Search papers, labs, and topics across Lattice.
This paper introduces PACE (Policy-Attested Contract Execution), a framework designed to enhance the safety of AI agents operating in decentralized finance (DeFi) by providing a transaction-level authorization mechanism that mitigates the risks associated with prompt injection in large language models (LLMs). By implementing typed transaction intents, a deterministic policy verifier, and cryptographic binding through Policy Decision Records (PDRs), PACE ensures that only verified transactions are executed on-chain, achieving a 0.00 unsafe execution rate across extensive testing. The findings underscore the framework's effectiveness in maintaining safety without compromising functionality, contrasting sharply with the 0.80 unsafe execution rate observed in unguarded baselines.
PACE achieves a flawless safety record in DeFi transactions, eliminating unsafe executions while leveraging LLMs for complex financial operations.
Autonomous AI agents are emerging as interfaces for decentralized finance (DeFi) actions such as swaps, lending operations, and yield management. Because these agents rely on large language models (LLMs) to plan transactions, they inherit the LLM's susceptibility to prompt injection and lack of mechanisms to bind a verifier's approval to the exact transaction ultimately submitted on-chain. We present PACE (Policy-Attested Contract Execution), a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution. PACE introduces typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind the approved intent, policy, and simulation report to the exact execution bytes, with replay and expiration protection. A Solidity smart account enforces PDR signatures on-chain with a measured overhead of 29,826-31,822 gas. We evaluate PACE against six baselines on 40 tasks spanning four attack categories plus benign utility (2,800 trials, 10 seeds). In our deterministic sandbox, PACE achieves a 0.00 unsafe execution rate and 0.00 false-positive rate on benign tasks, compared to 0.80 for the unguarded baseline. Ablation studies identify permissive policy settings (+57.5 pp) and the touched-contract allowlist (+12.5 pp) as the dominant safety components. To test whether the same deterministic floor holds for real model outputs, the artifact additionally provides a three-model live-LLM evaluation over the full task suite with repeated runs. A mainnet-fork harness is included for archive-RPC deployments, but fork results are reported only when the corresponding artifacts are generated. These auxiliary studies are separate from, and never substitute for, the deterministic benchmark. We frame our claims as logic-level safety within a reproducible benchmark rather than deployment-ready DeFi security.
