Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Optional pre-sign transaction guard: catch approval/Permit2 drains before the wallet signs

オープン
  • 何か問題がありますか？
#1,360 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
ドキュメント
明瞭さ
説明が足りない
活発さ
静か
技術スタック
python, typescript
領域
blockchain, security

調査の方向性

payload には EthAccountWalletProvider、CdpEvmWalletProvider、send_transaction、coinbase-agentkit==0.7.4 が記載されていますが、repository のファイルやテストはありません。まずこれらの provider のエントリーポイントを見つけ、トランザクションがどのように署名およびブロードキャストされるかを確認してください。指定された署名前のブロック動作をカバーする、合意済みで文書化された opt-in パターンがあれば完了です。

索引モデルが issue の本文から書いたものです。

説明

Summary

Sharing a small, optional pre-sign safety hook in case it is useful to AgentKit users, and to get the team's read on whether it belongs as a documented pattern. Feedback very welcome — including "this belongs in a wallet layer, not here."

Disclosure: I maintain chain-signer, the library referenced below. This is an optional integration suggestion, not a dependency ask.

The gap

AgentKit's wallet providers screen recipients (sanctions / known-bad addresses), which is great. What they don't do today is decode the calldata of the transaction the agent is about to sign. Most agent fund-loss in 2026 hasn't come from sending to a sanctioned address — it has come from an agent being talked into signing an unlimited approve(), a setApprovalForAll(true), a Permit2 allowance, or the same drain hidden inside a multicall / Safe / ERC-4337 execute. A recipient check doesn't see any of that, because the malicious party is the spender in the calldata, not the to of the tx. (Write-up with reproduced 2026 incident shapes: https://gist.github.com/Kevthetech143/f4b940b2b31d457bd593c3d6df9f65c4)

A small, dependency-light option

chain-signer is a pip-installable, offline, no-API-key, no-network static decoder. preflight(tx) decodes an unsigned EVM tx and returns HIGH/MED/LOW flags for the known drain patterns (unlimited/large approval, increaseAllowance, setApprovalForAll, ERC-20 transferFrom, ERC-721/1155 safeTransferFrom, ERC-2612/DAI/Permit2 permits, proxy upgradeTo, EIP-7702 delegation, and drains nested in multicall / Multicall3 / Safe multiSend / 4337 execute). It's a static complement to recipient screening and to simulation — not a replacement — and it runs in-process with no external call.

Proposed shape (opt-in wrapper, verified against coinbase-agentkit==0.7.4)
from chain_signer import preflight
from web3.types import TxParams
from coinbase_agentkit.wallet_providers import EthAccountWalletProvider  # or CdpEvmWalletProvider

class PreflightBlocked(Exception): ...

def preflight_guard(tx: dict, *, on_block: str = "raise"):
    report = preflight(tx)                      # offline, no key, no network
    highs = [f for f in report.get("risk_flags", []) if f.get("severity") == "HIGH"]
    if highs and on_block == "raise":
        raise PreflightBlocked("blocked before signing: " + ", ".join(f["code"] for f in highs))
    return None if highs else tx

class GuardedEthAccountWalletProvider(EthAccountWalletProvider):
    def send_transaction(self, transaction: TxParams):
        preflight_guard(dict(transaction), on_block="raise")   # raises BEFORE sign + broadcast
        return super().send_transaction(transaction)

Behavior (real provider instantiated, send_transaction called on a malicious unlimited approve() — raised before any broadcast):

BLOCKED pre-broadcast: chain-signer blocked a HIGH-risk tx before signing: unlimited_approval

Off by default; zero behavior change unless a user opts in.

Honest limits (stated up front)

This is static decoding, so it won't catch a novel/obfuscated drain it can't decode (those get a LOW "unknown" flag, not a block); it's EVM-only; and it does not stop a redirected legitimate transfer (moving real funds to an attacker) — that's a recipient-allowlist / value-cap concern, which AgentKit's policy layer already addresses and which chain-signer's separate check_action gate also covers. Best used alongside recipient screening + simulation for high-value actions.

Happy to open a PR adding this as a documented optional example if the team thinks it fits, or to just leave it here as a pattern for anyone who wants it.

主要言語
TypeScript
スター
1.3k
フォーク
871
30日以内にマージされた PR はありません

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

coinbase/agentkit のほかの issue

coinbase/agentkit の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。