Repository navigation
Glossary
Terms used throughout the Wardex documentation.
Wardex's system for automatically scaling security posture based on the USD value at risk. Four tiers: Audit (< $1), Co-pilot ($1-$100), Guardian ($100-$10K), Fortress (> $10K). See Security Tiers.
A list of trusted addresses, contracts, and protocol identifiers. Items on the allowlist receive a lower risk score but are still evaluated through the full pipeline.
An ERC-20 approve(spender, amount) call that grants a contract permission to spend tokens on your behalf. Infinite approvals (type(uint256).max) are a major attack vector — Wardex blocks them by default.
A record of a single security evaluation, including the transaction, verdict, risk scores, and reasons. Stored in the audit trail. See Audit & Compliance.
The chronological record of all security evaluations performed by a Wardex instance. Retains the last 10,000 entries in memory. Can be exported via callbacks.
Automatic emergency halt triggered when 5 or more transactions are blocked within the last 10 evaluations. Indicates a possible active attack. Requires human intervention to resume.
Middleware stage (#6) that compares a transaction against the agent's behavioral baseline. Detects anomalies in value, frequency, timing, and contract interaction patterns.
A verdict where Wardex prevents a transaction from proceeding. The agent should not sign or submit the transaction.
A constraint attached to a MetaMask delegation. Each caveat specifies an enforcer contract and ABI-encoded terms that define the constraint (e.g., "only call these contracts" or "max 1 ETH per transaction").
A smart contract in the MetaMask Delegation Framework that verifies a specific constraint on-chain. Examples: AllowedTargetsEnforcer, ValueLteEnforcer, TimestampEnforcer.
The weighted combination of context, transaction, and behavioral risk scores, ranging from 0 (safe) to 100 (dangerous). Produced by the risk aggregator middleware.
Middleware stage (#1) that scans conversation context for prompt injection patterns, jailbreak attempts, urgency manipulation, and cross-MCP attacks.
Middleware stage (#5) that analyzes contract bytecode for dangerous patterns: SELFDESTRUCT, DELEGATECALL, CALLCODE, proxy patterns, and honeypot indicators.
An EIP-712 signed authorization that grants scoped authority from a delegator (owner) to a delegate (agent). Backed by on-chain enforcer contracts. See Delegation Framework Guide.
Wardex class that creates, validates, and manages MetaMask Delegation Framework delegations. Mirrors the SessionManager API.
A list of known-malicious addresses. Transactions to denylisted addresses are blocked at Guardian tier and above.
Ethereum Improvement Proposal for typed structured data hashing and signing. Used by the MetaMask Delegation Framework for delegation signatures.
Standard for smart contract accounts that support programmable validation logic. Wardex's WardexValidationModule hooks into ERC-4337 to enforce on-chain spending limits.
Standard for scoped wallet permission systems. Session keys allow an agent to transact within boundaries (contracts, value limits, time) without the owner's full key.
The process of passing a transaction through the Wardex middleware pipeline to produce a security verdict. Each evaluation generates an audit entry.
A unique UUID assigned to every evaluation. Used for audit trail correlation and incident investigation.
The highest security tier (> $10K). Always blocks transactions, requires human approval, enforces a 15-minute time-lock, and records on-chain proofs.
A verdict where ALL operations are halted. Can be triggered automatically (auto-freeze) or manually (wardex.freeze()). Requires wardex.unfreeze() to resume.
Security tier for $100-$10K transactions. Blocks transactions with composite risk score above 70. Notifies the operator.
A cryptographic token generated by Wardex when a transaction is approved. The isolated signer verifies this token before signing. Prevents unauthorized signing.
A malicious contract designed to appear legitimate but contains hidden mechanisms (SELFDESTRUCT, fee extraction, approval traps) that steal funds.
A token approval where the amount is type(uint256).max or close to it (>= 2^128). Grants unlimited spending permission to a contract — dangerous because a compromised contract can drain all tokens.
A separate process (or TEE, or MPC network) that holds private key material. The AI agent communicates with it over Unix socket IPC but can never access the key directly.
The architectural principle that the AI model NEVER has access to private keys. Keys live in a separate process (SignerServer) and can only be used to sign transactions that have a valid Wardex approval token.
Anthropic's protocol for connecting AI models to external tools. Wardex's MCP server exposes security evaluation as MCP tools.
An async function in the Wardex pipeline that receives a shared context and a next() function. Each middleware stage enriches the context with security findings. See Custom Middleware.
The shared state object passed through the pipeline. Contains the transaction, decoded data, risk scores, reasons, reputation data, and the active policy.
A mandatory pipeline that scans all text output for sensitive data (private keys, seed phrases, mnemonics) and redacts them. Cannot be bypassed.
The 9-stage middleware chain that every transaction passes through: contextAnalyzer, transactionDecoder, valueAssessor, addressChecker, contractChecker, behavioralComparator, [custom], riskAggregator, policyEngine.
Middleware stage (#9) that applies security tier rules to the accumulated risk scores and reasons to produce the final verdict.
An attack where malicious instructions are embedded in content that an AI agent processes (tool outputs, conversation, web pages). Wardex's context analyzer detects 10+ injection patterns.
A cryptographic hash of an evaluation, included in Fortress-tier verdicts. Can be submitted on-chain for tamper-proof audit evidence.
Middleware stage (#8) that combines context, transaction, and behavioral risk scores into a weighted composite score (0-100).
A numerical assessment (0-100) of threat level in three dimensions: context (prompt injection likelihood), transaction (on-chain threat signals), and behavioral (deviation from baseline). Higher = more dangerous.
A specific finding from the evaluation pipeline. Contains a code (e.g., PROMPT_INJECTION), human-readable message, severity level, and source middleware.
The output of every Wardex evaluation. Contains the decision (approve/advise/block/freeze), risk scores, reasons, suggestions, and audit metadata.
A temporary, scoped cryptographic key that allows an agent to transact within boundaries. Managed by SessionManager. See Session Keys Guide.
Wardex class that creates, validates, and manages ERC-7715 session keys with enforced boundaries (allowed contracts, value limits, daily volume, expiration).
The main WardexShield object returned by createWardex(). Orchestrates the pipeline, maintains state, and provides the evaluation API.
An ERC-4337 smart contract wallet that supports programmable transaction validation. Wardex's WardexValidationModule can be installed as a validation module.
A delegation option that adds an AllowedMethodsEnforcer to block approve and setApprovalForAll function selectors at the smart contract level, not just off-chain.
Middleware stage (#2) that decodes calldata into function names and parameters. Identifies approvals, transfers, and ETH value.
A classification assigned to instruction sources: high (direct user), medium (known MCP server), low (unknown tool), untrusted. Lower trust levels increase risk scoring.
Middleware stage (#3) that estimates the USD value at risk and determines which security tier to apply.
A Solidity smart contract (ERC-4337 compatible) that enforces spending limits, approval token verification, and emergency freeze on-chain. Deployed via Foundry.
Getting Started
Concepts
Guides
- Guide: Protect an Ethers Agent
- Guide: Protect a Viem Agent
- Guide: Session Keys
- Guide: Delegation Framework
- Guide: MCP Server
- Guide: Claude Code Skill
- Guide: Custom Middleware
- Guide: Custom Policies
- Guide: Contract Deployment
API Reference
Security