On-Chain Risk Council

Inspiration

Wallet drainers have caused nine-figure losses on Solana. A single LLM asked "is this tx safe?" has no safety floor — one prompt injection or hallucination bypasses it entirely. We built a society of specialists that checks each other, wrapped in code that cannot be talked past.

What it does

On-Chain Risk Council is a Track 3 Agent Society for real Solana risk. Specialised Qwen agents (Intake, Risk Analyst, Exploit Skeptic, Compliance, Simulator, Referee) deliberate over high-stakes actions; a deterministic one-way-ratchet guardrail and a tamper-evident hash-chain audit log make the final call. Consensus is necessary, never sufficient. Role division, cross-debate with a monotonic safety floor, a deterministic guardrail (final call is code, not LLM), human-in-the-loop escalation, and double MCP (Helius in, council out). On a 19-action benchmark incl. real Wormhole/Cashio signatures: council malRecall 100%, falseApprove 0%; lone agent malRecall 60%, falseApprove 40%.

How we built it

Next.js 16 + TypeScript + Tailwind. Qwen Cloud via DashScope (qwen3.7-max, qwen-turbo, text-embedding-v3). Helius MCP over stdio. PostgreSQL + pgvector on Alibaba ECS. Deterministic Solana extraction (@solana/web3.js) feeds the guardrail so free-text cannot unlock irreversible actions. Orchestrator: intake → specialists ‖ sim → cross-debate → referee → guardrail → audit hash.

Challenges we ran into

Helius MCP telemetry params (_feedback / _feedbackTool / _model) — empty strings fail with -32602. Over-blocking clean actions — fixed by "reject only on positive exploit signal" + routine corridor. Social-engineering "this is refundable" — reversible derived only from trusted structure, never user claims.

Accomplishments that we're proud of

Deterministic guardrail no LLM agent can talk past. Live Alibaba ECS deployment with Qwen + Helius + pgvector all green. Productizable MCP server + hash-chain audit (ClearCrew-class integrity for decisions).

What we learned

A multi-agent society earns its keep on nuanced cases and evidence, not on obvious drainers a strong lone model already catches. The hard floor must be code; the society supplies perspectives and conflict resolution the floor cannot invent.

What's next for On-Chain Risk Council

More real exploit signatures in pgvector, a wallet browser extension that calls the council MCP before sign, and continuous bench on new mainnet drainers.

Built With

• agents
• ai
• blockchain
• css
• defi
• helius
• mcp
• multi-agent
• next.js
• pgvector
• postgresql
• qwen
• security
• solana
• tailwind
• typescript