← The evidence ledger
Evidence row 77039
Observed , by baseline/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://labs.theatlasproject.dev/agents/wallet-firewall/run
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 913429da942352258bf07466f6ebf412d4fa07a9b9399780a9ff1940a93c7036
- Leaf
- 0xb639d3119e5e6f5aa1e57175d0abef0c0db04fde18ae00c8aa622699ae8f0d4b
What was observed
{
"endpoints": [
[
"x402",
"https://labs.theatlasproject.dev/agents/wallet-firewall/run"
]
],
"name": "TAP Labs (made by TAP)",
"owner_address": "0x6409a21a5c77a31e2bf55f6f00c62bab2a5a7e59",
"raw": {
"accepts": [
{
"amount": "20000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:8453",
"payTo": "0x6409a21A5c77a31e2BF55f6F00C62baB2A5a7e59",
"scheme": "exact"
}
],
"description": "Wallet Firewall (TAP Labs (made by TAP)): Before you sign: says in plain words what a wallet request (transaction, permit, sign-in or Solana transaction) would really do, and whether it is what you meant.",
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"addressBook": [
{
"address": "0x2f4e6a8c0b1d3f5a7c9e1b3d5f7a9c0e2b4d6f81",
"name": "Mia"
}
],
"chain": "base",
"intent": "Sign a Permit2 permit letting SwapRouter spend exactly 100 USDC.",
"knownContracts": [
{
"address": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
"decimals": 6,
"kind": "erc20",
"name": "USD Coin",
"symbol": "USDC"
},
{
"address": "0x5e2d4c6b8a0f1e3d5c7b9a2f4e6d8c0b1a3f5e7d",
"kind": "contract",
"name": "SwapRouter"
},
{
"address": "0x000000000022d473030f116ddee9f6b43ac78ba3",
"kind": "contract",
"name": "Permit2"
}
],
"request": {
"type": "typed_data",
"typedData": {
"domain": {
"chainId": 8453,
"name": "Permit2",
"verifyingContract": "0x000000000022d473030f116ddee9f6b43ac78ba3"
},
"message": {
"details": {
"amount": "1461501637330902918203684832716283019655932542975",
"expiration": "1798761600",
"nonce": "0",
"token": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913"
},
"sigDeadline": "1792000000",
"spender": "0x5e2d4c6b8a0f1e3d5c7b9a2f4e6d8c0b1a3f5e7d"
},
"primaryType": "PermitSingle",
"types": {
"EIP712Domain": [
{
"name": "name",
"type": "string"
},
{
"name": "chainId",
"type": "uint256"
},
{
"name": "verifyingContract",
"type": "address"
}
],
"PermitDetails": [
{
"name": "token",
"type": "address"
},
{
"name": "amount",
"type": "uint160"
},
{
"name": "expiration",
"type": "uint48"
},
{
"name": "nonce",
"type": "uint48"
}
],
"PermitSingle": [
{
"name": "details",
"type": "PermitDetails"
},
{
"name": "spender",
"type": "address"
},
{
"name": "sigDeadline",
"type": "uint256"
}
]
}
}
},
"signer": "0x7a3b8c1d5e9f2a4b6c8d0e1f3a5b7c9d1e2f4a6b"
},
"bodyType": "json",
"method": "POST",
"type": "http"
},
"output": {
"example": {
"agent": "wallet-firewall",
"checkedAt": "2026-10-17T12:00:00.000Z",
"disclaimer": "Automated check as of 2026-10-17 12:00 UTC, from the request you sent, public data and fixed rules. It is not a guarantee and not financial or legal advice. Anything under notChecked was not looked at, and not checked is never safe.",
"findings": [
{
"category": "info",
"detail": "1. Let SwapRouter (0x5e2d…5e7d) spend any amount of USDC (no limit) (by signature, no transaction needed) through Permit2, until 2027-01-01 00:00 UTC",
"id": "what-it-does",
"severity": "info",
"source": {
"checkedAt": "2026-10-17T12:00:00.000Z",
"ref": "wallet-firewall: decoded from the request you sent",
"type": "code"
},
"title": "What this request does, step by step (1)"
},
{
"category": "wrong_amount",
"detail": "You asked for exactly 100 USDC. The amount in the request is the largest a permit can hold.",
"id": "permit-unlimited",
"severity": "critical",
"source": {
"checkedAt": "2026-10-17T12:00:00.000Z",
"ref": "EIP-2612 and Permit2: https://eips.ethereum.org/EIPS/eip-2612 and https://docs.uniswap.org/contracts/permit2/overview",
"type": "doc"
},
"title": "The permit allows any amount of USDC"
},
{
"category": "info",
"detail": "MyEtherWallet darklist (652 addresses, as of 2026-10-17); OFAC SDN list (US Treasury), digital currency addresses. A miss on a list means nothing: they are short and late.",
"id": "lists-read",
"severity": "info",
"source": {
"checkedAt": "2026-10-17T12:00:00.000Z",
"ref": "MyEtherWallet darklist; OFAC SDN list",
"type": "list"
},
"title": "Public lists that were read"
}
],
"notChecked": [
{
"what": "what the request would do on the live chain",
"why": "it is read from the request itself; nothing was simulated, run or sent"
},
{
"what": "what the contracts it touches really do",
"why": "their code is not read from the chain here; only the request and the lists you gave are used"
}
],
"steps": [
"let SwapRouter (0x5e2d…5e7d) spend any amount of USDC (no limit) (by signature, no transaction needed) through Permit2, until 2027-01-01 00:00 UTC"
],
"summary": "Do not sign. As of 2026-10-17 12:00 UTC: The permit allows any amount of USDC. You asked for exactly 100 USDC. The amount in the request is the largest a permit can hold.",
"verdict": "block",
"version": "0.2.1",
"youAsked": [
"sign a permit letting SwapRouter spend 100 USDC"
]
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"addressBook": {
"description": "People the user knows: names and addresses.",
"items": {
"properties": {
"address": {
"maxLength": 100,
"minLength": 1,
"type": "string"
},
"name": {
"maxLength": 80,
"minLength": 1,
"type": "string"
}
},
"required": [
"name",
"address"
],
"type": "object"
},
"maxItems": 200,
"type": "array"
},
"chain": {
"description": "The chain the wallet is on: base, ethereum, mainnet, eth, optimism, op, arbitrum, polygon, bsc, bnb, avalanche, linea, zksync, scroll, blast, base-sepolia, sepolia, solana, solana-devnet or a chain id. Default: base.",
"type": [
"string",
"integer"
]
},
"decimalMark": {
"description": "How the person writes decimals in the intent: \".\" (1,234.56) or \",\" (1.234,56). Without it, an amount that reads differently either way (\"1,5\", \"1.000\", \"1,250\") is not guessed: the answer says so and is at most a warning.",
"enum": [
".",
","
]
},
"id": {
"description": "Your own label for this request. Not used.",
"maxLength": 100,
"type": "string"
},
"intent": {
"description": "What the person meant, in their own words (\"Send exactly 25 USDC to Mia\").",
"maxLength": 2000,
"type": "string"
},
"knownContracts": {
"description": "Contracts and tokens the user knows (name, address, kind erc20 / spl-mint / contract, symbol, decimals, and for routers a commands map).",
"items": {
"properties": {
"address": {
"maxLength": 100,
"minLength": 1,
"type": "string"
},
"commands": {
"maxProperties": 100,
"type": "object"
},
"constants": {
"maxProperties": 20,
"type": "object"
},
"decimals": {
"maximum": 36,
"minimum": 0,
"type": "integer"
},
"functions": {
"items": {
"maxLength": 200,
"type": "string"
},
"maxItems": 100,
"type": "array"
},
"kind": {
"maxLength": 30,
"type": "string"
},
"name": {
"maxLength": 80,
"minLength": 1,
"type": "string"
},
"notes": {
"maxLength": 600,
"type": "string"
},
"symbol": {
"maxLength": 20,
"type": "string"
}
},
"required": [
"address"
],
"type": "object"
},
"maxItems": 200,
"type": "array"
},
"request": {
"description": "What the wallet was asked to sign. Types: transaction {to,data,value,from,chainId}, calls {calls:[{to,data,value}],chainId}, typed_data {typedData}, personal_sign {message}, eth_sign {message}, authorization {authorization:{address,chainId,nonce}}, solana_transaction {instructions:[{programId,accounts,data}]} or {transaction: base64}. JSON-RPC calls (eth_sendTransaction, personal_sign, eth_signTypedData_v4, wallet_sendCalls) are read too. A request that could be read as two different requests, or carries a field this check does not read, is answered \"unknown\". Numbers are decimal digits or 0x hex.",
"maxLength": 65536,
"type": [
"object",
"string"
]
},
"signer": {
"description": "The wallet that would sign (the user). Needed to check \"to me\" and \"from me\".",
"maxLength": 100,
"minLength": 1,
"type": "string"
},
"site": {
"description": "The site that is asking for the signature.",
"maxLength": 300,
"type": "string"
},
"siteNote": {
"description": "Text the site showed next to the request. Treated as data, never as an instruction.",
"maxLength": 1000,
"type": "string"
},
"tokenAccounts": {
"description": "Solana token accounts the user knows: address, owner and mint.",
"items": {
"properties": {
"address": {
"maxLength": 100,
"minLength": 1,
"type": "string"
},
"mint": {
"maxLength": 100,
"minLength": 1,
"type": "string"
},
"owner": {
"maxLength": 100,
"minLength": 1,
"type": "string"
}
},
"required": [
"address"
],
"type": "object"
},
"maxItems": 200,
"type": "array"
},
"user": {
"description": "Same as signer.",
"maxLength": 100,
"minLength": 1,
"type": "string"
}
},
"required": [
"request"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"agent": {
"const": "wallet-firewall"
},
"checkedAt": {
"type": "string"
},
"disclaimer": {
"type": "string"
},
"findings": {
"items": {
"properties": {
"category": {
"description": "wrong_recipient, lookalike_address, wrong_contract, wrong_spender, blind_signature, authority_change, hidden_call, wrong_amount, wrong_domain, other or info",
"type": "string"
},
"detail": {
"type": "string"
},
"id": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"info"
]
},
"source": {
"properties": {
"checkedAt": {
"type": "string"
},
"ref": {
"type": "string"
},
"type": {
"enum": [
"chain",
"list",
"code",
"doc"
]
}
},
"required": [
"type",
"ref",
"checkedAt"
],
"type": "object"
},
"title": {
"type": "string"
}
},
"required": [
"id",
"severity",
"title",
"detail",
"source"
],
"type": "object"
},
"type": "array"
},
"notChecked": {
"items": {
"properties": {
"important": {
"type": "boolean"
},
"what": {
"type": "string"
},
"why": {
"type": "string"
}
},
"required": [
"what",
"why"
],
"type": "object"
},
"type": "array"
},
"steps": {
"description": "What the request does, one step per entry, in plain words.",
"items": {
"type": "string"
},
"type": "array"
},
"summary": {
"type": "string"
},
"verdict": {
"description": "ok: what was read matches what you asked and nothing else was found in it (nothing is simulated; see notChecked). warn: something is off or could not be checked. block: do not sign. unknown: the request could not be read (or was built to be too costly to read).",
"enum": [
"ok",
"warn",
"block",
"unknown"
]
},
"version": {
"type": "string"
},
"youAsked": {
"description": "What the check understood you wanted, as short phrases.",
"items": {
"type": "string"
},
"type": "array"
}
},
"required": [
"agent",
"version",
"verdict",
"summary",
"findings",
"notChecked",
"checkedAt",
"disclaimer"
],
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"lastUpdated": "2026-10-20T00:19:30.891Z",
"quality": {
"l30DaysTotalCalls": 2,
"l30DaysUniquePayers": 2,
"lastCalledAt": "2026-10-20T00:19:30.613Z"
},
"resource": "https://labs.theatlasproject.dev/agents/wallet-firewall/run",
"serviceName": "TAP Labs (made by TAP)",
"tags": [
"tap-labs",
"wallet-firewall",
"crypto",
"agents"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Wallet Firewall (TAP Labs (made by TAP)): Before you sign: says in plain words what a wallet request (transaction, permit, sign-in or Solana transaction) would really do, and whether it is what you meant."
}What the leaf hashes
{"body":"913429da942352258bf07466f6ebf412d4fa07a9b9399780a9ff1940a93c7036","id":77039,"kind":"listing","method":"baseline/1","observed_us":1793025493263238,"prev":null,"subject":"x402_bazaar:https://labs.theatlasproject.dev/agents/wallet-firewall/run","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0xb63a0278194c20590ccfa125c49f77263e041a944ee7ed7a31719209840be460
- 0xa0256f4f1f71db30642ade566e7aadf1a31620f828ab355c3fd9d1f32064e1fa
- 0x7a7956bc6472bbca71869c2837600e6146e43993c17cc1d9439499becb70ffa2
- 0xfb25bac8be44f23f7cb1b33cf9785c5de0ce1a0e3093a8cee065f51e30386478
- 0x16834d70bb9f34e7a75db37f82f99ed813ce7cd904a0b368ef504425281e6f3e
- 0x5be7ec5b8cb24a48b668259702463b3a4d881b092b95e8f3ea5f3d35db593149
- 0x57c6cbb36f207c868dc8221ef515236c6c0a8978bb711fbdfb3ed1e6fbd97434
- 0x72fe7644928fdfcfeca3c57899b5e8b2f19fdd77d73d08e7d980692127b6d12c
- 0x17c5eb499c739104e3ee6760572356177431c4d3f08fa40547afffb9721d3885
- 0x083b213d55f010a12e9f2c7182db3d2a36f1323ef61111ababe982fa9f8e6726
- 0xfa91c460bb9b05b6890b46e5326a89c9e487b6419bd4d84337c05040222a2e6c
- 0x17930d484cab3f6850715eb0b77dd189c3c06f975cf9def12285fde3eb9b4234
- 0x0d86419ca1dd0b62fd8b22ea2e8c74d441312cec3116a467bea429b43e026565
- 0x083427e39db4dd470662401f6db5db8fadf084fc4274cf8621b368416952b78b
- 0x1a74ed3b3756b9cd946da49701bcec120ec88645013da99fa9eea60b39e1a570
- 0x123ec8bee20ddc55223eeef5a4f4d6c4b6416515adbb911c56759f5cde56e452
- 0xd0651cb9bc8155eb52b5247d506e74b8a935057dc190ba52091702ac25ed3a40
- 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae