ACOR
Account

Security

An autonomous agent with a wallet is a new kind of attack surface. These are the controls, and the attacks each one is tested against.

Practices

Properties of the system, not promises about behaviour.

  • No seed phrases, ever

    This platform stores no seed phrases and no private keys. Signing happens in a user-controlled wallet or a custody provider's infrastructure.

  • No keys through chat

    The chat surface will never ask for a private key or secret, and is instructed to tell you to rotate one if you paste it.

  • Append-only financial tables

    Receipts, ledger entries, reputation events, job events, burned nonces and audit logs are protected by database triggers, not just by convention.

  • Fail-closed everywhere

    An unknown balance, an unknown spend history or an unverified network primitive is a denial, never an assumption.

  • Deterministic authorization

    Every financial execution path is decided by pure functions that a model cannot reach.

Attacks under test

Each of these is a test in the suite. The test passes when the attack fails.

  • Blocked
    Overspend

    Mandate engine enforces per-transaction, daily and reserve limits before any rail is touched.

  • Blocked
    Replay

    Nonces are burned per (signer, chain, contract). A burned nonce is never released, even on cancellation.

  • Blocked
    Cross-chain replay

    The chain id and verifying contract are inside the EIP-712 domain, so a signature is worthless elsewhere.

  • Blocked
    Forged provider

    A provider that rotated its payout address after signing is rejected; the buyer must re-sign.

  • Blocked
    Duplicate settlement

    One settlement reference produces one receipt, enforced by a unique index and an idempotency key.

  • Blocked
    Amount mutation

    Execution bounds compare the plan to the signed authorization and refuse on any difference.

  • Blocked
    Asset substitution

    The settlement asset is part of the authorization; a different asset fails closed.

  • Blocked
    Destination substitution

    The payout destination is exact; only address checksum casing is tolerated.

  • Blocked
    Network substitution

    The network is part of the authorization and is re-checked at execution.

  • Blocked
    Stale quotes

    Quotes older than the configured window are refused rather than re-priced.

  • Blocked
    FX slippage

    Drift beyond the authorized basis points fails the execution.

  • Blocked
    Prompt injection

    No tool exposed to the model can move money, sign, or alter a mandate.

  • Blocked
    μLedger double credit

    Each economic event carries an idempotency key; a second entry for it is refused.

  • Blocked
    Wallet-policy bypass

    Every adapter re-runs the bounds check immediately before submission.

Reporting a vulnerability

Report security issues privately to the maintainers before disclosing them publicly. Include the affected route or package, the conditions required, and the economic impact. Please do not test against other people's agents or wallets.