An agent can assemble an exposure nobody authorised out of steps that each pass. AMW checks the composition before settlement, holds it, and hands a named human the case file.
One question, asked nine times and answered honestly. Nobody asks the tenth.
“Is this action allowed?”
240,000 against a 250,000 cap. Classified venue, named agent, unexpired mandate.
Answered nine times: yes“What do these nine amount to?”
2,160,000 against a 2,000,000 bound. 3,333 bps off-primary against 2,500. All of it from permitted parts.
Asked by nothing on chainFinance named this fifty years ago and made it an offence: structuring — a reportable amount cut into unreportable slices. An agent needs no intent to produce it. A sizing loop will do.
The contract’s own arithmetic, running here. Move a bound; the hold moves with it.
EIP-712, identified by its own digest, so one signed elsewhere cannot be replayed here. A child may only narrow its parent — widening is impossible, not flagged.
The guard is the sole approved spender; the agent holds no tokens and no allowance. Every intent is recorded before it passes or fails, so a hold leaves a trace instead of vanishing in a revert.
Aggregate, count and off-primary share are checked against what the action intends, across every ancestor — so delegating is not the way around it. A breach returns a hold: no revert, nothing debited.
Workers draft and challenge the language; the arithmetic and the striking gate use no model. A claim whose citation does not resolve never reaches the page, and a struck one stays visible with its reason. The authoriser signs the release.
Tier 1 is what an action is. Tier 2 is what a sequence becomes. Same instrument, same contract, both enforced before value moves.
The three marked clauses are properties of a sequence. No per-action guardrail can evaluate them.
Not misconfigured. Held by someone hostile who can sign anything the agent could.
Move the owner’s tokens: the guard is the sole spender. Reclassify a venue: the map is keyed by owner. Widen the mandate: the terms are the owner’s signature or nothing. Release its own hold: no agent can become an authoriser.
Exactly what the mandate permits, and every unit of it recorded before it happens.
Source-verified contracts: bytecode a reader cannot check is bytecode they are asked to trust. The incident, the commitments and the decision are on chain.
Every contract has two names: the native 0.0.x id and the 0x EVM address, one contract behind both. Mandates are signed against the EVM address, because that is what the guard reads.
npm run -w @amw/relay gate10
A key funded with nothing signs six things and sends no transaction.
npm run -w @amw/contracts gate2
Nine actions from an agent key holding nothing. The ninth is held.
npm run -w @amw/contracts gate7
The compromised-agent drill, in fifteen seconds.
npm run verify
270 tests, each named after the attack it refuses.
A mandate bounds size, not price. No execution-quality clause, no oracle. An agent willing to lose value can lose it inside every clause.
Recovery is ecrecover only. A multisig treasury needs EIP-1271 — named here, not built.
The window is a fixed epoch, not rolling — cheaper to run, at the cost of a boundary an attacker can see.
One chain, one tenant, synthetic instruments. Each limit carries a test that fails the day it stops being true.
The incident, the case file behind the hold, and a preview answered by the enforcement bytecode itself. No wallet needed.