Verifiable risk ratings and on‑chain guardrails for agent money

Summary

AI agents now hold and spend money. They can be talked into bad decisions, and the data they read can be fake: a token can carry a price with no money behind it, and an address can be planted to look like one the agent has paid before.

Svalin is a read-only service that rates what an agent is about to touch. It grades tokens by the trusted money in their trading pools, scores wallets for concentration and exposure, and checks a recipient before a payment. Every token grade can be recomputed by anyone from archived inputs. Two planned additions follow: the Svalin Registry puts grades on-chain where contracts can read them, and Svalin Guard lets an owner give an agent spending power under rules the blockchain enforces. Svalin itself never holds a key to anyone's funds. What is live and what comes next is on the roadmap.

1. The problem

Agents can be talked into things

In May 2026 a hidden instruction made an AI agent linked to Grok and Bankr transfer tokens reported at $150,000 to $204,000. No key and no contract was compromised; the model simply followed an instruction it should have refused. This is prompt injection, and it works on any agent that reads the open web.

A quoted price is only a quote

Anyone can create a token, give it a price and send it to a wallet. A tool that trusts the quoted price sees a fortune that cannot be sold. In the Svalin Index edition of 24 October 2026, only 96 of 4,419 NEAR tokens with a quoted price had enough real money behind them to grade above F. Several unvetted tokens borrow famous names such as NEAR or USDT, quoted like the real thing with a few dollars behind them.

A look-alike address steals the next payment

In address poisoning, an attacker sends a tiny transfer from an address with the same first and last characters as one the victim uses, so the victim copies the wrong one from their history. One victim lost about $50 million in USDT this way in December 2025. Agents that reuse recent addresses are an easy target.

Advice an agent can skip is not a safeguard

Scanners help only when the agent asks and obeys. An agent manipulated into a bad payment can also be manipulated into skipping the check. Limits that matter have to live outside the agent, in code it cannot change.

2. Design principles

• Read-only core. The rating service has no code path that signs for, approves or moves the funds of a wallet it analyses.
• Deterministic. The same inputs always give the same output. No language model computes a number.
• Verifiable. Index editions archive their inputs and fingerprints, so anyone can recompute every grade.
• Enforced, not advised. Where it matters, rules are checked by a contract the agent cannot bypass.
• Never charged for errors. Bad input is rejected before payment, and failed calls are never settled.

3. How Svalin fits together

In everyday terms: the Ratings are a food-safety inspector that grades every token. The Registry is the grade sticker in the window, readable by anyone. The Guard is a company card with rules: the employee, here the agent, can only spend through it, and it declines F-rated places, purchases over the limit and payments to strangers.

4. Svalin Ratings

Wallet risk reportsLive

Given a Solana wallet or a NEAR account, Svalin returns a priced portfolio and a risk report: a score from 0 (safest) to 100, a grade from A to F, and findings with next steps. The score looks at how much rides on a single asset, how large the stablecoin cushion is, and how much sits in unvetted or meme tokens. It measures how holdings are spread, not whether the owner can be trusted.

On NEAR, a report also says what the wallet would actually fetch if everything were sold now. A position that is large next to the real money in its pools cannot be sold at its quoted price, so a wallet that looks rich may not be. A wallet with nothing Svalin can price is not rated, so a fresh or spam-only wallet never shows as an A.

Check Before PayingLive

Before money moves, the check answers allow, caution or block, with reasons. It is deterministic: data sources gather the signals, and one function judges them.

• Block: the address is not a wallet (a token or a program), the account does not exist, or it imitates an address or name the payer has paid before, or a well-known NEAR account.
• Caution: the address is brand new or barely used, runs a contract, is about to receive a large first payment, or its history could not be read.
• Allow: none of the above.

If the payer's history cannot be read, the check says so and cautions instead of guessing, because a gap could hide the very payment a look-alike imitates. Try the free check.

Token grades: the Svalin IndexLive

The Index grades every NEAR token that Ref Finance prices by its real backing: the money its trading pools hold in tokens Svalin trusts, such as NEAR and USDC. A sale can never take out more than that. The grade answers one question: how much of a $1,000 sale would be lost to price movement?

Only trusted money counts, so pools where fake tokens trade against each other add nothing: fake tokens and freshly seeded pools were part of the April 2026 Rhea Finance exploit. New money also has to stay put before it counts, so a pool added this morning cannot lift a grade today. Grades describe how sellable a token is, not whether its project is good. See the live Index.

Every token also has exit prices: what selling $1K, $10K or $100K of it would actually fetch, how much can be sold close to the quoted price, and the most its whole supply could fetch. A wallet can show them beside a balance, a lender can size a loan by them, and an agent can check them before accepting a token as payment, at any sale size, through the API. They need nothing but an edition's data, so anyone can recompute them.

Verifiable editionsLive

The Index is rebuilt every few hours by a public workflow. Each edition keeps the exact data it was computed from and a fingerprint of it, and once a day an edition is sealed and never rewritten, so anyone can check that a grade was not changed after the fact. Each edition also records how earlier grades moved since, building a public track record.

Tokens are not walletsLive

A token address sent where a wallet was expected gets HTTP 422 with code token_address instead of a meaningless wallet score, and the caller is not charged. For a NEAR token, the answer carries its grade.

5. Svalin RegistryPlanned

The Registry is a NEAR contract that holds the latest token grades, so other contracts and agents can read them on-chain. Its layout follows the reputation and validation ideas of ERC-8004, the draft standard for trust records about AI agents.

• What it stores: for each graded token, its grade, real backing and edition; for the edition, its fingerprint, time and methodology.
• Unknown means F: a token that is not listed has no backing worth grading.
• Who can write: only Svalin's publishing key, a NEAR key that can publish grades and do nothing else, so even if it leaked it could not move money.
• How to check it: the fingerprint on-chain must match the public edition.
• Reading is free: any contract or agent can look up a token's grade.

6. Svalin GuardPlanned

The Guard is a small contract an owner deploys on their own account, such as vault.alice.near. It holds a spending budget. Someone else, usually an AI agent, gets a key that can only ask the Guard to trade or pay. The Guard checks each request against the owner's rules and the Registry, then executes it, refuses it, or queues it for the owner.

Roles and keys

• Owner: holds a full-access key, sets the policy, approves queued requests, freezes the Guard and withdraws at any time.
• Spender: holds a NEAR function-call key limited to the Guard's trade and pay methods. It cannot attach funds, call other contracts, add keys or withdraw. Its only power is to ask.
• Svalin: publishes grades to the Registry. It has no key to any Guard and no say over any owner's funds.

Rules an owner can set

• A minimum grade for any token the agent buys.
• Spending limits per payment and per day.
• A list of approved recipients, and a waiting period before paying a new one.
• Owner approval above a set amount, and a freeze switch.

The Guard is a general engine: one owner, one limited spender, rules the chain enforces. AI agents come first because they act fastest and are easiest to trick, but the same contract suits a trading bot, a team member paying contributors, or a person's own wallet in a safe mode. It is not custody by Svalin, not a full wallet, and not audited yet; until it is, budgets should stay small.

7. NEAR and Solana

The rating method is the same on every chain. How grades are published and enforced follows each chain's own tools.

Research NEAR Chain Signatures let a NEAR contract sign for other chains, including Solana. A Guard on NEAR could then be the only signer for an agent's Solana address: the rules live on NEAR, and the money can sit on Solana.

8. Security model

Rows about the Guard and the Registry describe their planned design; the rest is how Svalin works today.

9. Limitations

• Grades measure sellability, not quality, and are not investment advice.
• Solana prices are used as the data provider quotes them; the pool check covers NEAR only for now.
• The recipient check sees recent history only, and there is no NEAR scam list yet.
• Exit value and exit prices cover NEAR for now and count only NEAR pools, so a token that also trades elsewhere could fetch more. Exit value assumes each position is sold on its own.
• The Registry and the Guard are designs; the Guard will not be audited at first.

References

1. Svalin Index editions
2. MetaMask, crypto security report, May 2026 (Grok and Bankr)
3. Blockaid, address poisoning
4. NEAR access keys and Chain Signatures
5. ERC-8004: Trustless Agents
6. x402