Conversation
…only record Closes the on-chain enforcement holes from the security review: - No unchecked exit (A#1): remove public vault_spend (agent could draw a raw coin and transfer to self, bypassing the recipient allowlist). Spends now go through either vault_transfer (recipient-enforced) or vault_borrow -> a FlashSpend hot-potato (no abilities) that MUST be settled via vault_settle, depositing the resulting asset back into a same-policy vault. Funds can't be pocketed; the recipient allowlist is now meaningful (no raw path around it). - Real blast-radius bound (A#3, A#5): rolling per-window spend budget (window_ms/window_budget) so one PTB can't loop spends up to the lifetime budget; the window resets when elapsed. - Honest accounting (A#6): record_action is now audit-only (&AgentPolicy, no budget charge) so a bare log entry can't exhaust the budget. - Multi-asset ready (for Wormhole deposits): vault_settle<U> lets the returned asset differ from what was borrowed; Vault<T> stays generic. 40 Move tests pass (incl. hot-potato settle, foreign-settle rejection, and rolling-window burst/reset). Build clean. NOTE: mainnet redeploy + off-chain tx-builder rewrite are the follow-up; a professional audit remains a hard gate before real funds.
…aults + docs Make the contract stable/complete so downstream stacks consume it without further churn: - open<T> is now owner-cap-gated (was unauthenticated): only the policy owner can add ADDITIONAL asset vaults (Vault<USDC> alongside Vault<SUI> for bridged deposits). new<T> is key-only so no external code can share a vault around this. - Module docs rewritten to describe the final design: generic multi-asset Vault<T>, the two authorized exits (vault_transfer + vault_borrow/settle hot-potato), and the rolling-window + lifetime budget model. 42 Move tests pass; build clean.
…n DeFi outputs
Model B completion. Native staking (→ StakedSui) and lending supply (→ an
account position) return NON-coin outputs, so they can't use vault_borrow/settle
(which requires a Coin to return). vault_spend_capped hands the agent a raw coin
for these, but:
- requires a NAMED protocol (aborts on the no-protocol sentinel) → stays gated
by the protocol allowlist; it can't be used as a generic drain;
- is the ONLY path with standing exposure, deliberately bounded by the rolling
per-window budget (a compromised agent can misdirect at most one window's
worth). Sends still use vault_transfer (recipient-checked), swaps use
vault_borrow/settle (funds return — zero standing exposure).
44 Move tests pass; build clean. Contract now covers sends, swaps, staking,
lending + bridged multi-asset deposits — no further contract change needed.
Fresh mainnet publish of the reworked non-custodial contract (the rework is breaking, so it can't be an on-chain upgrade of the old 0x1925… package). Record the new published-at/original-id/upgrade-cap in Published.toml, and rewrite the README for model-B: the three bounded spend exits (vault_transfer / vault_borrow+settle / vault_spend_capped), the rolling-window blast-radius bound, and the deprecation of the old unchecked-vault_spend package. publish tx: 9NwFHsn1w2K6jBUKC1UjXf5uupTd6w2Rkx38cmR3nZCJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ships the reworked model-B contract to Sui mainnet and documents it.
0x8b2412e9a5d931cafa533d29daf8c91edacda28d6a689cbdecacf2a092380e14(fresh publish — the breaking rework can't be an on-chain upgrade).0x1925bced…(uncheckedvault_spend); old-vault funds stay owner-recoverable viaowner_withdraw.Contents
vault.move/policy.move: no unchecked exit — three bounded exits (vault_transfer,vault_borrow/vault_settlehot-potato,vault_spend_capped), rolling-window blast-radius bound, owner-gated multi-asset vaults.Published.toml: new mainnet record.README.md: rewritten for model-B.publish tx
9NwFHsn1w2K6jBUKC1UjXf5uupTd6w2Rkx38cmR3nZCJ