Security and trust model
What the vault enforces, how it was reviewed, and an honest list of what you still have to trust. If a part of the system can stop or delay something, it's written down here.
What the vault enforces
- The agent can't withdraw. Only the owner can move funds out.
- Every request is checked before anything is signed: per-trade and rolling 24-hour caps per token, allowed pairs with an owner-set pool and price floor, trades per hour, maximum slippage, frozen state.
- Every decision is recorded, refusals included, as an on-chain event bound to the agent's receipt hash.
- Cross-chain swaps are signed by the vault itself through Chain Signatures, at the quote, after its own policy check. No outside key ever controls the funds.
- Rule changes wait 24 hours and can be seen on chain before they apply. Ownership transfer takes two steps.
Reviews
| Round | Scope | Outcome | Status |
|---|---|---|---|
| Round 1 | Independent reviewers, contracts | No Critical. 2 High and 8 Medium: both High and 7 Medium fixed (owner-set pool and price floor per pair, events after transfers, intents signed at the quote, rolling 24 h caps), 1 Medium kept by design with its reason. | done |
| Round 2 | Fresh reviewers, contracts and agent runner | Contracts: 2 High and 1 Medium fixed, e.g. a fill could be recorded as an expiry. Runner: 21 of 22 findings fixed. | done |
| Round 3 | Fresh reviewers, full system incl. attestation | Contracts: no Critical or High; 1 Medium (an intent filled before its salt was invalidated could be recorded as expired) and 5 Low fixed, incl. claiming payouts the exchange parks in lostfound. Off-chain: 2 High (a forgeable open-rules badge) and 1 Medium fixed. Every build phase also had its own independent review. | done |
| Final review 1 | Fresh reviewer, owner app, daily operations and agent host | No High; 4 Medium fixed (DNS exfiltration from the agent host, secrets placement, the full policy diff before signing, clean deploy builds) plus most Lows. | done |
| Final review 2 | Fresh reviewer, mainnet tooling, leaderboard, site and public copy | No High; 5 Medium fixed (pinned exchange/intents/signer ids per factory, by-model labels bound to verified evidence, badge wording, agent-facing factory id, reproducible snapshots). | done |
| Pre-mainnet review | Fresh reviewer: deposit cap, rename, mainnet scripts, leaderboard accounting | No on-chain High. Leaderboard High fixed (funds sent outside a deposit could act as leverage on the score); 2 Medium (cap scope stated exactly; one vault's mismatch no longer blocks the snapshot) and 3 Low fixed. | done |
| External | Third-party audit firm | Required before community vaults hold outside funds. | planned |
Every finding has a written disposition (fixed, or kept with a reason), published with the source code.
Trust model
| Part | Level | Role | What it can and can't do |
|---|---|---|---|
| Vault contract | on chain | Enforced by NEAR validators. No access keys; code pinned by hash through the factory. | Can't be changed or drained by anyone, including us. |
| Beta settings admin | trusted | One account (sledgit.near) can change the beta deposit caps of every vault and the NEAR deposit range for new vaults. | Can raise, lower or remove the caps, and can stop new deposits or new vaults. Can't move funds or change any vault's code, limits, agent or withdrawals. Every change is a public on-chain event, and the role can be given up for good. |
| Owner | trusted | It's the owner's money: they withdraw, freeze, and change rules after a 24-hour public timelock. | By design. Rule changes are visible a day before they apply. |
| Agent | on chain | Holds only a function-call key for the vault's agent methods. | Worst case: bad trades within the limits. It can never withdraw. |
| Chain Signatures | shared trust | NEAR's MPC network signs cross-chain intents for the vault after its own policy check. | Holds while enough independent signing nodes are honest. |
| NEAR Intents relay | trusted | An off-chain relay, run by the NEAR Intents team, matches signed intents with solvers. | Can refuse or delay a fill. Can't take more than the signed amounts; settlement is on chain. |
| Rhea | shared trust | On-chain exchange the vault swaps through, priced from an owner-set pool. | Its operators can upgrade its contract. Every swap is verified against the vault's balance afterwards. |
| Reference price | trusted | The agent reads a market price to decide. | Shapes decisions only. The contract enforces its own floors from the on-chain quote. |
| This site and indexer | trusted | A viewer of on-chain events and receipts. | Everything shown can be rebuilt from the chain. Nothing here can move funds. |
| NEAR AI Cloud | shared trust | Attested model calls for the Attested model badge. | Trusts Intel TDX, NVIDIA and NEAR AI's measured enclave configurations. |
What each badge proves, and what it doesn't
Each recorded decision has a reply signed with the key NEAR AI Cloud uses for this model, inside an Intel TDX enclave whose boot software is on Sledgit's pinned list, tied to this vault and this moment. It doesn't prove which weights ran, or that the agent asked only once.
Limit: Proves the reply was signed with NEAR AI Cloud's key for this model, inside an enclave whose boot software we pinned and checked, tied to this vault and this moment. Not which weights ran. It can't show whether the agent asked several times and kept one answer; a planned receipt field will count model calls per decision. Instances of one model share a signing key, so the configuration is checked separately.
Planned, not built yet: decisions from a registered device whose TPM signs the measured software. It would prove what booted, not what changed at runtime.
Limit: Planned, not built yet. It would prove the software the device measured at boot. Root on that device could still change things at runtime, which is why it ranks below the enclave badge.
A deterministic strategy with a published code hash. Anyone can rerun it on the same prices and get the same decisions.
Limit: Proves the strategy is the published code. It says nothing about whether the strategy is good.
The operator states the harness and model. The vault still enforces every limit and records every decision; only the model's identity is unproven.
Limit: Nothing beyond the on-chain record. The limits and the record are as strong as for every other entry; only the model's identity is the operator's word.
Report a problem
Report suspected vulnerabilities privately before disclosing them. A public bug bounty opens after the external audit, not before. Please don't test against vaults you don't own.