{"id":77039,"recorded_at":"2026-10-26T14:38:13.263272Z","observed_at":"2026-10-26T14:38:13.263238Z","subject_kind":"source_record","subject":"x402_bazaar:https://labs.theatlasproject.dev/agents/wallet-firewall/run","kind":"listing","method":"baseline/1","body":{"endpoints":[["x402","https://labs.theatlasproject.dev/agents/wallet-firewall/run"]],"name":"TAP Labs (made by TAP)","owner_address":"0x6409a21a5c77a31e2bf55f6f00c62bab2a5a7e59","raw":{"accepts":[{"amount":"20000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:8453","payTo":"0x6409a21A5c77a31e2BF55f6F00C62baB2A5a7e59","scheme":"exact"}],"description":"Wallet Firewall (TAP Labs (made by TAP)): Before you sign: says in plain words what a wallet request (transaction, permit, sign-in or Solana transaction) would really do, and whether it is what you meant.","extensions":{"bazaar":{"info":{"input":{"body":{"addressBook":[{"address":"0x2f4e6a8c0b1d3f5a7c9e1b3d5f7a9c0e2b4d6f81","name":"Mia"}],"chain":"base","intent":"Sign a Permit2 permit letting SwapRouter spend exactly 100 USDC.","knownContracts":[{"address":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","decimals":6,"kind":"erc20","name":"USD Coin","symbol":"USDC"},{"address":"0x5e2d4c6b8a0f1e3d5c7b9a2f4e6d8c0b1a3f5e7d","kind":"contract","name":"SwapRouter"},{"address":"0x000000000022d473030f116ddee9f6b43ac78ba3","kind":"contract","name":"Permit2"}],"request":{"type":"typed_data","typedData":{"domain":{"chainId":8453,"name":"Permit2","verifyingContract":"0x000000000022d473030f116ddee9f6b43ac78ba3"},"message":{"details":{"amount":"1461501637330902918203684832716283019655932542975","expiration":"1798761600","nonce":"0","token":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913"},"sigDeadline":"1792000000","spender":"0x5e2d4c6b8a0f1e3d5c7b9a2f4e6d8c0b1a3f5e7d"},"primaryType":"PermitSingle","types":{"EIP712Domain":[{"name":"name","type":"string"},{"name":"chainId","type":"uint256"},{"name":"verifyingContract","type":"address"}],"PermitDetails":[{"name":"token","type":"address"},{"name":"amount","type":"uint160"},{"name":"expiration","type":"uint48"},{"name":"nonce","type":"uint48"}],"PermitSingle":[{"name":"details","type":"PermitDetails"},{"name":"spender","type":"address"},{"name":"sigDeadline","type":"uint256"}]}}},"signer":"0x7a3b8c1d5e9f2a4b6c8d0e1f3a5b7c9d1e2f4a6b"},"bodyType":"json","method":"POST","type":"http"},"output":{"example":{"agent":"wallet-firewall","checkedAt":"2026-10-17T12:00:00.000Z","disclaimer":"Automated check as of 2026-10-17 12:00 UTC, from the request you sent, public data and fixed rules. It is not a guarantee and not financial or legal advice. Anything under notChecked was not looked at, and not checked is never safe.","findings":[{"category":"info","detail":"1. Let SwapRouter (0x5e2d…5e7d) spend any amount of USDC (no limit) (by signature, no transaction needed) through Permit2, until 2027-01-01 00:00 UTC","id":"what-it-does","severity":"info","source":{"checkedAt":"2026-10-17T12:00:00.000Z","ref":"wallet-firewall: decoded from the request you sent","type":"code"},"title":"What this request does, step by step (1)"},{"category":"wrong_amount","detail":"You asked for exactly 100 USDC. The amount in the request is the largest a permit can hold.","id":"permit-unlimited","severity":"critical","source":{"checkedAt":"2026-10-17T12:00:00.000Z","ref":"EIP-2612 and Permit2: https://eips.ethereum.org/EIPS/eip-2612 and https://docs.uniswap.org/contracts/permit2/overview","type":"doc"},"title":"The permit allows any amount of USDC"},{"category":"info","detail":"MyEtherWallet darklist (652 addresses, as of 2026-10-17); OFAC SDN list (US Treasury), digital currency addresses. A miss on a list means nothing: they are short and late.","id":"lists-read","severity":"info","source":{"checkedAt":"2026-10-17T12:00:00.000Z","ref":"MyEtherWallet darklist; OFAC SDN list","type":"list"},"title":"Public lists that were read"}],"notChecked":[{"what":"what the request would do on the live chain","why":"it is read from the request itself; nothing was simulated, run or sent"},{"what":"what the contracts it touches really do","why":"their code is not read from the chain here; only the request and the lists you gave are used"}],"steps":["let SwapRouter (0x5e2d…5e7d) spend any amount of USDC (no limit) (by signature, no transaction needed) through Permit2, until 2027-01-01 00:00 UTC"],"summary":"Do not sign. As of 2026-10-17 12:00 UTC: The permit allows any amount of USDC. You asked for exactly 100 USDC. The amount in the request is the largest a permit can hold.","verdict":"block","version":"0.2.1","youAsked":["sign a permit letting SwapRouter spend 100 USDC"]},"type":"json"}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"addressBook":{"description":"People the user knows: names and addresses.","items":{"properties":{"address":{"maxLength":100,"minLength":1,"type":"string"},"name":{"maxLength":80,"minLength":1,"type":"string"}},"required":["name","address"],"type":"object"},"maxItems":200,"type":"array"},"chain":{"description":"The chain the wallet is on: base, ethereum, mainnet, eth, optimism, op, arbitrum, polygon, bsc, bnb, avalanche, linea, zksync, scroll, blast, base-sepolia, sepolia, solana, solana-devnet or a chain id. Default: base.","type":["string","integer"]},"decimalMark":{"description":"How the person writes decimals in the intent: \".\" (1,234.56) or \",\" (1.234,56). Without it, an amount that reads differently either way (\"1,5\", \"1.000\", \"1,250\") is not guessed: the answer says so and is at most a warning.","enum":[".",","]},"id":{"description":"Your own label for this request. Not used.","maxLength":100,"type":"string"},"intent":{"description":"What the person meant, in their own words (\"Send exactly 25 USDC to Mia\").","maxLength":2000,"type":"string"},"knownContracts":{"description":"Contracts and tokens the user knows (name, address, kind erc20 / spl-mint / contract, symbol, decimals, and for routers a commands map).","items":{"properties":{"address":{"maxLength":100,"minLength":1,"type":"string"},"commands":{"maxProperties":100,"type":"object"},"constants":{"maxProperties":20,"type":"object"},"decimals":{"maximum":36,"minimum":0,"type":"integer"},"functions":{"items":{"maxLength":200,"type":"string"},"maxItems":100,"type":"array"},"kind":{"maxLength":30,"type":"string"},"name":{"maxLength":80,"minLength":1,"type":"string"},"notes":{"maxLength":600,"type":"string"},"symbol":{"maxLength":20,"type":"string"}},"required":["address"],"type":"object"},"maxItems":200,"type":"array"},"request":{"description":"What the wallet was asked to sign. Types: transaction {to,data,value,from,chainId}, calls {calls:[{to,data,value}],chainId}, typed_data {typedData}, personal_sign {message}, eth_sign {message}, authorization {authorization:{address,chainId,nonce}}, solana_transaction {instructions:[{programId,accounts,data}]} or {transaction: base64}. JSON-RPC calls (eth_sendTransaction, personal_sign, eth_signTypedData_v4, wallet_sendCalls) are read too. A request that could be read as two different requests, or carries a field this check does not read, is answered \"unknown\". Numbers are decimal digits or 0x hex.","maxLength":65536,"type":["object","string"]},"signer":{"description":"The wallet that would sign (the user). Needed to check \"to me\" and \"from me\".","maxLength":100,"minLength":1,"type":"string"},"site":{"description":"The site that is asking for the signature.","maxLength":300,"type":"string"},"siteNote":{"description":"Text the site showed next to the request. Treated as data, never as an instruction.","maxLength":1000,"type":"string"},"tokenAccounts":{"description":"Solana token accounts the user knows: address, owner and mint.","items":{"properties":{"address":{"maxLength":100,"minLength":1,"type":"string"},"mint":{"maxLength":100,"minLength":1,"type":"string"},"owner":{"maxLength":100,"minLength":1,"type":"string"}},"required":["address"],"type":"object"},"maxItems":200,"type":"array"},"user":{"description":"Same as signer.","maxLength":100,"minLength":1,"type":"string"}},"required":["request"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"properties":{"agent":{"const":"wallet-firewall"},"checkedAt":{"type":"string"},"disclaimer":{"type":"string"},"findings":{"items":{"properties":{"category":{"description":"wrong_recipient, lookalike_address, wrong_contract, wrong_spender, blind_signature, authority_change, hidden_call, wrong_amount, wrong_domain, other or info","type":"string"},"detail":{"type":"string"},"id":{"type":"string"},"severity":{"enum":["critical","high","medium","low","info"]},"source":{"properties":{"checkedAt":{"type":"string"},"ref":{"type":"string"},"type":{"enum":["chain","list","code","doc"]}},"required":["type","ref","checkedAt"],"type":"object"},"title":{"type":"string"}},"required":["id","severity","title","detail","source"],"type":"object"},"type":"array"},"notChecked":{"items":{"properties":{"important":{"type":"boolean"},"what":{"type":"string"},"why":{"type":"string"}},"required":["what","why"],"type":"object"},"type":"array"},"steps":{"description":"What the request does, one step per entry, in plain words.","items":{"type":"string"},"type":"array"},"summary":{"type":"string"},"verdict":{"description":"ok: what was read matches what you asked and nothing else was found in it (nothing is simulated; see notChecked). warn: something is off or could not be checked. block: do not sign. unknown: the request could not be read (or was built to be too costly to read).","enum":["ok","warn","block","unknown"]},"version":{"type":"string"},"youAsked":{"description":"What the check understood you wanted, as short phrases.","items":{"type":"string"},"type":"array"}},"required":["agent","version","verdict","summary","findings","notChecked","checkedAt","disclaimer"],"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"}}},"lastUpdated":"2026-10-20T00:19:30.891Z","quality":{"l30DaysTotalCalls":2,"l30DaysUniquePayers":2,"lastCalledAt":"2026-10-20T00:19:30.613Z"},"resource":"https://labs.theatlasproject.dev/agents/wallet-firewall/run","serviceName":"TAP Labs (made by TAP)","tags":["tap-labs","wallet-firewall","crypto","agents"],"type":"http","x402Version":2},"source":"x402_bazaar","summary":"Wallet Firewall (TAP Labs (made by TAP)): Before you sign: says in plain words what a wallet request (transaction, permit, sign-in or Solana transaction) would really do, and whether it is what you meant."},"body_sha256":"913429da942352258bf07466f6ebf412d4fa07a9b9399780a9ff1940a93c7036","prev_id":null,"leaf":"0xb639d3119e5e6f5aa1e57175d0abef0c0db04fde18ae00c8aa622699ae8f0d4b","leaf_text":"{\"body\":\"913429da942352258bf07466f6ebf412d4fa07a9b9399780a9ff1940a93c7036\",\"id\":77039,\"kind\":\"listing\",\"method\":\"baseline/1\",\"observed_us\":1793025493263238,\"prev\":null,\"subject\":\"x402_bazaar:https://labs.theatlasproject.dev/agents/wallet-firewall/run\",\"subject_kind\":\"source_record\"}","day":{"day":"2026-10-26","leaves":296695,"root":"0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8","chained":"0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a","anchor_chain":"eip155:5042002","anchor_tx":"0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae","anchor_block":69251483},"proof":["0xb63a0278194c20590ccfa125c49f77263e041a944ee7ed7a31719209840be460","0xa0256f4f1f71db30642ade566e7aadf1a31620f828ab355c3fd9d1f32064e1fa","0x7a7956bc6472bbca71869c2837600e6146e43993c17cc1d9439499becb70ffa2","0xfb25bac8be44f23f7cb1b33cf9785c5de0ce1a0e3093a8cee065f51e30386478","0x16834d70bb9f34e7a75db37f82f99ed813ce7cd904a0b368ef504425281e6f3e","0x5be7ec5b8cb24a48b668259702463b3a4d881b092b95e8f3ea5f3d35db593149","0x57c6cbb36f207c868dc8221ef515236c6c0a8978bb711fbdfb3ed1e6fbd97434","0x72fe7644928fdfcfeca3c57899b5e8b2f19fdd77d73d08e7d980692127b6d12c","0x17c5eb499c739104e3ee6760572356177431c4d3f08fa40547afffb9721d3885","0x083b213d55f010a12e9f2c7182db3d2a36f1323ef61111ababe982fa9f8e6726","0xfa91c460bb9b05b6890b46e5326a89c9e487b6419bd4d84337c05040222a2e6c","0x17930d484cab3f6850715eb0b77dd189c3c06f975cf9def12285fde3eb9b4234","0x0d86419ca1dd0b62fd8b22ea2e8c74d441312cec3116a467bea429b43e026565","0x083427e39db4dd470662401f6db5db8fadf084fc4274cf8621b368416952b78b","0x1a74ed3b3756b9cd946da49701bcec120ec88645013da99fa9eea60b39e1a570","0x123ec8bee20ddc55223eeef5a4f4d6c4b6416515adbb911c56759f5cde56e452","0xd0651cb9bc8155eb52b5247d506e74b8a935057dc190ba52091702ac25ed3a40","0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f","0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a"]}