IntentGuard stops a prompt-injected sentence from draining an AI agent's wallet.
The x402 protocol lets autonomous agents pay for things on their own — but agents read untrusted data (invoices, web pages, tool output), and a single injected sentence can scope-lift a payment: redirect the recipient or inflate the amount. In our reproduction, raw x402 lets ~50% of these attacks succeed. IntentGuard freezes the user's payment intent into an EIP-712 mandate at the moment of approval, delegates a scoped permission to the agent via **MetaMask Smart Accounts (ERC-7715)**, and enforces it on-chain with ERC-7710 caveat enforcers (allowedTargets, erc20PeriodTransfer, time bounds) that a corrupted agent cannot relax. The agent reasons with Venice AI behind a CaMeL-style planner / quarantined-LLM split; legitimate payments settle **gaslessly through the 1Shot permissionless relayer** on Base Sepolia.
The result: prompt-injection scope-lift attacks drop from ~50% to 0% while the agent keeps ~98% autonomy — versus a human-in-the-loop approval gate, which stops the attacks but drops autonomy to 0%. It's a security layer for the agentic-payments stack, not a wallet replacement.
Research backing: Zenodo DOI 10.5281/zenodo.20575443.
<p>Built end-to-end during the hackathon window (first commit → demo-ready in ~8 days):</p><p></p><ul><li><p><strong>Intent-binding engine</strong> — EIP-712 mandate signing over secp256k1, freeze → verify</p></li></ul><p>→ settle, with <code data-inline="true" spellcheck="false">ScopeCaveat</code> enforcement (allowed target, value cap, time window,</p><p>nonce anti-replay). <strong>13 unit tests.</strong></p><ul><li><p><strong>Venice agent</strong> — CaMeL planner / quarantined-LLM split that reproduces the</p></li></ul><p><strong>50% → 0%</strong> attack-success result. LLM layer made provider-agnostic</p><p>(Venice / Ollama / any OpenAI-compatible endpoint) with a deterministic heuristic</p><p>fallback so the demo runs with no API key.</p><ul><li><p><strong>x402 merchant + attack harness</strong> — 402-invoice flow plus **9 prompt-injection</p></li></ul><p>families** across recipient / amount / cumulative / nonce / operation / adaptive</p><p>dimensions.</p><ul><li><p><strong>MetaMask Smart Accounts delegation flow</strong> — ERC-7715 freeze-intent signing in the</p></li></ul><p>browser, scoped ERC-7710 delegation to the agent.</p><ul><li><p><strong>1Shot permissionless relayer</strong> — keyless, gasless ERC-7710 redemption with ERC-7702</p></li></ul><p>account upgrade; <code data-inline="true" spellcheck="false">getCapabilities</code> live-verified against the relayer.</p><ul><li><p><strong>Demo UX</strong> — animated payment-pipeline visualization; toggle the guard and the</p></li></ul><p>injection to watch the baseline get drained vs. blocked, side by side.</p><ul><li><p><strong>FastAPI API</strong> — <code data-inline="true" spellcheck="false">freeze</code> / <code data-inline="true" spellcheck="false">invoice</code> / <code data-inline="true" spellcheck="false">run</code> / <code data-inline="true" spellcheck="false">relayer</code> routes, CORS-wired to the</p></li></ul><p>frontend, live-verified.</p><ul><li><p><strong>Ship-ready</strong> — Dockerfiles + <code data-inline="true" spellcheck="false">docker-compose.yml</code>, Render/Vercel deploy configs,</p></li></ul><p>runbook, demo script, and research paper.</p><p></p><p><strong>Tracks covered:</strong> x402 + ERC-7710 · Best Agent · Best use of Venice AI · 1Shot Relayer.</p>