Summary
Adversarial scripts 136 (NEAR Intents) and 137 (Wormhole/Mayan) confirm the trust boundary vaultpilot-preflight SKILL.md lines 290-294 explicitly accepts is exploitable.
Outer LiFi BridgeData passes Invariant #6 cleanly (destinationChainId + bridge label match the ground-truth allowlist). The attacker recipient lives one decode-layer deeper:
NearData.receiverAccountId (NEAR Intents)MayanData.nonEvmRecipient (32-byte SVM)
The Ledger ETH app blind-signs LiFi calldata, so the user cannot catch the swap on-device. Defense today is best-effort agent address-extraction (not skill-mandated) plus opt-in second-LLM check (friction-prone at high value, plus the rogue-agent omit-the-offer attack).
Why this is high-impact
A meaningful fraction of EVM-outbound bridge volume routes through bridges whose final recipient is encoded inside opaque facet data: Wormhole, Mayan, NEAR Intents, Across V3, deBridge, Stargate composeMsg.
Proposal — Invariant #6b + tier-1 decoders
Maintain a per-bridge facet decoder in the MCP (mirrored in the skill). Tier-1 must-have:
- Wormhole TokenBridge
transferTokensWithPayload
- Mayan
MayanData.nonEvmRecipient
- NEAR Intents
intent.receiver
- Across V3
depositV3.recipient
After Inv #6 strict-pair passes, Inv #6b decodes the per-bridge facet and asserts decodedFinalRecipient == userSuppliedRecipient. Mismatch → STOP with ✗ BRIDGE-FACET RECIPIENT MISMATCH — DO NOT SIGN.
Tier-2 (best-effort): deBridge / DLN, Stargate composeMsg, Hop, Symbiosis. Gate: signing requires either a tier-1 decoder match OR explicit user override after second-LLM check.
Source
Adversarial smoke-test, 2026-04-28. Scripts 136, 137.
🤖 Generated with Claude Code
Summary
Adversarial scripts 136 (NEAR Intents) and 137 (Wormhole/Mayan) confirm the trust boundary
vaultpilot-preflightSKILL.md lines 290-294 explicitly accepts is exploitable.Outer LiFi
BridgeDatapasses Invariant #6 cleanly (destinationChainId + bridge label match the ground-truth allowlist). The attacker recipient lives one decode-layer deeper:NearData.receiverAccountId(NEAR Intents)MayanData.nonEvmRecipient(32-byte SVM)The Ledger ETH app blind-signs LiFi calldata, so the user cannot catch the swap on-device. Defense today is best-effort agent address-extraction (not skill-mandated) plus opt-in second-LLM check (friction-prone at high value, plus the rogue-agent omit-the-offer attack).
Why this is high-impact
A meaningful fraction of EVM-outbound bridge volume routes through bridges whose final recipient is encoded inside opaque facet data: Wormhole, Mayan, NEAR Intents, Across V3, deBridge, Stargate composeMsg.
Proposal — Invariant #6b + tier-1 decoders
Maintain a per-bridge facet decoder in the MCP (mirrored in the skill). Tier-1 must-have:
transferTokensWithPayloadMayanData.nonEvmRecipientintent.receiverdepositV3.recipientAfter Inv #6 strict-pair passes, Inv #6b decodes the per-bridge facet and asserts
decodedFinalRecipient == userSuppliedRecipient. Mismatch → STOP with✗ BRIDGE-FACET RECIPIENT MISMATCH — DO NOT SIGN.Tier-2 (best-effort): deBridge / DLN, Stargate composeMsg, Hop, Symbiosis. Gate: signing requires either a tier-1 decoder match OR explicit user override after second-LLM check.
Source
Adversarial smoke-test, 2026-04-28. Scripts 136, 137.
🤖 Generated with Claude Code