AI agent wallet security

• A tool call that becomes a transaction

  The function the model is allowed to call, the transaction it builds, and the fields the model can fill in.

• Session keys

  Which key or operator a session grants, which calls that grant can make, and how long the grant lasts.

• Spend limits

  The amount a signer approved, the asset it covers, and the calls that can move more than that amount.

• EIP-7702 delegation

  Code an account delegates to, a chain id of 0 that derives a second session, and what that code can then sign and send.

• Approval prompts

  The screen a person sees before a signature, and whether the agent can satisfy that prompt on its own.

• Key storage

  The wallet, enclave, or environment that holds the key, and which process on the agent host can ask it to sign.

Check our work before you send code

• Published reports
• Report format and severity
• Methodology
• Terms of engagement
• Responsible disclosure
• security.txt

How every finding is graded

• Critical

  Funds or safety, exploitable as scoped.

• High

  Serious, less immediate than critical.

• Medium

  Bounded loss or a broken assumption that does not yet have an exploit path in scope.

• Low

  Defense in depth.

• Informational

  An observation with no security impact as scoped.

Questions about AI agent wallet security

• What is AI agent wallet security?

  AI agent wallet security is the review of an agent that can sign. We trace the tool that builds a transaction, the session key or delegation that allows it, the spend limit, the approval prompt, and the place the key is stored.

• What does it mean when an agent can sign?

  A tool the model can call is able to produce a signature or submit a transaction. The review covers that tool's arguments, the session key, the EIP-7702 delegation, the spend limit, the approval prompt, and key storage.

• When does a tool call become a transaction?

  When the tool builds, signs, or submits a transaction from arguments the model can set. We trace that path from the tool schema to the signature and the spend limit on the call.

• What does the ZeroDev Bastion report show?

  7 findings in Bastion.sol, BastionFactory.sol, and types/Structs.sol. The two High findings are checkSig permissionless replay refills allowance, and same (v,r,s) plus mutated Approval overwrites operator. A caller-chosen _chainId writes a second spendable row, and native 7702 auth accepted as checkSig is recorded as informational. The session-key SDK is out of scope. The recommended patches were not merged to master when the report was published.

• How is the quote set?

  The quote is fixed after we read the scope: which tools can sign, what they can spend, and where the keys are stored.