T6 · AI × Crypto Engineer
Let models participate in decisions without controlling funds, with every expense fully explainable.
For agents and the machine economy.
“T6” here means this track. Linked “Chapter T33” means a course chapter; Chapter T6 covers Solana accounts.
Who This Track Serves
Your agent works until money is involved. Research and APIs run well, but you supervise every signature. You recognize both limited autonomy and unsafe delegation.
Your defenses exist in prompts. Five-dollar limits and three recipients are written clearly, but injected text reaches the same language channel.
You understand Crypto but not unreliable components. Careful contracts meet a component that invents, can be induced, and outputs inconsistently; you do not know where to stop it.
An agent incident cannot be reconstructed. Logs show only final tool calls, omitting proposals, reasoning, and layer decisions; rerunning relies on luck.
The dividing line: deliver a system whose permissions can be explained layer by layer after an incident.
Prerequisites
Security prerequisites matter: Chapter T31 depends on T28, and Chapter T36 on T30. Learn auditing before attaching a wallet.
- Chapter T4
- Chapter T12
- Chapter T28
- Chapter 32
- Chapter T32
- Chapter T33
- Chapter T27
- Chapter 34
- Chapter T34
- Chapter T35
- Chapter T36
| Required reading | Graph rationale |
|---|---|
| Chapter T4 · RPC | T33 prerequisite; limits and completeness bound tool reliability |
| Chapter T12 · Testing & Deployment | T31/T32 prerequisite; simulation uses fork tests to show consequences before spending |
| Chapter T28 · Smart Contract Security | T31 prerequisite; reviewing generated code requires review competence |
| Chapter 32 · AI in Trading | T32 prerequisite; judgment about suitable delegation |
| Chapter T32 · Reliable AI Architecture | Backbone: model proposes, deterministic systems validate, execution accepts approved proposals |
| Chapter T33 · Tool-using Crypto Agent | Tool definitions bound capabilities |
| Chapter T27 · Account Abstraction | T34 prerequisite; session keys bound impact |
| Chapter 34 and Chapter T34 | Budgets, allowlists, sessions, audit logs are all required |
| Chapter T35 and Chapter T36 | Eight-step pipeline and autonomy boundaries define the deliverable |
T35 also depends on Chapter T22 · Lending. For DeFi agents, an agent cannot clarify a strategy you cannot calculate yourself.
What You Will Learn
- LLM
- Agent
- MCP
- Wallet
- Payment
- Onchain Tool
- Risk
- Agent Economy
Eight topics form four groups. Each adds a gate to the preceding group.
1. LLMs and Agents: Contain Unreliability
Constrain models to proposals: typed schema objects, smallest-unit amount strings rather than floats, checksum addresses, and mandatory reasoning.
Unstable output is a model property. Design for harmless mistakes rather than perfect output.
2. MCP and Tools: Definitions Are Permissions
Ambiguous descriptions cause plausible but incorrect interpretations visible afterward in logs.
Practice:
- Granular least-privilege tools rather than arbitrary transaction execution.
- Preconditions, failures, and explicit exclusions in descriptions.
- Untrusted treatment of chain strings and API explanatory text, which may contain injection.
- Protocol-level separation of reads and writes rather than names alone.
3. Wallets, Payments, and Risk: Gate Before Execution
Define five dimensions in reviewable, versioned, auditable configuration:
| Dimension | Decision | Common error |
|---|---|---|
| Amount | Per-action, daily, per-task limits | Token-unit limits whose value rises with price |
| Recipient | Address allowlist | Names or domains resolved autonomously |
| Frequency | Hourly calls and recipient cooldown | Amount limits without frequency limits |
| Time | Session expiry and operating windows | Never-expiring keys |
| Approval | Human threshold and required reasons | Rules only in prompts |
Per-task budgets are often omitted. Otherwise one looping task can legally consume the day's budget.
Risk checks convert values, inspect remaining budgets, and detect repeated payments. Simulation then reveals consequences before spending, an irreplaceable step.
4. Agent Economy: Accountable Autonomy
Design income/cost accounting, reconstructable audit logs, effective shutdown, and protection against bad-price amplification among interacting agents.
Logs need original proposals, model reasons, every layer's decision and reasons, transaction hashes, and post-execution balances. Missing any prevents reconstruction.
Final Deliverable
An autonomous onchain agent with budget, policy, and audit logs.
The Capstone Project already offers onchain agents and treasury directions. Its emphasis is working operation; this track emphasizes resisting attacks.
Run the work on testnet. Any unavoidable real-asset validation uses small amounts with README limits and safeguards.
Others can run it. One command starts services; a bundled task completes using testnet keys. Document keys, default budgets, and shutdown.
Block at least ten real-channel injection attempts and record the blocking layer. Use tool data, chain text, and API fields rather than user input alone.
Record desired action, rejecting layer, and reason. Successful bypasses are especially useful: add deterministic rules and retain original records.
Budgets are enforced rather than prompted. Test single-action excess, daily excess, and looping-task consumption. Reject all before signing.
Lower configured limits and rerun the same task. Changed behavior proves configuration is actually read.
Reconstruct every expense through all layers. Retrieve proposal, reasoning, validations, simulation, hash, and balance changes within a minute.
Broadcast success is not payment success. Included transactions can fail while charging gas. Budget accounting based on broadcast drifts from chain state.
Measure shutdown in seconds. Simulate persistent abnormal proposals and time detection through complete cessation.
Publish this number. Measured shutdown demonstrates that stopping was genuinely considered.
Assess Your Readiness
Rules and injected text both enter language context; text alone does not guarantee the intended constraint prevails over malicious instructions.
Even perfect-looking compliance is a probabilistic constraint, while money requires deterministic enforcement.
Models propose without execution authority; validators and policies decide; executors accept approved work only. Prompts reduce invalid proposals but cannot be the sole defense.
Four required safeguards: budget, allowlist, session keys, audit logs.
Budgets cover actions, days, and tasks; otherwise one loop consumes a full day legally.
Allowlists contain addresses rather than names. Supplier address changes need human confirmation.
Sessions bound duration, cumulative value, targets, and assets. Never give agents master private keys.
Logs preserve the other safeguards' decisions for incident reconstruction.
It alone shows pre-spend consequences beyond schema checks: sufficient balances, reverts, recipient capability, and resulting health.
It does not guarantee execution state equals simulation state. Blocks, prices, liquidity, dependencies, and inserted transactions can invalidate assumptions.
Use execution protections such as minimum output and confirm actual results afterward.
They come from uncontrolled sources and enter agent context.
A token-information tool reads a malicious name instructing the agent to ignore limits and transfer funds. Querying it imports that instruction.
Other channels include API descriptions, transaction notes, documents, and agent messages.
Separate and label data, but never depend on the model recognizing injection. Policies and allowlists must reject harmful transfers even if it is deceived.
Check:
- Model mistakes versus system exploitation: considering only mistakes suggests missing adversarial tests.
- Temporary budget increases may remain. Record and review configuration changes.
- Track income and costs to know whether it earns or burns funds. Otherwise autonomy covers only spending.
Common Mistakes
“Stronger Models Need Fewer Checks”
Capabilities reduce invalid proposals, but probabilistic output still needs deterministic monetary guarantees. At a thousand decisions daily, 99.9% accuracy implies roughly one daily error.
Attackers target weakest paths repeatedly rather than average cases.
Design checks around consequences. Better models can propose more complex work without removing gates.
“Fix Agent Incidents by Adding a Prompt”
Prompt-only changes can alter unrelated behavior without static guarantees or adequate test coverage.
Ask which layer should have blocked the incident. Add a testable rule rather than merely a sentence. Prompt changes may supplement it.
“Read-Only Tools Are Risk-Free”
Reads determine later decisions. Wrong prices, poisoned sources, or injected descriptions can make otherwise valid writes harmful.
Evaluate source trust, cross-check critical values, and reject disagreements. This follows Chapter T21's oracle principle.
“Audit Logs Just Record Calls”
Final calls record outcomes rather than the decision chain: proposal, reason, and every approval.
Organize by proposal through chain confirmation. Agents must not modify their own logs.
Next Steps
- Reread with your agent: Chapter T32, Chapter T34, Chapter T35.
- Inspect your architecture against the AI Safety Stack before building.
- Combine Track T5 · Security Engineer for adversarial testing, Track T3 · Onchain Data Engineer for trustworthy sources, and Track T4 · DeFi Engineer for real positions.
- Cross into Track N2 · Crypto Product. Permission documents make decisions for users, often invisibly.
- Explore a complete economy through the Capstone Project's Create a Machine Economy.