AI 代理安全
PACE Binds AI Agent Transaction Approvals to Onchain Bytes, Cutting the Unsafe Execution Rate From 0.80 to Zero in Sandbox Tests
PACE does not ask language models to determine whether transactions are safe. Instead, it uses deterministic rules to check transaction intent, simulation results, and actual calldata. A smart account revalidates the signed policy decision record before execution, though the zero-failure result so far comes only from a simplified DeFi sandbox.
The newly proposed [Policy-Attested Contract Execution (PACE)](https://arxiv.org/abs/2608.17220) treats DeFi agents as untrusted proposers: an LLM may plan swaps, loans, or token approvals, but it cannot directly decide whether a transaction should be submitted. The goal is to prevent prompt injection, malicious contracts, or agents from replacing calldata after simulation, shifting protection from probabilistic safeguards at the model layer to deterministic authorization at the transaction layer.
The agent first produces a typed `TransactionIntent` containing fields such as the chain ID, sender and recipient addresses, ETH value, function selector, calldata, token approvals, and slippage. After an offchain simulator generates an execution result, a stateless verifier applies the user’s policies to check address and function allowlists, spending limits, unlimited approvals, slippage, health factor, simulation freshness, and the contracts actually touched. The approval result is packaged as a signed Policy Decision Record (PDR) bound to hashes of the intent, policy, simulation, and calldata.
Before making an external call, the onchain Solidity smart account revalidates the signer, chain ID, account, target, value, calldata hash, nonce, and expiration time. This uses [ERC-4337](https://eips.ethereum.org/EIPS/eip-4337), which allows smart accounts to define custom validation logic. As a result, even a fully prompt-injected agent can submit only bytes that comply with the predefined policy.
The authors ran 2,800 tests across seven protection configurations, 40 tasks, and ten seeds. The unprotected baseline had an unsafe execution rate of 0.80; full PACE achieved zero in the sandbox, with a false-block rate of zero for benign tasks. Ablation experiments showed that relaxing the policy increased the unsafe execution rate by 57.5 percentage points, while removing the touched-contract allowlist increased it by 12.5 points. Onchain PDR validation added 29,826 to 31,822 gas.
This is not yet proof that the system can safely custody funds. The main experiments used a regex-based mock LLM and an in-memory DeFi simulator, and the code artifact will not be released until the paper is accepted. A PDR guarantees only that the approved bytes match the executed bytes; it cannot guarantee that onchain state, prices, or upgradeable contracts remain unchanged after simulation. The policy, verifier, simulator, and signing key also remain within the trusted computing base. The next step should be to rerun the evaluation with real ABIs, proxy contracts, non-standard tokens, state drift, and adaptive attacks.