▄▄▄▄▄ ▄ ▄ ▄ ▄ ▄▄▄▄▄ ▄▄▄ ▄ ▄ ▄▄▄ ▄ █ █ █ ██ █ █ █ █ █ █ █ █ █ ▀▀▀▀█ █▄▄▄█ █ █ █ █ █▄▄▄█ █ █▄▄▄█ █ ▄▄▄▄▀ █ █ ██ █ █ █ █ █ █ █ █
AI trading under mathematical constraints.
The AI thinks. The protocol executes safely.
Language models are excellent analysts and terrible custodians. They hallucinate, they can be steered by injected text, and they read data an attacker can shape. Give one a signing key and the failure mode is binary: the day it is fooled, the wallet empties.
The usual mitigation is a sentence in a prompt — "never buy unlisted tokens". That is not a control. It is a request addressed to the exact component assumed to be under attack.
Syntax does not ask the AI to be trustworthy. It assumes the AI will eventually be compromised, and makes that survivable.
Runs inside beforeSwap. Verifies the agent's EIP-712 signature against the
owner's policy and reverts on any failing clause. Refuses every caller except the router.
Has no recipient parameter. The output is taken to intent.owner, in code,
with no branch that does otherwise.
Why two contracts and not one: beforeSwap never sees the recipient. v4 settles
balances after hooks run, and whoever unlocked the manager decides where tokens land. A hook
alone cannot promise funds return to the owner — so the hook refuses any caller whose
settlement path it does not control, and that caller is the router.
Any single failure reverts the whole transaction. There is no partial execution.