-
-
ChainBreak-Web3 is a deterministic pre-signing firewall that interposes directly between autonomous AI agents and EVM wallet signing.
-
Baseline vs Protected
-
“Same Agent. Same Attack. ChainBreak Decides What Gets Executed.”
Inspiration
Every time I read about an AI agent misbehaving — sending the wrong funds, exposing private data, or getting hijacked mid-execution — I noticed the same pattern: each individual action looked legitimate in isolation. The problem only becomes visible when you step back and look at the sequence.
The wake-up call was a thought experiment. An AI crypto-payment agent with a $100 session budget. A single transaction for $40: fine. A second for $50: fine. A third for $30: blocked... by what exactly? Most agent frameworks inspect transactions one at a time and approve each one. No system was watching the cumulative trajectory.
That's the gap. Not "is this one transaction okay?" but "has the agent's evolving behavior crossed a forbidden boundary?"
I built ChainBreak to answer that question definitively — and to prove the answer, not just claim it.
What it does
ChainBreak is a deterministic pre-signing firewall that sits between an autonomous AI agent and an EVM blockchain signer. It intercepts every transaction proposal before a private key is ever touched and evaluates it against a set of mathematical security invariants — stopping attacks that no traditional per-transaction wallet check can catch.
The three attack classes it defeats:
🧩 Intent Drift (Recipient Mutation): An agent instructed to pay Alice tries to transfer funds to Mallory — a classic address-substitution attack via prompt injection. ChainBreak catches this before signing by comparing the decoded recipient against the locked IntentEnvelope.
📊 Trajectory Budget Drains (Micro-Step Attacks): An attacker fragments a $150 drain into three $40, $50, and $30 transactions — each individually below the per-transaction cap. ChainBreak maintains a stateful cumulative spend ledger across the entire session and blocks the third transaction when it would breach the $100 session budget.
🔀 Capability Boundary Violations: Unauthorized chain hops (Sepolia → Mainnet), disallowed token contracts, method mutations (approve vs transfer exploitation). ChainBreak whitelist-validates every dimension of every proposal.
How the verdict is delivered:
Every decision is one of three outputs:
✅ ALLOW — all invariants pass, signing proceeds 🚫 BLOCK — invariant violated, signing is structurally unreachable, tx_hash = null ⏸️ HOLD — calldata is malformed or undecodable; fail-closed, no broadcast The Dual-Track Counterfactual Proof Engine makes this concrete for judges, auditors, and developers: it runs the identical attack scenario twice — once unprotected, once through ChainBreak — and shows exactly which step diverged, the state hash delta, and the financial loss prevented.
The cockpit UI shows this live: a cyberpunk dashboard with a 15-scenario adversarial benchmark grid, real-time dual-track timeline, cryptographic decision receipts (SHA-256 proposal hash + before/after state hashes), and an embedded AI explainer bot.
How I built it
The core architecture principle: AI classifies. Deterministic logic decides.
Backend (Python 3.12 + FastAPI 0.115) The invariant engine is pure Python — no ML, no probabilities. A decode_evm_transaction() function parses raw hex calldata without any LLM, extracting recipient, amount, asset, and method selector in < 1ms. This is what lets me guarantee zero hallucination in the enforcement path.
A TrajectoryState object accumulates session spend across assets, tracks nonce progression, and computes SHA-256 state hashes at every transition. The ChainBreakExecutor is the physical gate: it is structurally impossible to reach sign_and_broadcast() unless all five invariants return ALLOW.
AI is used in exactly one place: For the legacy V1 general-agent mode, an LLM (Llama 3.1 8B via OpenRouter) maps open-ended tool call arguments into typed SemanticAttributes. The LLM never sees the invariant engine and never gets a say in ALLOW/BLOCK. If the LLM fails or times out, the system fail-closes to HOLD — zero egress regardless.
The 15 adversarial scenarios (W01–W16) are organized across 5 attack families:
Family A: Safe sessions (boundary tests, multi-asset) Family B: Intent drift (Alice→Mallory pivot, invoice padding, bait-and-switch) Family C: Capability boundary (chain hopping, asset substitution, approval trap) Family D: Trajectory attacks (micro-drain, nonce replay, adaptive attacker) Family E: Malformed calldata (truncated selector, hex injection) Plus a W16 mutation fuzz campaign generating 100+ automated mutations with 100% correct classification and zero false-allows.
Frontend (React 18 + Vite 5 + Tailwind CSS) A high-contrast, real-time cyberpunk cockpit UI. Dual-track scenario runner with divergence highlighting. Cryptographic receipt inspector. Embedded conversational AI explainer for walking through invariants.
Testing: 128 automated tests (unit + integration + fuzz) — all passing in 1.19 seconds.
Deployment: Docker multi-stage build + Render Blueprint (render.yaml) for one-click cloud deploy. Vercel for the frontend CDN.
Challenges I ran into
The determinism boundary problem. The hardest design decision was finding the exact line between where AI should and shouldn't operate. The temptation was to use an LLM to evaluate whether a transaction "seems suspicious" — essentially the "LLM Judge" anti-pattern. That approach is wrong: it's non-deterministic, injectable, and adds ~300ms to every transaction. Enforcing the hard boundary — AI handles semantic extraction, determinism handles enforcement — required refactoring the architecture twice.
Building a calldata decoder without a blockchain node. I needed to parse raw EVM hex calldata (transfer(address,uint256)) without spinning up Geth or calling Etherscan. The pure-Python decoder handles Native ETH and ERC-20 standard methods with correct ABI padding, and it fails closed (HOLD) on any unrecognized selector — no silent misclassification.
Stateful trajectory across multi-step sessions. Tracking cumulative spend correctly across assets required building a proper causal ledger — not just a running sum, but a state graph with antecedent lineage, per-asset denominators, and deterministic hash binding. Getting the micro-drain detection (W06) to correctly accumulate 40+50+30 = 120 > 100 without false-blocking the multi-step safe session (W01: 20+30+25+25 = 100) required extremely precise boundary semantics.
Proof over claims. Every security tool claims to block attacks. I wanted judges to see the block happen and see what would have been lost without it. Building the dual-track counterfactual runner — executing both the unprotected and protected paths, diffing them, and surfacing the exact divergence step and financial delta — was the most time-intensive engineering piece.
Accomplishments that I'm proud of
128 / 128 automated tests passing — a complete test corpus covering unit logic, invariant math, fuzz mutations, and API contracts. 100% attack detection rate across all 15 adversarial scenarios, with 0 false-allows on the 100+ mutation fuzz campaign. < 1ms invariant evaluation overhead — the enforcement path adds no meaningful latency to transaction throughput. The physical signing gate: The private key and broadcast dispatcher are structurally unreachable on BLOCK — not just skipped by an if statement, but isolated behind the invariant executor. tx_hash = null is a guarantee, not a policy. Dual-track counterfactual proof — showing a judge exactly what $50 was prevented from leaving a wallet, at which step, and why. Fuzz campaign W16: 100+ automated mutations, every one correctly classified. No crashes, no unhandled edge cases.
What I learned
Security decisions must be deterministic. The moment you introduce a probabilistic model into the enforcement path, you've introduced a new attack surface. An adversary can probe the LLM's decision boundary. Deterministic math cannot be socially engineered.
Fail-closed is not a feature — it's a law. Every failure mode in the system (LLM timeout, malformed calldata, low-confidence parse, unknown method selector) must resolve to HOLD or BLOCK. There is no acceptable failure mode that resolves to silent ALLOW.
Proof beats claims. A counterfactual runner that shows two parallel execution traces is ten times more convincing than a benchmark score. Judges and users want to feel the block happen.
Scope discipline wins hackathons. Instead of building a generic AI security platform, I locked the scope: exactly 5 invariants, exactly 15 scenarios, exactly one physical gate. Every engineering hour went to depth in that scope rather than breadth across a vague surface.
What's next for ChainBreak
EIP-712 Typed Data Support: Extending deterministic invariant enforcement to offchain gasless signatures (Permit2, CowSwap, Seaport orders) — the next frontier for AI agent wallet security. DeFi Protocol ABI Plugin Registry: Community-contributed decoders for Uniswap V3 Multicall, Aave, Compound, and MakerDAO — extending coverage beyond ERC-20 standard methods. SDK Middleware Packages: Native drop-in adapters for ElizaOS, LangChain, CrewAI, and AutoGen — so any agent framework can add ChainBreak as a one-line security layer. Z3 / SMT Formal Verification: Mathematically provable completeness certificates for the invariant set against a given IntentEnvelope — moving from tested-correct to proven-correct. Distributed Redis State Bus: Cluster-synchronized causal trajectory tracking for multi-agent swarm deployments operating against shared wallets.
Log in or sign up for Devpost to join the conversation.