Agent security on NEAR
A prompt-injected agent will try to pay the wrong account. With Sentraio, the money stays where it is.
Rules on-chain · Reasons in plain words · Allow signs · Warn asks a human · Block refuses · Panic in one click
01 — At a glance
Measured in the sandbox, not estimated: every number comes from the test suite or a worst-case run.
Gas per action · 0.0001 NEAR per Tgas
9
independent checks per payment
62
unit tests across contracts and packages
0
NEAR lost to the injected invoice
16%
of the 300 Tgas limit in the worst case
02 — Three layers
Each layer works on its own; together the agent can only ask, never take.
01
Who is being paid, and what will really happen?
Checks the receiver and the token before anything is signed, then simulates the payment on real contract code with real balances in a sandbox.
Look-alike names / Registry / Code changes / Simulation
Try Clearance →02
The mandate the agent cannot step outside of.
On-chain limits per transaction and per day, single-use Clearance signatures, strikes that auto-freeze, and a constant-gas panic switch. Native NEAR included.
Limits / Approvals / Auto-freeze / Panic
Open the vault →03
Success on top, failure inside? It tells you.
Reads every receipt of any NEAR transaction, explains each failure with a fix, and shows where the funds actually are now.
Receipt tree / Fix hints / Funds now / Testnet + mainnet
Explain a transaction →03 — How a payment flows
01
The LLM decides to pay. It holds only a function-call key for vault.execute.
02
Nine signals, worst wins. Allow signs, warn waits for the owner, block refuses.
03
Limits, receiver rules and a valid, unused signature, or nothing moves.
04
Every outcome comes back as a plain-language report with the funds trail.
Block. Clearance never signs; the guard refuses.
Warn. The owner decides with a wallet signature; the agent cannot approve itself.
Bypass. The vault rejects calls without a valid, unused signature.
04 — The attack, replayed
Run it yourself with pnpm demo:attack: local sandbox, no keys, no funds.
05 — Built on NEAR
near-sdk (Rust)
Vault and registry contracts, pinned to build for mainnet protocol 86.
near-workspaces sandbox
Clearance simulation and every end-to-end test.
NEP-141 / NEP-297
Token transfers and event logs that the vault and Tx X-Ray speak.
NEP-413
Owner approvals are signed messages from a full-access key.
Function-call keys
The agent key: one contract, one method, gas-only allowance.
NearBlocks API
Receiver age and activity signals.
FastNEAR RPC
Regular and archival nodes, so Tx X-Ray also reads old transactions.
Agent API
Spending policy for agents. Sentraio covers what it does not: counterparties, simulation, native methods.
06 — Run it
Real contracts and real token code in a local NEAR sandbox, with fake money.
pnpm install pnpm demo:attack # the five situations above pnpm dev:chain # sandbox for the dashboard pnpm --filter @sentraio/web dev # http://localhost:3000
07 — Honest limits
08 — Questions
The Agent API caps spending and can freeze an agent, but its policy does not protect native methods and it does not ask who is being paid. Sentraio adds the counterparty check, simulation, a vault that covers native transfers, and the failure explainer. Use both.
The agent can still only ask. Clearance blocks look-alike or reported receivers, and the vault refuses any call without a valid, unused Clearance signature. The agent’s key cannot transfer NEAR or add keys.
No. Answering a warn needs a fresh NEP-413 signature from a full-access key of the vault owner, checked on chain, single-use and valid for five minutes. The agent has no such key.
An attacker could sign approvals, but only inside the owner’s mandate: limits and receiver rules are enforced by the contract. The owner rotates the guardian or hits Panic.
The vault puts the amount back into its ledger and the daily budget. Tx X-Ray shows the failed receipt, the refund and where the funds are. Untracked tokens can be recovered with sync_balance.
Every caller pays their own gas and cannot grow the vault’s state. Loops are bounded (10 tokens, 50 receivers), and Panic costs the same however many agents exist.