--- eip: 1954 title: AI Agent Security Framework for DeFi description: A systematic classification and mitigation framework for AI agent DeFi surfaces, defining 8 attack vectors and 3 compliance levels author: Shiqiang Chen (@shunfeng8421) discussions-to: https://ethereum-magicians.org/t/erc-1954-ai-agent-security-framework-for-defi/29400 status: Draft type: Standards Track category: ERC created: 2026-08-17 --- ## Abstract As AI agents increasingly manage on-chain assets autonomously, a new class of attack vectors emerges at the intersection of AI systems and decentralized finance. This proposal provides the first systematic taxonomy of AI Agent × DeFi vulnerabilities, defining 8 attack vectors, 3 compliance levels, and automated detection tools. Based on real-world exploitation data (2 confirmed MCP CVEs, 5 protocol audits, 108 contracts analyzed), this framework enables protocols and wallets to self-assess their AI agent security posture. ## Motivation Current DeFi security guidelines such as [ERC-2612](../EIPS/eip-2612.md) permit and [ERC-4626](../EIPS/eip-4626.md) tokenized vaults address traditional smart contract vulnerabilities but assume human operators. When AI agents execute transactions autonomously, new failure modes emerge that conventional tools cannot detect: - Prompt injection bypassing tool authorization - AI agent reading manipulated on-chain prices - MCP protocol man-in-the-middle attacks - Multi-agent collusion exceeding rate limits No existing standard addresses these threats systematically. ## Specification ### Eight Attack Vectors #### V1: Prompt Injection to Tool Abuse AI agent receives adversarial input that overrides behavioral constraints. Mitigation: implement tool allowlist with positive authorization model. #### V2: Tool Hijacking via Adversarial Contract AI agent calls a malicious contract address. Mitigation: maintain contract allowlist; only call pre-verified addresses. #### V3: Oracle Poisoning via Agent-Read Prices AI agent reads spot price from a manipulated AMM pool. Mitigation: enforce TWAP with a minimum 30-minute window. #### V4: MCP Protocol Man-in-the-Middle Unencrypted agent protocol transport allows message injection. Mitigation: mandate authenticated plus encrypted transport. #### V5: Multi-Agent Collusion Multiple compromised agents bypass per-agent limits. Mitigation: per-wallet global limits supersede per-agent quotas. #### V6: Agent Identity Spoofing Attacker impersonates an authorized agent address. Mitigation: agent authorization MUST include an expiry timestamp and nonce. #### V7: Reward Function Manipulation Agent optimized for the wrong metric causes adversarial behavior. Mitigation: any reward function must include a loss-prevention sub-metric. #### V8: Human-in-the-Loop Bypass Accumulated small transactions exceed the confirmation threshold. Mitigation: cumulative daily total triggers mandatory re-authorization. ### Compliance Levels | Level | Vectors Required | Description | |:--:|:--:|------| | Gold | V1-V8 | Full mitigation plus independent audit | | Silver | V1-V4, V6 | Core security plus identity | | Bronze | V1, V2, V6 | Essential protections | ### Automated Verification A compliance checker (`aass-compliance.py`) validates protocol adherence to all 8 vectors through static analysis and behavioral testing. ## Rationale The 8 vectors were derived from: analysis of 63 DeFi exploit reports (2017-2026), audits of 5 AI agent DeFi protocols (108 contracts), and 2 original MCP protocol CVEs (CherryStudio path traversal plus SSRF). The 3-tier compliance model balances security rigor with practical deployability. ## Backwards Compatibility This proposal is informational and introduces no protocol changes. Existing contracts remain compatible. ## Reference Implementation - Specification: `ai-agent-security-standard.md` - Compliance Checker: `aass-compliance.py` - Reference Wallet: Safe AI Agent Wallet (Silver compliance, 5/8 vectors) - Repository: github.com/shunfeng8421/defi-hack-memo ## Security Considerations This framework addresses security directly. Protocols claiming compliance should undergo independent audit verification. ## Copyright Copyright and related rights waived via [CC0](../LICENSE.md).