Test the resale before the buy.
NEAR signs only what was checked.
The demo, in 86 seconds. A real run on NEAR testnet and a local fork of Base, the waits cut. Narrated by a synthetic voice; every line is also on screen.
The agent buys on the Base blockchain only through the guard, a NEAR contract. Before NEAR signs, three sentinels simulate the buy and the resale, check whether the token's code has drained pools before, and vote a verdict anyone can replay: allow, warn (the owner decides) or block.
The agent holds no key for Base: the guard builds the transaction and NEAR Chain Signatures signs it.
Reading the demo guard on NEAR testnet…
Run a check
Pick a token. The board replays, value for value, the latest check of it that the demo guard recorded on NEAR testnet. Nothing is simulated in your browser.
Four lamps, four steps of a check. The fourth lights only when NEAR signs.
- Asked
- Simulated
- Verdict stored on NEAR
- Signed by NEAR
What it stops
- block listed A token you can buy but never sell
- block listed The token's owner takes tokens back without approval
- block A clean copy of code whose earlier pools were drained
- block listed A token that sells only in a simulation, or only at the sizes and delays a check tries
- block A token keyed on WETH or the factory, or that fails on a later Base block
- warn A token whose own code reads the time or its pool, to change after the check: the owner decides
- no allow One stolen sentinel key, or a Base node only one sentinel reads, says allow on a trap: the second matching vote is missing, or another sentinel blocks
- ignored A prompt-injected agent changes the route, recipient or minimum output: NEAR signs what was simulated
Each line opens the exact reason the sentinel gives and the test that shows it. Listed: put on the guard's shared blocklist, refused to every agent.
What it does not stop
- Two of the three sentinels lying. One alone never allows: it can block a buy, or spoil an exit while another is down. In this demo all three run on one machine: three keys, not three parties. Replay shows a lie afterwards.
- A rug by liquidity removal. A token that sells normally gets warn at best; block only when its code template has drained pools before. Of 81 real launches that ended badly within 24 h, 73 were blocked that way and 8 got warn (corpus).
- Same-second entries. A verdict takes about 30 s, NEAR's signature 6 s more (latency, and whom it fits).
- What a token does later. A pause, tax or blacklist after the buy.
- Asking again, later. A block on the token's code quarantines it for 30 min, for every agent; a warn or a split vote does not. Then an agent may ask again, with new draws.
- What no code shows. A holder of most of the supply can sell into the pool; liquidity older than one hour is not read; each sentinel believes the Base node it reads.
- Front-running. The signing request is public on NEAR before the swap reaches Base.
- Other pools. Only Uniswap V2 WETH pools on Base are checked and bought today, where copy-paste trap launches concentrate; Uniswap V3 and V4 pools are not supported yet.
How one purchase goes
- The agent asks the guard to check a token and an amount, and pays for the check.
- Each sentinel reads the check and simulates on Base the exact buy the guard would sign, then its resales, at several delays and sizes.
-
Each posts its vote to the guard, with the sha256 of its evidence
and the hash of the one transaction NEAR may sign. An
allowtakes two matching votes of three; oneblockis enough. -
On a fresh
allow, within 120 s, the agent buys. It names no route, recipient or minimum. - The guard rebuilds the simulated swap and Chain Signatures signs it for the guard's Base address.
- A relay broadcasts the signed swap: a program that holds no key and only forwards it. In this demo, to a local fork of Base. A second guard, whose account holds no key, had its swaps mined on Base Sepolia.
The guard's owner appoints the sentinels, three on the demo guard; a sentinel's key can only vote on checks. What a lying sentinel can still do, and the architecture.
Verify it yourself
No NEAR account, no key: replay a stored verdict and check the model's
decision behind a check. You need bun 1.4, Foundry 1.8
and jq.
The README section
adds the trap tests on a local fork.
git clone https://github.com/cmoron/near-preflight && cd near-preflight && bun install
export GUARD=guard.goblin-guard-17826.testnet # the demo guard on NEAR testnet, read only
# Check #19 (USDC on Base mainnet): resent, traced on a local fork, its template index rebuilt, re-judged, compared with NEAR
INDEX_RPC=https://base-rpc.publicnode.com bun app/replay.ts app/fixtures/usdc-base-mainnet.json https://mainnet.base.org --check
# REPLAY OK: verdict allow confirmed, same as on chain
# The model's decision behind check #10: signature, Intel and NVIDIA attestation, the guard's record (archival node: ordinary nodes no longer keep the NEAR block the model cited)
NEAR_RPC=https://archival-rpc.testnet.fastnear.com bun app/attest.ts app/fixtures/decision.json --check 10
# ATTEST OK: 15 checks hold (1 not verified, see SKIPPED)