{"ok":true,"count":94,"verdictPolicy":"verdict = highest severity among triggered rules; risk_score = 15 per WARN + 40 per DENY + 20 for intent_mismatch + 50 for injection_pattern, capped at 100","rules":[{"code":"zero_address","severity":"DENY","layer":"transaction","description":"Target, transfer recipient, spender or operator is the zero address or 0x...dEaD."},{"code":"set_approval_for_all","severity":"DENY","layer":"transaction","description":"setApprovalForAll(operator, true): full control over every token of the collection."},{"code":"approval_to_eoa","severity":"DENY","layer":"transaction","description":"approve / increaseAllowance / permit / setApprovalForAll to an address without contract code (a plain wallet)."},{"code":"address_poisoning","severity":"DENY","layer":"transaction","description":"Recipient or spender shares the visible prefix and suffix of an address in context.known_addresses but is a different address."},{"code":"contract_lookalike","severity":"DENY","layer":"transaction","description":"Address imitates a well-known contract or token from the built-in registry (same 4+4 hex characters, different address)."},{"code":"permit_spender_mismatch","severity":"DENY","layer":"transaction","description":"A Permit2 permit embedded in a Universal Router call grants allowance to a contract other than the router."},{"code":"permit2_pull_to_third_party","severity":"DENY","layer":"transaction","description":"A Universal Router PERMIT2_TRANSFER_FROM sends your tokens to an address that is neither you nor the router."},{"code":"unlimited_approval","severity":"WARN","layer":"transaction","description":"Approval amount is MAX_UINT256 or above 2^255 (effectively unlimited), including Permit2 permits embedded in router calls."},{"code":"unknown_spender","severity":"WARN","layer":"transaction","description":"Unlimited allowance to a contract that is not in the known-protocol registry; notes upgradeable proxies and tiny contracts."},{"code":"router_output_to_third_party","severity":"WARN","layer":"transaction","description":"A swap, sweep, unwrap or transfer step inside a router call sends output to an address that is neither you nor the router."},{"code":"fresh_recipient","severity":"WARN","layer":"transaction","description":"Recipient of an ERC-20/721/1155 or native transfer has nonce 0, zero balance and no code."},{"code":"unknown_selector","severity":"WARN","layer":"transaction","description":"Function selector is not recognised or calldata cannot be decoded."},{"code":"calldata_to_eoa","severity":"WARN","layer":"transaction","description":"Calldata is attached but the target has no contract code."},{"code":"simulation_reverted","severity":"WARN","layer":"simulation","description":"eth_call from the supplied \"from\" reverts; the decoded revert reason is included."},{"code":"simulation_unavailable","severity":"WARN","layer":"simulation","description":"Simulation was requested (\"from\" supplied) but the RPC failed."},{"code":"insufficient_balance","severity":"WARN","layer":"simulation","description":"ERC-20 balance of \"from\" is below the transfer amount."},{"code":"rpc_unavailable","severity":"WARN","layer":"transaction","description":"On-chain checks could not run. Fail-safe: never ALLOW."},{"code":"funds_flow_to_flagged","severity":"DENY","layer":"asset-flow","description":"Simulation shows value ending at an address listed in the ScamSniffer database, reported as a drainer, or imitating a known contract, even though the transaction itself does not name that address."},{"code":"funds_flow_no_return","severity":"WARN","layer":"asset-flow","description":"Simulation shows the sender giving value to a plain wallet (not a contract) through an unrecognised call and receiving nothing back. The classic shape of a \"claim\" or \"mint\" drain."},{"code":"intent_mismatch","severity":"WARN","layer":"intent","description":"Declared agent_goal does not match the decoded transaction intent, or the caller set intent_match=false."},{"code":"goal_escalation","severity":"DENY","layer":"intent","description":"agent_goal is read/analyze but the transaction is an approve, setApprovalForAll, token transfer or native transfer."},{"code":"untrusted_source_before_tx","severity":"WARN|DENY","layer":"context","description":"recent_sources contains domains outside the trusted list and the transaction is an approve/transfer. DENY when the amount is large (unlimited approval, setApprovalForAll, >= LARGE_AMOUNT_RAW, or native >= 0.1)."},{"code":"injection_pattern","severity":"DENY","layer":"context","description":"recent_sources contains a hostname matching phishing patterns: brand impersonation, typosquatting, homoglyphs, punycode, suspicious TLD, phishing keywords, bare IP, deep subdomain chain."},{"code":"rapid_context_shift","severity":"WARN","layer":"runtime","description":"The last tool call before the transaction was an ingest tool (web_fetch, read_file, ...) and the transaction does not match agent_goal."},{"code":"memory_poisoning_signal","severity":"WARN","layer":"runtime","description":"More than 3 distinct untrusted domains were consumed in the same session_id within SESSION_TTL_MS."},{"code":"context_analysis_failed","severity":"WARN","layer":"runtime","description":"The context analyzer threw an unexpected error. Fail-safe: verdict is at least WARN."},{"code":"known_drainer","severity":"DENY","layer":"shared-intel","description":"Counterparty address was reported by multiple independent agents for on-chain-attributable DENY rules (approval_to_eoa, contract_lookalike, permit_spender_mismatch, permit2_pull_to_third_party). Thresholds: THREAT_DENY_REPORTS / THREAT_DENY_REPORTERS."},{"code":"flagged_address","severity":"WARN","layer":"shared-intel","description":"Counterparty address has at least THREAT_WARN_REPORTS report(s) in the shared threat registry."},{"code":"known_phishing_domain","severity":"DENY","layer":"shared-intel","description":"A source domain was previously reported as phishing (brand impersonation, typosquatting, punycode, SIWE phishing) by other agents."},{"code":"session_compromised_likely","severity":"DENY","layer":"session","description":"Within SESSION_TTL_MS the session accumulated >= SESSION_WARN_THRESHOLD WARN verdicts, >= SESSION_DENY_THRESHOLD DENY verdicts, or cumulative risk >= SESSION_RISK_THRESHOLD. Stop signal for the agent."},{"code":"session_risk_elevated","severity":"WARN","layer":"session","description":"Session has 2+ WARN, 1+ DENY or cumulative risk >= 60 within the window."},{"code":"template_critical_deviation","severity":"DENY","layer":"differential","description":"Compared with context.reference_tx: target, function, recipient, spender or operator changed; bounded approval became unlimited; native value appeared; an approval/permit or a new output recipient appeared inside the call; router plan gained money-moving commands."},{"code":"template_deviation","severity":"WARN","layer":"differential","description":"Compared with context.reference_tx: amount or native value increased, or the router plan differs in non-money-moving commands."},{"code":"shared_state_unavailable","severity":"WARN","layer":"shared-intel","description":"A persistent store is configured but did not answer; shared-intel and session-health checks were skipped."},{"code":"scam_database_address","severity":"DENY","layer":"shared-intel","description":"Counterparty address is listed in the curated public ScamSniffer scam database. DENY for every role, including plain transfers, because most real drains are victims sending straight to the listed address."},{"code":"scam_database_domain","severity":"DENY","layer":"shared-intel","description":"A source domain (or its parent domain) is listed in a public phishing database (ScamSniffer)."},{"code":"eth_sign_deprecated","severity":"DENY","layer":"signature","description":"eth_sign over an arbitrary 32-byte hash."},{"code":"blind_hash_signing","severity":"DENY","layer":"signature","description":"personal_sign over a raw 32-byte non-text value."},{"code":"opaque_hex_message","severity":"WARN","layer":"signature","description":"personal_sign over non-text bytes."},{"code":"siwe_phishing_domain","severity":"DENY","layer":"signature","description":"Sign-In-With-Ethereum domain matches a phishing pattern."},{"code":"siwe_domain_mismatch","severity":"WARN","layer":"signature","description":"SIWE domain and URI host differ."},{"code":"siwe_address_mismatch","severity":"WARN","layer":"signature","description":"SIWE message account differs from the signer."},{"code":"authorization_text_in_message","severity":"WARN","layer":"signature","description":"Plain-text message contains authorisation language plus an address."},{"code":"phishing_url_in_message","severity":"DENY","layer":"signature","description":"Plain-text message links to a phishing-pattern host."},{"code":"signature_transfer_authorization","severity":"WARN","layer":"signature","description":"Permit2 PermitTransferFrom: the spender can pull tokens immediately."},{"code":"far_deadline","severity":"WARN","layer":"signature","description":"Permit or order deadline beyond PERMIT_MAX_DEADLINE_DAYS (default 30) or never expires."},{"code":"expired_deadline","severity":"WARN","layer":"signature","description":"Permit deadline already passed."},{"code":"permit2_domain_mismatch","severity":"DENY","layer":"signature","description":"Permit2-shaped message whose verifyingContract is not the canonical Permit2."},{"code":"seaport_zero_consideration","severity":"DENY","layer":"signature","description":"Seaport order that gives items away with no payment to the offerer."},{"code":"verifying_contract_is_eoa","severity":"DENY","layer":"signature","description":"EIP-712 domain verifyingContract has no code."},{"code":"authority_is_eoa","severity":"WARN","layer":"signature","description":"An authority field in unrecognised typed data names a plain wallet."},{"code":"unrecognized_authorization","severity":"WARN","layer":"signature","description":"Unrecognised typed data contains spender/operator-like fields."},{"code":"domain_chain_mismatch","severity":"WARN","layer":"signature","description":"typedData.domain.chainId differs from the requested chainId."},{"code":"payment_network_unsupported","severity":"WARN","layer":"payment","description":"The challenge settles on a network Guardian cannot inspect (non-EVM or unknown chain); on-chain checks were skipped."},{"code":"testnet_payment","severity":"WARN","layer":"payment","description":"The challenge asks for payment on a testnet. Real services on OKX.AI settle on mainnet."},{"code":"unknown_payment_scheme","severity":"WARN","layer":"payment","description":"The x402 scheme is not one of exact, upto, aggr_deferred or period."},{"code":"unknown_settlement_asset","severity":"WARN","layer":"payment","description":"The asset is not a recognised x402 settlement stablecoin on this network."},{"code":"asset_lookalike","severity":"DENY","layer":"payment","description":"The asset imitates a canonical stablecoin (same visible prefix/suffix) but is a different contract."},{"code":"asset_not_contract","severity":"DENY","layer":"payment","description":"The asset address has no contract code; no token can be paid there."},{"code":"asset_mismatch_listing","severity":"DENY","layer":"payment","description":"The token in the challenge differs from the token the marketplace listing promised."},{"code":"eip712_domain_mismatch","severity":"WARN","layer":"payment","description":"extra.name / extra.version do not match the canonical EIP-712 domain of the asset; the signature will be rejected or signed for a different token."},{"code":"amount_above_listing","severity":"DENY","layer":"payment","description":"The amount requested is higher than the listed price (price bait-and-switch)."},{"code":"amount_above_user_cap","severity":"DENY","layer":"payment","description":"The amount exceeds the spending cap the agent was given (context.max_amount)."},{"code":"upto_cap_above_listing","severity":"WARN","layer":"payment","description":"An upto (metered) authorisation allows charging more than the listed price."},{"code":"recurring_payment","severity":"WARN","layer":"payment","description":"The period scheme authorises recurring charges; confirm the subscription terms with the user."},{"code":"permit2_approval_required","severity":"WARN","layer":"payment","description":"Permit2-based schemes need a one-time token approval to the canonical Permit2 contract; approve only Permit2, never another spender."},{"code":"payto_zero_address","severity":"DENY","layer":"payment","description":"The payee is the zero address; funds would be burned."},{"code":"payto_is_asset","severity":"DENY","layer":"payment","description":"The payee is the token contract itself; funds sent there are usually unrecoverable."},{"code":"payto_mismatch_listing","severity":"DENY","layer":"payment","description":"The payee differs from the wallet the marketplace listing names for this provider."},{"code":"payto_poisoning","severity":"DENY","layer":"payment","description":"The payee shares the visible prefix/suffix of a known or expected address but is a different address."},{"code":"multiple_payees","severity":"WARN","layer":"payment","description":"accepts[] entries pay different recipients; make sure the entry you select pays the provider."},{"code":"long_payment_timeout","severity":"WARN","layer":"payment","description":"maxTimeoutSeconds is unusually long, so a signed authorisation stays usable for a long time."},{"code":"payment_domain_mismatch","severity":"DENY","layer":"payment","description":"The URL that returned the 402 is on a different domain than the listed endpoint."},{"code":"resource_host_mismatch","severity":"WARN","layer":"payment","description":"The resource.url in the challenge points to a different domain than the URL the agent called."},{"code":"insecure_payment_endpoint","severity":"WARN","layer":"payment","description":"The paid endpoint uses plain http, so the challenge can be altered in transit."},{"code":"endpoint_url_injection","severity":"DENY","layer":"payment","description":"The endpoint or resource URL carries shell syntax (command separators, pipes, brace expansion, command substitution). It targets buyer agents that pass the URL to a shell, such as curl in a tool call."},{"code":"challenge_field_injection","severity":"DENY","layer":"payment","description":"A free-text field of the 402 challenge (extra.name, extra.version, resource.description, error) carries a shell payload such as $(...), a quote break followed by a command, or a chained curl/base64. Honest sellers never need this."},{"code":"endpoint_phishing_pattern","severity":"DENY","layer":"payment","description":"The paid host imitates someone (brand impersonation, typosquatting, punycode, bare IP) and no marketplace listing vouches for it."},{"code":"endpoint_domain_suspicious","severity":"WARN","layer":"payment","description":"The paid host imitates a brand but is the endpoint named in the marketplace listing, or it only has a weak pattern (abused TLD, phishing keyword, deep subdomains) and no listing names it. Weak patterns on a listed endpoint are ignored."},{"code":"accepted_mismatch","severity":"DENY","layer":"payment","description":"The signed payload's accepted requirement differs from the challenge (recipient, amount, asset, network or scheme)."},{"code":"signed_recipient_mismatch","severity":"DENY","layer":"payment","description":"The signed authorisation pays a different address than the challenge payTo."},{"code":"signed_amount_mismatch","severity":"DENY","layer":"payment","description":"The signed authorisation allows more than the challenge amount."},{"code":"signed_token_mismatch","severity":"DENY","layer":"payment","description":"The signed Permit2 authorisation moves a different token than the challenge asset."},{"code":"signed_spender_not_x402_proxy","severity":"DENY","layer":"payment","description":"The signed Permit2 authorisation names a spender other than the canonical x402 Permit2 proxy for this scheme."},{"code":"signed_network_mismatch","severity":"DENY","layer":"payment","description":"The signed payload is for a different network than the challenge."},{"code":"signed_validity_too_long","severity":"WARN","layer":"payment","description":"The signed authorisation stays valid far longer than the challenge maxTimeoutSeconds."},{"code":"signed_expired","severity":"WARN","layer":"payment","description":"The signed authorisation is already expired or not yet valid; the payment will be rejected."},{"code":"signed_payer_mismatch","severity":"WARN","layer":"payment","description":"The signed authorisation spends from a different wallet than context.from."},{"code":"signature_does_not_recover","severity":"WARN","layer":"payment","description":"The EIP-3009 signature does not recover to authorization.from; the facilitator will reject it."},{"code":"challenge_header_body_mismatch","severity":"DENY","layer":"payment","description":"The PAYMENT-REQUIRED header (or the entries a wallet quote persisted) and the 402 JSON body describe different payments. Whoever reads the body is shown one payee or price while the wallet signs another."},{"code":"quote_inconsistent","severity":"DENY","layer":"payment","description":"An Onchain OS payment quote disagrees with itself: the payee, amount, token or network in its summary differs from the accepts entry that payment pay will sign."},{"code":"quote_expired","severity":"WARN","layer":"payment","description":"The persisted Onchain OS quote has expired; payment pay will refuse it, so quote again and check the new paymentId."},{"code":"quote_partial","severity":"WARN","layer":"payment","description":"The quote output does not include the full challenge (header-only seller), so the EIP-712 domain and free-text fields were not visible. Check the persisted payment state instead."},{"code":"listing_not_checked","severity":"WARN","layer":"payment","description":"No marketplace listing was supplied or resolved, so price, token and payee were not compared against a listing. On its own this is not a safe-to-pay result."}]}