Changelog

A bare policy filename resolves its ledger beside it, not inside it. Closes 1 disclosed issue, highest severity Low.

• Low Reported privately: loadPolicy found the policy file's directory by stripping everything after the last slash, so a bare relative filename (AGENTWALLET_POLICY=policy.json, no slash) was left whole and became the...

A hostname is canonical before the policy sees it; the mint prices an SPL send. Closes 2 disclosed issues, highest severity Medium.

• Medium Reported privately (twice, by the same researcher): the policy matcher compared the hostname as the URL parser returned it, and Node keeps the DNS root label's trailing dot (and decodes a percent-encoded one into it)...
• Low Reported privately: in hosted mode the policy priced an SPL send at the caller's token_decimals whenever one was given, reading the mint only when the hint was absent, so 1,000 USDC sent with token_decimals: 18 was...

The native value carried on a token or approval call is a spend. Closes 1 disclosed issue, highest severity High.

• High Reported privately: once a call's calldata matched a classified layout (an ERC-20 transfer, an approval), the native value the call carried was dropped before the policy ran, so in local mode a transfer() carrying 1 ETH...

A refused spend is voided, never counted; may-be-live is a marker, not wording. Closes 1 disclosed issue, highest severity Low.

• Low Reported privately: in local mode, every refused sign_transaction consumed the rolling budget for good.

One budget across processes; sign_transaction is a spend. Closes 2 disclosed issues, highest severity High.

• High Reported privately: in hosted mode the spend policy was enforced only on /wallets/{id}/send; sign_transaction posts to /wallets/{id}/sign and returned a signed, broadcast-ready transaction with no policy check, no...
• Medium Reported privately: the 1.14.0 ledger was read once at startup and never re-read, with no lock across the check-and-append step, so two live agentwallet-mcp processes sharing one ledger file (two MCP...

Approvals and contract-call value are spends under the policy. Closes 1 disclosed issue, highest severity High.

• High Reported privately: the 1.14.0 spend policy decoded only transfer calldata, so an ERC-20 approve (including approve_token with "max" and approve_permit2 with no amount) fell through as a plain contract call...

Spend Policy.

Round 8 freeform findings. Closes 4 disclosed issues, highest severity Medium.

• Medium Internal adversarial audit, round 8 (1.13.15): the "one live authorization per resource" guard was keyed on the chain, so a paywall rotating the chain per answer harvested one cap-sized nonce per registry chain for a...
• Low Internal adversarial audit, round 8 (1.13.15): an MCP cancellation (notifications/cancelled) of an in-flight pay_x402 was ignored; the handler went on to sign and deliver the payment and the client never saw a result
• Low Internal adversarial audit, round 8 (1.13.15): the hosted broadcast-transfer branch of pay_x402 posted /wallets/{id}/send without the skip header, so a metered 402 from the API host was auto-paid inside the call and the...
• Low Internal adversarial audit, round 8 (1.13.15): a v2 requirement with megabytes of junk in outputSchema or extensions was echoed whole into PAYMENT-SIGNATURE (5 MB header per paid retry, kept in the cache for the...

A plain-http Solana RPC URL is refused except on localhost, like an EVM one.

settled-claim units read one way; get_token_info surfaces a chain mismatch; package.json repository format.

Round 6, prompt-injection arrival across every tool. Closes 1 disclosed issue, highest severity Medium.

• Medium Internal adversarial audit, round 6 (1.13.13), prompt-injection arrival across all 34 tools: a hostile API host's 402 on the auto-pay path produced a 4 MB error built from raw accepts entries (tool errors had no size...

Round 5, network edge and regression sweep. Closes 1 disclosed issue, highest severity High.

• High Internal adversarial audit, round 5 (1.13.12), network edge: the RPC-secret redaction ran a quadratic regex over the node's whole error text, so a 160 KB error page froze the single-threaded server for 14 s and a 5 MB...

Round 4, local EVM path (fee ceiling, honoured gas parameters, local hash). Closes 1 disclosed issue, highest severity High.

• High Internal adversarial audit, round 4 (1.13.11), local EVM path: nothing bounded the fee of a locally signed transaction; a node answering a 47,000 gwei priority fee or a 30M gas estimate took the whole native balance as...

Round 4 (Solana decimals flip, startup parsing, strict arguments, docs). Closes 3 disclosed issues, highest severity High.

• High Internal adversarial audit, round 4 (1.13.10), local Solana path: the SPL token cap read the mint's decimals through a cached call and the instruction through an uncached one, so an RPC that answered 6 to one read and...
• Medium Internal adversarial audit, round 4 (1.13.10): a leading space in AGENTWALLET_API_URL defeated the https-only check (the regex saw the space, fetch did not) and Basic credentials went out in plaintext; unknown tool...
• Low Internal adversarial audit, round 4 (1.13.10), startup and docs: AGENTWALLET_MAX_AUTOPAY_PER_HOUR was unvalidated (blank meant 0, garbage meant 20); a misspelled AGENTWALLET_* name ran uncapped without a warning...

Round 3, Permit2 upto and EIP-712 signing. Closes 1 disclosed issue, highest severity Low.

• Low Internal adversarial audit, round 3 (1.13.9), Permit2 upto and EIP-712 signing: for a token outside the domain registry the "exact" signer read name()/version() through the 64-character display sanitiser instead of the...

Adversarial audit round 3 (auto-pay scope, signing mutex, approvals binding, host data bounds). Closes 3 disclosed issues, highest severity High.

• High Internal adversarial audit, round 3, server side (hosted API 1.7.2, deployed 2026-10-04): the server's per-transaction token cap knew only transfer, approve and transferFrom, so increaseAllowance, Permit2.approve...
• High Internal adversarial audit, round 3 (1.13.8), hosted trust boundary: with AGENTWALLET_WALLET_ID set, a 402 from the API host on ANY call (list_wallets, get_chains, get_token_info's three internal reads) was paid...
• Medium Internal adversarial audit, round 3 (1.13.8): when the first of N parallel pay_x402 calls for one purchase failed, every waiter proceeded at once and signed its own nonce (7 nonces from 8 calls); a paywall that varied...

delete_wallet names the wallet it deletes. Closes 1 disclosed issue, highest severity Medium.

• Medium Internal adversarial audit, round 2, server side (hosted API 1.7.1): one DELETE with a leaked API key destroyed a wallet key; the approval email's amount and token name were the agent's own text; the emailed approve...

Adversarial audit round 2 (NFT selectors, payment_made, legacy receipt origin, ATA pre-funding). Closes 3 disclosed issues, highest severity Medium.

• Medium Internal adversarial audit, round 2 (1.13.6): an ERC-721 or ERC-1155 collection declines decimals() and so counted as "not a token" to the cap, which let setApprovalForAll(attacker, true) and NFT transfers through...
• Low Internal adversarial audit, round 2 (1.13.6): payment_made trusted a server-sent settlement header even on a 402 or 500, and the server's claimed transaction hash was shown as tx_hash; a legacy-shaped 402 from any host...
• Informational Internal adversarial audit, round 2 (1.13.6): USDT, DAI and USDbC in the registry do not implement EIP-3009 (checked on chain), so an "exact" payment in them signed a dead authorization; Polygon USDT now reports as...

Adversarial audit fixes (local auto-pay, decimals probe, SPL decimals, windows). Closes 8 disclosed issues, highest severity Medium.

• Medium Internal adversarial audit (1.13.5): in local mode with hosted credentials also configured, a 402 from the API host on any call that falls through to it (usage, chains, paywall reads) ran the internal auto-pay, which...
• Medium Internal adversarial audit (1.13.5): the local token cap's decimals() probe trusted viem's revert classification, which maps JSON-RPC error -32603 and an empty envelope to "the contract reverted", so a transient node...
• Medium Internal adversarial audit (1.13.5): transfer_token on a Solana mint outside the registry scaled the amount by the caller's decimals and then wrote the mint's real decimals into the instruction, so the on-chain check...
• Medium Internal adversarial audit (1.13.5): a server could shrink the signed authorization window to seconds, vary an amount's leading zeros, or answer parallel calls, and each retry signed a fresh nonce it could also settle
• Low Internal adversarial audit (1.13.5): every EVM RPC failure returned viem's message, which carries the RPC URL with its API key, to the agent (the 1.13.0 redaction covered wallet_mode only); an out-of-range private key...
• Low Internal adversarial audit (1.13.5): the Solana recipient guard accepted any account not owned by a token program, including program-data, buffer and lookup-table accounts that nothing can sign for; a plain account...
• Low Internal adversarial audit (1.13.5): Permit2 was recognised at one address, so a chain with a different deployment (zkSync Era) got no Permit2 guard; a whitespace-only cap value meant "no cap"...
• Informational Internal adversarial audit (1.13.5): several refusal messages told the agent to raise the operator's caps itself; the pay_x402 description still said upto is refused and that max_payment can raise the cap; untrusted...

Final URL recorded out of band, authorization key includes the query. Closes 2 disclosed issues, highest severity Medium.

• Medium Reported privately: pay_x402 learned which origin finally answered from the x-agw-final-url response header, and safeFetch copied every server header through before appending its own, so a server reached through a...
• Low Reported privately: the authorization-reuse key was built from origin and path without the query string, so two resources at the same path with different queries shared one signature and the second was reported paid...

SOL cap checks token-account rent at the account's real size. Closes 1 disclosed issue, highest severity Informational.

• Informational Reported privately: when an SPL send has to create the recipient's token account, the rent checked against AGENTWALLET_MAX_TX_SOL was computed for the classic 165-byte account, while a Token-2022 account is 170 to 195...

Solana recipient guard refuses mints, local mode refuses approvals. Closes 2 disclosed issues, highest severity Low.

• Low Reported privately: the Solana recipient guard refused programs and token accounts but used a length gate, so an 82-byte token mint passed as a wallet and an SPL send to it landed in a token account owned by the mint...
• Low Reported privately: in local mode with hosted credentials also configured, pay_x402 accepted an approval_id from the hosted account, but the local signer never reports back, so the approval was never marked used and...

Allowance totals, exact-only internal auto-pay, pinned decimals. Closes 3 disclosed issues, highest severity Medium.

• Medium Reported privately: in local mode increaseAllowance was checked on the increment alone, so repeated compliant calls could leave a spender's standing allowance above AGENTWALLET_MAX_TX_TOKEN
• Low Reported privately: the internal auto-pay path (a 402 from the configured AgentWallet API host, not pay_x402) took the first offer without checking its scheme, so an upto maximum from that host would have been paid...
• Informational Reported privately: for a token outside the registry, a compromised RPC answering a false decimals() scales both the signed amount and the token cap by the same factor.

Security audit release. Closes 3 disclosed issues, highest severity High.

• High Internal audit (1.13.0): the x402 cap was "1 unit of whatever asset the endpoint named", so a hostile 402 asking for native ETH was measured against a 1 ETH cap and the asset label shown to the agent (and in the...
• Medium Internal audit (1.13.0): authorization validity followed the endpoint's maxTimeoutSeconds with no ceiling and every retry signed a fresh nonce (a withholding server could harvest one cap-sized authorization per retry)...
• Low Internal audit (1.13.0): SPL sends could burn tokens into a token account or program address and paid recipient-account rent the SOL cap never saw; one Solana or EVM RPC URL served every chain id unchecked; the SPL...

Token cap prices WETH deposit()/withdraw(uint256) on the chain's wrapped-native contract so wrap_eth and unwrap_eth work under AGENTWALLET_MAX_TX_TOKEN. Closes 1 disclosed issue, highest severity Low.

• Low With AGENTWALLET_MAX_TX_TOKEN set in local mode, wrap_eth and unwrap_eth were refused by the token cap (WETH deposit() / withdraw(uint256) are unpriced calldata to a token contract) and the only way to restore them was...

Token cap refuses unpriced calldata when decimals() answers outside 0..36 or the RPC is unreachable. Closes 1 disclosed issue, highest severity Medium.

• Medium Token cap let unpriced calldata through when the target's decimals() answered outside 0..36: the probe reported "absurd answer" and "no answer" with the same null, and only "no answer" was meant to pass

Report EIP-7702 delegated payers before an x402 authorization, fresh test keys.

Token cap prices increaseAllowance and Permit2 approve, refuses unpriced token calldata; SSRF guard canonicalizes IPv4-compatible IPv6.

x402 Payer Report (42 endpoints settled on Base), payment_made requires a receipt or 2xx.

pay_x402 treats a used approval as not approved; record the approval-flow settlement.

Approvals above the cap, Permit2 upto, token risk, proof and security docs.

x402 exact via EIP-3009, upto refused, v2 headers and extensions. Closes 2 disclosed issues, highest severity High (functional).

• High (functional) exact scheme sent a broadcast transfer instead of an EIP-3009 authorization; standard servers rejected every payment
• Medium upto scheme settled as a full upfront transfer (overcharge relative to usage)

Fix native SOL x402 cap using 18 decimals instead of 9.

docs-only, guards documented by custody mode.

Drop caller credentials on cross-origin redirects in safeFetch.

Pin SSRF-validated addresses to the connection, and land 1.10.2/1.10.3.

Fix SSRF filter bypass in pay_x402 URL validation.

Solana local signing, and move price comparisons off the README.

Local (non-custodial) signing mode + key export path.

Closes 1 disclosed issue, highest severity High.

• High pay_x402 cap could be bypassed when max_payment was omitted (attacker-controlled maxAmountRequired reached the transfer)