Inv #17: independent ERC-721 / collection-offer decoder — proceeds recipient distinct from asset recipient

[szhygulin]

Companion to vaultpilot-mcp #670 (closed as architectural) — MCP-side defense-in-depth shipped in PR #679.

Context

#670 described a rogue-agent + rogue-MCP collusion substituting the proceeds recipient inside an NFT collection-offer fill. With both layers hostile the attack is undefendable (the independent decode runs inside the rogue MCP; the cross-check runs in the rogue agent). The genuine rogue-MCP-only / cooperating-agent residual is improvable: PR #679 added safeTransferFrom (0x42842e0e / 0xb88d4fde) to the MCP's independent calldata decoder so the recipient + tokenId surface on uncurated NFT destinations. The skill-side half is an agent-facing decoder that distinguishes the proceeds recipient from the asset recipient on a marketplace fill.

Proposed rules (Inv #17)

1. For any NFT marketplace fill or collection-offer acceptance (Seaport / Blur / X2Y2), the agent MUST independently decode and surface, distinctly: the asset recipient (who receives the NFT) and the proceeds recipient (who receives the payment). A fill where the proceeds recipient is not the user's own address is the attack signal.
2. Surface to + tokenId from any safeTransferFrom in CHECKS PERFORMED (mirrors the MCP-side #679 decode), and flag when the recipient is not a known / owned address.
3. NFT marketplace fills are EIP-712 typed-data signing; couple this with the typed-data clear-sign defenses tracked at vaultpilot-mcp #453 — do not present a blind-signed collection-offer fill as verified.

Scope

Cooperating-agent guidance only — a rogue agent ignores any rule here. For the full agent+MCP collusion of #670 this buys nothing; it hardens the rogue-MCP-only case where a cooperating agent independently decodes. The residual anchor against full collusion is on-device clear-sign (#453).