Ward Counterparty desk

Fixture chain on this deployment. No keys required.

NEAR testnet · AI Security & Defense

Check the receiver before the agent pays.

Ward answers allow, warn, or block, and it returns the reasons. Block never reaches the signer. Warn waits for a person. The agent holds a function-call key scoped to pay on one treasury, so a bypass still cannot move NEAR.

  • Allow

    Known receiver, stable code, no blocklist hit. The agent pays.

  • Warn

    Young account, recent code change, or a single report. A person decides.

  • Block

    Missing account, confirmed report, or three reports. The wrapper does not sign.

01

Check a receiver

The agent is pay-agent.ward.testnet. The call is pay with no attached deposit.

NEAR. At most 24 decimal places.

Next: check a receiver. Block never reaches the signer.

No check yet.

02

Attack demo

A prompt-injected agent tries to pay known-bad.ward.testnet. The log matches npm run demo.

A stopped payment prints PAYMENT STOPPED and signer.called: false.

The log will appear here.

03

Signals and where they come from

Each reason names a source. The score does not come from a model.

Signal Source
Account age NearBlocks GET /v1/account/{id}, created.block_timestamp in nanoseconds.
Activity NearBlocks GET /v1/account/{id}/txns/count.
Contract or not NEAR RPC view_account. The empty code hash means there is no contract.
Code changed Ward's own code-hash history, plus a NearBlocks receipts page when it contains DEPLOY_CONTRACT.
Full-access key NEAR RPC view_access_key_list, first 100 keys. A contract with a full-access key can be rewritten.
Prior payments This agent's authorization rows in Supabase, or the memory store.
Shared blocklist Ward contract get_target, cached in Supabase. One report warns. Three reports, or an owner confirmation, block.

04

What the agent key cannot do

The contract sees the account, not which key signed. The method list keeps the agent out of the owner methods.

  • It can call only pay on the treasury contract.
  • It cannot attach NEAR. The treasury spends its own balance.
  • It cannot transfer, add keys, deploy code, or call withdraw, confirm, or report.
  • Its gas allowance is finite. At zero, the key is dead and topping up the account does not revive it.