A chatbot returns text. An economic agent returns a signed transaction. The distance between those two is not a better prompt…

Description and use

AI‑agent demos that give the LLM a private key risk prompt‑injection attacks. A three‑layer design—LLM proposer, policy contract, and executor—ensures safe, reactive USDC transfers on Base with low fees.

Problem

Demonstrations of AI agents controlling crypto wallets often give the LLM a private key and ask it to move funds, leading to prompt injection attacks that drain the treasury. The challenge is to design a safe, reactive agent that can execute token transfers on Base while preventing misuse.

Outcome

The architecture prevents prompt injection by isolating the LLM from the private key, enforcing strict intent parsing, simulating before signing, and using a policy contract to enforce limits. This yields a reactive, low‑cost autonomous agent on Base.

Workflow

• 1. LLM receives a natural‑language request and outputs a strict JSON intent (action, token, to, amount_usdc, memo).
• 2. The system parses the JSON, rejecting unknown keys, validating checksum and allowlist for "to", and ensuring amount is a Decimal with ≤6 places.
• 3. The executor simulates the transaction using Web3.py and the USDC contract ABI to confirm success before signing.
• 4. If simulation passes, the executor signs the transaction with the treasury key, broadcasts it, and retries on failure.
• 5. The policy contract on Base enforces spend limits, allowlists, and rate limits via a session key.
• 6. The treasury address (0x92Aff59709b03b9373b8fA887D24953D60fAd919) never exposes its private key to the LLM.
• 7. The system logs the signed transaction and updates state accordingly.

Evidence

Most "AI agent + crypto" demos skip that. They hand an LLM a private key, ask it to move USDC, and call the result autonomy.

Source

Empirically over the past few months, ERC-20 transfers on Base typically land between 0.001 and 0.05 gwei base fee + L1 data fee; call it $0.0004–$0.004 per transfer at current ETH prices.

Source

Three layers: 1) Proposer — the LLM. Untrusted. Outputs an intent JSON, nothing else. 2) Policy — a contract on Base with a session key. Holds the actual spend limits, allowlist, rate limits. 3) Executor — a dumb Python process. Signs, simulates, broadcasts, retries.

Source

Parse it strictly. Reject unknown keys. to must be checksummed and in the allowlist. Amount must be a Decimal with ≤ 6 places.

Source

python from web3 import Web3 from eth_account import Account from decimal import Decimal w3 = Web3(Web3.HTTPProvider("https://mainnet.base.org"))

Source