NEAR competition

AI Security & Defense

Who stops an injected agent from paying an attacker?

How .x3 fits

The owner writes the spending mandate. The compiler rejects unsupported requests; the NEAR Guard checks signed quote terms against the stored rules.

The owner's spending mandate

mandate x3_shopping_agent {
    owner x3-owner.near
    agent x3-agent.near
    spend Solana.USDC
    per_payment 50000000
    per_24h 200000000
    allow recipients x3-demo.near
    allow assets Near.USDC
    refund_to 4Nd1mzi8Y1QYxJt9wZWBYZpG7S4pYkZs6YzD3Vt9aBcD
    require slippage <= 1%
    require fees <= 100 bps
    approve above 30000000 by 1 of x3-owner.near
    expires 30d
}

Amounts use token base units. These accounts are example or historical testnet identities; use the source guide before adapting a program.

What the evidence establishes

Published result

Historical NEAR testnet refusals, quote checks, mandate registration and revocation.

Trust and limits

Guard does not custody assets. A holder of an unrestricted origin-wallet key can bypass it.

Judge walkthrough

  1. Read the mandate and payment source. Identify recipient, asset, amount, nonce, deadline and refund terms.
  2. Run the local policy preview. Change the recipient to attacker.near and inspect the refusal; local results do not prove chain execution.
  3. Open the archived testnet records. Match the source hash, contract, transaction and network to the claim being checked.
  4. For delivery, inspect the source and destination finalized records and the relay assumptions separately from Guard authorization.

Full judge guide