How Obelisk is secured
The short version: your rules are checked by an open-source SP1 program, and your vault contract only lets the agent move money when it receives a zero-knowledge proof from that program that the transaction follows them.
Three checks on every transaction
- Signed by a registered agent. The agent signs each transaction with a key issued by dstack. The key is registered onchain only after its attestation is checked, and you can switch the agent off for your vault at any time.
- Proven to follow your rules. An SP1 program checks the transaction against your limits, allowed payees, the exchange and the swap output. If any rule fails, no proof can exist.
- Verified by the vault contract. The vault verifies the proof onchain, checks it belongs to this exact transaction, vault and day, and only then executes. Anything else reverts.
Checked twice
Vaults made since vault v4 do not rely on the proof alone. The vault contract keeps its own copy of your limits and checks every call itself:
- Which calls. Only an approval for the exchange (up to your daily limit), a payment to one of your payees, or a swap of USDC whose output comes back to the vault.
- How much leaves. The vault measures its USDC balance before and after each action, and refuses anything above your per-transaction or daily limit, whatever the transaction claims.
The proof still checks everything else, such as the pool and your price limit. Vaults made before v4 rely on the proof alone; the app offers to move them to a new vault.
What this protects against
- Prompt injection: an agent tricked into sending money elsewhere cannot produce a valid proof.
- Mistakes: amounts above your per-transaction or daily limit are refused.
- A leaked agent key: the key alone cannot move funds without a proof that the rules hold.
- Replays: every proof is tied to one transaction, one vault, one chain and one day.
Contracts on BNB Chain
- Vault factory
- 0x1dBA1119DB33533fc10966E5f0806290Eae435CdCreates vaults and records who owns them.
- Earlier vault factory
- 0x4530A51f8efB1A3Fc3d57e14db1965A1038Bb15cMade vaults before policy v3. Their owners move them to the current rules in the app.
- Earlier vault factory
- 0xadDe5A5cF722Ef1e6a55fB15d84Fd4A9a71a2429Made vaults before policy v3. Their owners move them to the current rules in the app.
- Agent registry
- 0xd79210b37c548584f87d66B07C8296db75678FE8Lists agent keys that passed the attestation check.
- Proof verifier
- 0x735A8EbC91e7ccC02A7275e13F4e02eab93cB5CASuccinct SP1 Groth16 verifier. Checks every proof.
- USDC token
- 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168The stablecoin your limits are counted in.
- Exchange router
- 0xCaf681a66D020601342297493863E78C959E5cb2The only contract the agent may swap through.
- Policy program
- 0x002c72fab9e46ad169621189cf082ed7a585af657aa44c4ef657d3d0621c53bdVerification key of the SP1 program that checks the rules.
What is not finished yet
Obelisk is in beta. These are the known limits today, so you can decide how much to trust it with.
- No third-party audit yet. The contracts and the SP1 program have tests and a self-review, but no independent audit. Deposit only what you can afford to lose.
- The agent runs in dstack's simulator, not in Intel TDX hardware. Someone with access to our server could read the agent key. Your limits still hold, because the key alone cannot pass the proof check.
- Proofs take time. About a minute per step on our GPU prover, and up to about 15 minutes when it falls back to the CPU. There is one queue for everyone.
- One operator key registers agents. It cannot move vault funds. Moving it to a multisig is planned.
Check it yourself
Every action and every refusal is listed on the activity page, and the code is open source on GitHub. If you find a problem, please open an issue.