ChainWarden — On-Chain Agent Safety Gate

Bounded autonomy for Web3 agents. The agent PROPOSES; a smart contract DECIDES. Value moves on-chain only when every gate passes: binding → scope whitelist → budget cap → human approval → kill switch.

Built for the 3rd-Web-Hack hackathon (Blockchain/Web3 track). Portfolio piece.

---

The problem

Autonomous agents that move value on-chain are either fully trusted (send whatever, hope it's right) or fully manual (defeats autonomy). There is no enforceable middle ground. Trusted models + private keys = disastrous failure modes. The missing piece is code-is-law authorization: the agent can propose, but a contract — not a human in the loop per action, not the model — is the authority.

The solution: SafetyGate.sol

A minimal on-chain enforcement layer that mirrors the off-chain safety-protocol pattern, but immutable and non-bypassable:

Gate	On-chain
Binding	registeredAgents[agent] — only registered agents can propose
Scope	scope[agent][target] — whitelist of approved recipients
Budget	budget[agent] vs spent[agent] — hard cap, enforced in executeAction
Approval	approveAction(id) — owner-only gate before any value moves
Kill switch	kill() — freezes all execution
Audit	every state change emits an event (immutable log)

Value (native ETH) only moves inside executeAction, and only after approved == true AND scope still valid AND budget not exceeded. There is no function that moves value outside these checks. The agent literally cannot exceed authorization — the contract won't let it.

Architecture

[Strands Agent] --propose--> [SafetyGate.sol on Sepolia]
                                  |  emits events
                                  v
                          [Dashboard] reads on-chain state
                                  |  owner clicks Approve
                                  v
                          [executeAction] --value--> merchant

• Agent: Strands Agents SDK, proposes pay_subscription / dispute / transfer
• Contract: SafetyGate.sol (Solidity 0.8.24), compiled & verified
• Network: Sepolia testnet (free faucet — no mainnet funds)
• Dashboard: reads contract state + events, owner approves from UI

Quick start

pip install -r requirements.txt
export SEPOLIA_RPC=https://rpc.sepolia.org
export AGENT_PRIVATE_KEY=<sepolia-test-key>
python -m agent.onchain deploy   # deploys + registers + sets scope/budget
export GATE_ADDRESS=<deployed>
python -m agent.onchain state     # read on-chain gate state

Get Sepolia ETH from a public faucet (search "Sepolia faucet") — no cost.

Why it matters

This is the trust primitive Web3 agents need before they can hold value. Same enforcement model as the off-chain safety-protocol library, but with the guarantees only a blockchain provides: tamper-evident, non-revocable by the agent, auditable by anyone. Agents that move money fail on trust, not capability. ChainWarden is the trust layer.

License

MIT