dotx3.net

Pick a case or launch an attack

One-click attacks on the authorized payment

The twelve judge scenarios

The agent pays 25 USDC to a listed recipient, inside every limit.

The two programs

Owner's mandatenear_mandate_agent.x3

// near_mandate_agent.x3 — what an owner lets an AI agent spend, enforced on NEAR by x3-guard.
//
// The owner sends this once (`near_intents.py mandate args`). From then on the agent account
// can register swaps in the owner's name, and x3-guard refuses any that break a term:
//
// - `spend` and `per_payment`: Solana USDC only, at most 50 USDC a payment.
// - `per_24h`: at most 200 USDC in any rolling 24 hours (and at most 64 payments).
// - `allow recipients` / `allow assets`: where the money may go, and as what.
// - `refund_to`: a failed swap refunds here. The agent cannot point refunds at itself.
// - `require slippage` / `require fees`: the loosest bounds an agent's intent may declare.
// - `approve above`: a payment over 30 USDC waits for one of the listed approvers.
// - `expires`: the mandate ends 30 days after it is compiled. The owner can revoke it at
//   any time (`near_intents.py mandate revoke`), and every unaccepted intent stops at once.
//
// Amounts are base units: 50 USDC at six decimals is 50_000_000.
//
// The accounts are placeholders. Replace them with accounts you control.
mandate x3_shopping_agent {
    owner x3-owner.near
    agent x3-agent.near
    spend Solana.USDC
    per_payment 50000000
    per_24h 200000000
    allow recipients x3-demo.near
    allow assets Near.USDC
    refund_to 4Nd1mzi8Y1QYxJt9wZWBYZpG7S4pYkZs6YzD3Vt9aBcD
    require slippage <= 1%
    require fees <= 100 bps
    approve above 30000000 by 1 of x3-owner.near
    expires 30d
}

Agent's paymentnear_intents_agent_payment.x3

// near_intents_agent_payment.x3 — an AI agent's payment, under its owner's mandate.
//
// The same NEAR Intents swap as `near_intents_sol_to_near.x3`, with one more clause:
// `under mandate x3-owner.near`. The agent account registers and accepts it through
// x3-guard's agent methods, which check `near_mandate_agent.x3`'s terms on chain first:
//
//   near_intents.py mandate check near_mandate_agent.x3 near_intents_agent_payment.x3
//   near_intents.py quote near_intents_agent_payment.x3 --live --mandate near_mandate_agent.x3 \
//       --guard-contract <x3-guard account>
//
// 25 USDC is under the mandate's 30 USDC approval threshold, so no approval is needed.
intent near_intents_agent_payment {
    from Solana.USDC amount 25000000 receiver 4Nd1mzi8Y1QYxJt9wZWBYZpG7S4pYkZs6YzD3Vt9aBcD
    to Near.USDC receiver x3-demo.near
    route {
        bridge NearIntents Solana.USDC -> Near.USDC min_receive 24800000;
    }
    under mandate x3-owner.near
    require slippage <= 0.5%
    require fees <= 100 bps
    require nonce unused agent_payment_001
    timeout 10m refund Solana.USDC
    on_fail rollback
}

Verdict

Checking…

Verify a signed 1Click quote

Guard trusts a quote only after the 1Click signature checks out. This is the same Ed25519 check the contract runs, using the pinned 1Click key, on quotes that 1Click actually issued. Change one digit and it fails.

{
  "quote": {
    "amountIn": "25000000",
    "amountInFormatted": "25.0",
    "amountInUsd": "24.982750000000",
    "minAmountIn": "25000000",
    "amountOut": "24997929",
    "amountOutFormatted": "24.997929",
    "amountOutUsd": "24.980680428990",
    "minAmountOut": "24872939",
    "timeEstimate": 20,
    "refundFee": "244425",
    "withdrawFee": "0"
  },
  "quoteRequest": {
    "dry": true,
    "depositMode": "SIMPLE",
    "swapType": "EXACT_INPUT",
    "slippageTolerance": 50,
    "originAsset": "nep141:sol-5ce3bf3a31af18be40ba30f721101b4341690186.omft.near",
    "depositType": "ORIGIN_CHAIN",
    "destinationAsset": "nep141:17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1",
    "amount": "25000000",
    "refundTo": "4Nd1mzi8Y1QYxJt9wZWBYZpG7S4pYkZs6YzD3Vt9aBcD",
    "refundType": "ORIGIN_CHAIN",
    "recipient": "wrap.near",
    "recipientType": "DESTINATION_CHAIN",
    "deadline": "2026-11-03T04:06:46.297Z",
    "confidentiality": "public",
    "quoteWaitingTimeMs": 0,
    "insured": false,
    "appFees": [
      {
        "recipient": "5880ad2b362620fadf759cbceb1cd5737ce8c6ed7fb8e9942881e6731f9247dd",
        "fee": 1
      }
    ]
  },
  "signature": "ed25519:mao2Y1gakEypKEMhqoSi9UoFNCKHZhU4Ey6Hd9UM4DBwMiNpiNTpUptxaUZSAXuYzBAt2KTVaU5QhPJgSLJgGKB",
  "timestamp": "2026-11-03T03:56:47.575Z",
  "correlationId": "11a1e38e-6577-44ce-8320-c314e44339ca"
}

Checking…

Pinned key ed25519:reYaWhvwu8Jzo3WUM3zhn6VrhuMEF4eADL17qtRVifc. These are dry quotes captured on 2026-11-03. A valid signature proves what 1Click offered. It does not prove a swap happened.

What this proves, and what it does not

Shown here · Locally valid policy
The mandate and the payment compile, and the shared checker decides them. Python and this page agree.
Not shown here · Approved request
x3-guard records approvals on NEAR (approve_intent). No approval has been recorded for these scenarios.
Not shown here · On-chain authorization
x3-guard's agent_register_intent and agent_accept_quote on a deployed contract. Not deployed for this console.
Not shown here · Wallet-controlled transfer
x3-guard does not custody funds. A keyholder can still transfer directly; only a wallet that calls the Guard is bound by it.
Not shown here · Signed quote
The X3 Guard page verifies real 1Click dry quotes in the browser. This console asks 1Click for nothing.
Not shown here · Observed transaction
No deposit or delivery transaction exists for these scenarios.
Not shown here · Finalized settlement
No settlement has been observed.
Not shown here · Proven cross-chain causality
Not claimed. Separate source and destination transactions would not prove that one caused the other.

Checker source: x3guard.mjs at 470d61a, copied byte for byte. In x3lang a parity test runs it against the Python adapter on the same programs. This site's own test re-checks all twelve scenarios against Python's recorded answers. The testnet transactions are on Inspect the Proof.

Break the agent's payment. Watch it get refused.

Pick a case or launch an attack

The two programs

Verdict

Verify a signed 1Click quote

What this proves, and what it does not