee applies to the executed transaction under arbitrary drift. On an open testbed of 260 scenarios (14 attack families including five drift and two adaptive families, and 12 benign families), with harm measured from attacker balances rather than from any policy, PGS prevented 93.6% of the 140 harmful scenarios and passed 97.5% of the benign ones. Simulation-only checking prevented 57.9% and a static allowlist 71.4%. None of the 50 drift scenarios produced attacker gain under PGS. The only unprevented family, an in-policy drain, was bounded by the per-session budget. We also find that giving an LLM reviewer a clean pre-drift simulation made it more likely to approve a drift attack. Overhead is about 41k gas and 0.1-0.2 s per check.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-10-02 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Computational Engineering, Finance, and Science (cs.CE).
Pagina del lavoro: https://arxiv.org/abs/2610.00354 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-06T10:21:28.050Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-10-02?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).