Landing Page
Dashboard
Review
Proof

Inspiration

As autonomous AI agents rapidly evolve in Web3, giving them direct access to blockchain wallets introduces a fundamental vulnerability: Authorization ≠ Intent. Granting an AI agent broad transaction capabilities creates severe security risks. If an agent experiences prompt injection, hallucination, or a malicious exploit, it can execute unauthorized transactions and drain user funds.

We created IntentShield to bridge the gap between human language and on-chain execution. Instead of trying to build "un-hackable" AI or trusting the agent's internal reasoning, IntentShield enforces a Zero-Trust AI framework: "Don't trust the agent. Constrain the agent." We empower users to delegate execution authority to autonomous agents while mathematically and cryptographically bounding that authority within strict, user-approved constraints.

What it does

IntentShield is an Intent-Bound Authorization Layer for Autonomous Blockchain Agents that converts natural language instructions into cryptographically bound, machine-enforceable security policies.

Key features include:

AI Intent Compilation: Converts plain natural language instructions (e.g., "Swap max 500 USDC to ETH on Uniswap with max 1% slippage over the next hour") into a structured JSON draft policy using Google Gemini.
Human Review & User Override: Displays the draft policy transparently to the user, allowing them to review, edit, or override parameter values before granting authorization.
Cryptographic Authorization (EIP-712): The user signs the finalized policy using typed structured data (EIP-712) via their EVM wallet. This binds the authorization to exact parameters (agent, action, tokenIn, tokenOut, maxAmountIn, allowedTarget, maxSlippageBps, expiresAt, nonce) without ever revealing private keys or granting unrestricted wallet access.
Two-Layer Verification System (Defense-in-Depth):
- Layer 1 (Off-Chain Verifier): A server-side pre-check using Viem that inspects the agent's proposed calldata against the signed policy, rejecting unauthorized transactions early to save gas fees and provide instant UX feedback.
- Layer 2 (On-Chain Smart Account Enforcement): A Solidity contract (IntentShieldEnforcer.sol) deployed on Base Sepolia that acts as the ultimate security boundary. It validates signatures, expiration timestamps, nonces, and transaction parameters directly at the EVM execution level. If an agent attempts an over-budget transaction (e.g., 5,000 USDC when the limit is 500 USDC), the Smart Account triggers an EVM REVERT.
Transparent Audit Trail & Proof Page: Logs every transaction attempt (SUCCESS_ONCHAIN, REJECTED_OFFCHAIN, REVERTED_ONCHAIN) on Supabase and links on-chain results directly to Base Sepolia block explorers for independent verification.

How we built it

Smart Contracts & Security Boundary: Developed in Solidity (IntentShieldEnforcer.sol) and rigorously tested using the Foundry framework (forge). Deployed to the Base Sepolia Testnet (Chain ID: 84532).
AI Compiler Subsystem: Integrated Google Gemini API (@google/genai, gemini-1.5-flash) with structured JSON schema outputs (responseSchema) to reliably parse natural language inputs into structured policy definitions.
Frontend & Web3 Integration: Built with Next.js (App Router), TypeScript, Tailwind CSS, and shadcn/ui. Integrated EVM wallet connections and EIP-712 typed data signing via Viem, Wagmi, and RainbowKit.
Off-Chain Verification Layer: Implemented a deterministic pre-check module (src/lib/offchain-verifier.ts) utilizing Viem's verifyTypedData to validate signed policies before submitting on-chain transactions.
Database & Audit Trail: Configured Supabase PostgreSQL to record execution history, raw prompts, compiled policies, and transaction hashes for public auditing on the /proof page.
DEX Protocol Integration: Integrated with Uniswap V3 SwapRouter (exactInputSingle) for executing token swaps on Base Sepolia.

Challenges we ran into

Purity of Trust Boundaries: Enforcing a strict separation between Untrusted components (Gemini AI, Agent Runner, Frontend, Backend, Supabase) and Trusted boundaries (EIP-712 User Signature, Smart Account Enforcer, Blockchain Consensus) so that a compromise in the AI or database can never expand the agent's on-chain spending limit.
Deterministic On-Chain Calldata Decoding: Parsing Uniswap V3 exactInputSingle parameters inside Solidity at the EVM level to verify token pairs, recipient addresses, and spending caps without adding excessive gas overhead.
EIP-55 Address Checksumming & Viem Validation: Handling strict EIP-55 checksum validation across off-chain verification and EVM simulation to prevent signature mismatches or address decoding errors.
EVM Simulation & Gas Estimation for Testing: Configuring Foundry deployment scripts (forge script) to deploy smoothly across public testnet RPCs without hitting local EVM dry-run reverts or priority fee estimation glitches.

Accomplishments that we're proud of

Deterministic Security Guarantee: Successfully proved our core security property: An authorized autonomous agent cannot execute a transaction through the IntentShield Smart Account if it violates the user's signed policy.
Uncompromised Attack Protection: Demonstrated that when a rogue or compromised agent attempts a malicious transaction (e.g., 5,000 USDC against a 500 USDC limit), the system successfully blocks it off-chain at Layer 1, and forces an EVM REVERT at Layer 2 even if the off-chain verifier is completely bypassed.
Seamless End-to-End User Experience: Delivered a complete workflow from typing natural language intents to reviewing draft policies, signing EIP-712 authorizations, running autonomous agent proposals, and viewing immutable proof on Base Sepolia.

What we learned

Defense-in-Depth in Web3 + AI: Security boundaries must be placed as close to the execution layer (the Smart Account) as possible. Applications cannot rely on off-chain AI guardrails alone.
Don't Trust the AI; Constrain the AI: AI models don't need to be 100% un-hackable or flawless. By bounding their execution authority through cryptographic constraints and smart contracts, autonomous agents can operate safely even under threat of prompt injection or exploits.
Database Independence: Security guarantees must rely on cryptographic signatures (EIP-712) and smart contract verification, ensuring database records act solely as UX metadata rather than sources of security truth.

What's next for Intent Shield

Phase 2 — Multi-Protocol & Advanced Policies: Expand policy enforcement to support multiple DeFi protocols (Aave for lending/borrowing, staking, bridges), recurring DCA subscription policies, and time-windowed cumulative spending limits.
Modular Enforcer Architecture: Transition the Smart Account architecture toward ERC-6900 / ERC-7579 plugin modules and Bounded Session Keys (ERC-7710) for friction-free, long-running agent autonomy.
Phase 3 — Multi-Agent & Enterprise Treasury: Enable multi-agent delegation pipelines, agent-to-agent payment authorizations, and cross-chain policy enforcement for autonomous treasuries.
Phase 4 — Real-World Assets & Autonomous Commerce: Extend intent enforcement to verifiable Web2 commerce, merchant attestations, and Real-World Asset (RWA) purchases backed by oracle attestations.