--- title: Self-serve scoped permissions and pre-signature checks for Safes and AI agents type: grant recipient: Protocol Wealth goal: 135000 summary: Self-custody fails at the moment of signing. This grant builds a self-serve app that turns on audited Zodiac controls with safe defaults, adds the pre-signature checks that do not exist yet, and scopes an AI agent so it holds no key. Apache 2.0 throughout. The largest milestone pays only when 100 Safes outside Protocol Wealth run it holding at least $20,000,000, verifiable onchain. duration: 12 url: https://initiatives.thedao.fund/initiative/self-serve-scoped-permissions-and-pre-signature-checks-for-s categories: wallets-signing funding_status: open raised: 0 funded_pct: 0 backer_count: 0 safe: 0x15802f6e43D733261882eaE22B4FBf89c0DBC095 chain_id: 1 --- ## Why this matters Self-custody fails at the moment of signing, not in the contract. The Bybit theft in February 2025 took about $1,500,000,000 and no contract was broken. Signers approved what they were shown. Marc Zeller of Aave said it after a friend was phished: "Even a 1/1 SAFE is far better than a hot wallet." Almost nobody does it, because a bare 1-of-1 Safe still signs whatever you approve. The failures are specific: - **Address substitution.** Clipboard hijackers such as AnimateClipper swap the destination the moment a user pastes it. - **Address poisoning.** A zero-value ERC-20 transfer still fires Transfer, so a lookalike lands in history and gets copied back out. - **Unbounded approvals.** A signature granted once keeps working long after the site is forgotten. - **Keys handed to software.** People wire AI agents to wallets with a private key, the hot wallet mistake with something faster at the controls. None of that is a cryptography problem. The money leaves because a person told a machine to send it and the machine obeyed. The industry's answer is a warning screen, which works only if someone reads it and stops. On a phone, in a hurry, on a site that looks right, people do not. The controls already exist as audited Zodiac modules. What does not exist is a way for an ordinary person to turn them on without reading module documentation. That is what this builds. The same modules answer the agent problem. A Roles module makes an AI agent a non-signer: no key, only the calls its role permits, enforced onchain, revocable in one transaction. The signer underneath stays whatever the owner already trusts, a hardware wallet, a passkey, an embedded signer such as Turnkey, or an MPC wallet such as Fordefi. **Why not stop at the signer?** Because a signing policy is a convention the key holder can lift. Turnkey's own documentation is explicit: actions approved by the root quorum bypass the policy engine entirely, and policies cannot limit root actions. That is the correct design for an unbrick path, and it means the policy is not a bound on a compromised holder. The threat here is a person who has been phished or an agent that has been hijacked, so the constraint has to sit where the signer cannot reach it, which onchain is a module. Key security and spend constraints are different jobs: Turnkey does the first one well across every network, and on networks without Safe its policy is all there is, which this work does not pretend otherwise about. ## The team **Protocol Wealth LLC**, a Delaware LLC and SEC-registered investment adviser, does the work. Nick Rygiel is the named maintainer. - **Nick Rygiel**, Managing Partner, CTO and CISO. USNA '04, Systems Engineering. Surface Warfare Officer aboard USS PORTER (DDG-78), AEGIS qualified, then unmanned systems at SCSTC Dahlgren. Deloitte on Department of Defense PKI identity management, then over a decade as a Merrill Lynch VP and Senior Financial Advisor. Founded Ironclad Financial, a multi-asset RIA covering traditional portfolios and digital assets, which merged into Protocol Wealth in 2025. CFP and CRPC professional, MBA, CRD 5996576. https://www.linkedin.com/in/nickrygiel/ - **Adam Blumberg**, Managing Partner and Chief Compliance Officer. CFP professional, Certified Digital Asset Advisor, registered since May 2009 (CRD 5656102). He founded Interaxis in 2019 to teach digital-asset literacy to other advisers, co-founded PlannerDAO, and previously ran his own RIA. The advisers this work has to reach are the ones he has spent years teaching. https://www.linkedin.com/in/adamblumberg/ - **Jason Leupold**, Managing Partner and CIO. CAIA charterholder, MBA. FINRA registered since February 2000 (CRD 4124810). Six years buy-side at Crabel Capital running the Asian Trade Desk and the FX Desk, then Fidelity Brokerage Services and Fidelity Personal & Workplace Advisors. https://www.linkedin.com/in/jasonleupold/ - **Brandon Hunt**, engineering contractor leading smart-contract delivery. Five years at Steer Protocol, most recently Lead Strategist and Senior Software Engineer, where he architected four generations of Solidity vault infrastructure and owned access control across the contract layer and the keeper network. https://www.linkedin.com/in/brandonjmhunt/ No other funder pays for this scope. Protocol Wealth runs client self-custody in production under fiduciary duty, so when this work says a control is safe to turn on, the maintainer already makes that claim with client money behind it. It has no relationship with Safe, Gnosis Guild, Turnkey or Fordefi beyond using their software. ## Why a grant: what already exists Safe{Wallet}'s web app depends on `zodiac-roles-deployments` at `^2.3.4`, declared in its own `apps/web/package.json`. The Zodiac Roles Modifier, Allowance Module and Delay Modifier are deployed and audited. This configures them rather than replacing them, so no new contract carries user funds. Protocol Wealth already operates this pattern with client assets: scoped module permissions over a Safe, with an agent named as proposer holding a zero-balance key. This grant moves that boundary onchain so it survives a compromised agent, and publishes the configuration. The adjacent work is thin, which is why this is worth funding rather than adopting: `txkit/mono` (MIT) has 7 stars and `zodiac-guard-scope` is untouched since March 2024. Two repositories this builds on are ours and public: `nexus-core` (Apache 2.0) and `pw-redact` (MIT). The price sits below a from-scratch build because the contracts are written, deployed and audited by other people. This pays for assembly, the checks that do not exist, and getting the result used. ## In scope Most of this money buys adoption rather than code. The build is the smaller half and is priced that way. - A **self-serve web app**: connect a Safe, pick a profile, and it deploys and configures the modules. No config files, no Zodiac documentation, no Safe UI walkthrough. - **Defaults that are safe before anyone configures anything**, every control adjustable afterwards, and an assistant that explains each choice and never signs. - **Deterministic pre-signature checks**: address similarity to prior counterparties, unlimited approvals, first contact with a contract, destination against stated intent. - A **model-assisted review layer** over the signer's own history, reporting only. - An **agent mode**: a Roles configuration in which an AI agent holds no key and calls only what its role permits. - One document read two ways: a Rule 206(4)-2 position an advisory firm can rely on, and plain guidance for an individual. - Paths in for existing key holders and for someone arriving through an embedded or MPC signer. ## Out of scope - Custody of anyone's keys. - A new token standard, smart account standard, wallet, or fork of Safe. Everything runs on contracts audited and deployed today. - A hosted service required to use it. The app is self-hostable and the configuration works without it. - Any check that can block a transaction on a model's say-so. Models report, code decides. - Formal verification of Safe or Zodiac. ## Commitments - Everything ships Apache 2.0 in a public repository from the first milestone. - Protocol Wealth maintains the app and configuration for 12 months after the last milestone, funded by the advisory practice that depends on it. - No new trusted party: no Protocol Wealth server is required, and no RPC provider, indexer, wallet, signer or model vendor is mandatory. - Every control can be turned off, with the removal path documented and tested in public CI. - Recovery is time-delayed, visible onchain before it executes, and cancellable by the owner. - Pinned target: at least 100 Safes outside Protocol Wealth running this configuration within 12 months of the first payment. - The project never holds a key, and no user is shown a seed phrase to copy somewhere unsafe. ## Milestones ### The module set and its defaults - $20,000 - A versioned Safe plus Zodiac configuration covering daily limits, dapp allowlists, two-factor approval and delayed recovery, public under Apache 2.0 - A published threat model naming which of phishing, address poisoning, drainer approval and key compromise each control stops, and which it does not - At least 30 test cases in public CI, each asserting a refusal as well as an allow - A deployment on at least 2 public testnets, addresses published in the README ### Pre-signature checks - $35,000 - Deterministic checks for address similarity, unlimited approvals, first contact with a contract, and destination against stated intent, each with tests passing in public CI - A model-assisted review layer holding no authority to sign or block, with that boundary demonstrated in a public test - The address-poisoning check runs at or below $0.001 per transaction, method and results published - Zero-value poisoning transfers excluded from displayed history and any address book, demonstrated in a public test - A public recording of a poisoning transaction being refused, with each check decision logged readably without the tool ### The self-serve app - $30,000 - A deployed app taking a person from a connected Safe to full configuration without editing a config file, live at a public URL - Default profiles safe before any configuration, published with their reasoning - An in-app assistant explaining each control, with a public test proving it cannot sign or authorize - Agent mode available in the app: an AI agent scoped by a Roles module, holding no key, revocable in one transaction - At least 10 people outside Protocol Wealth complete setup unassisted and say so publicly, naming the hardest step - The Rule 206(4)-2 position published, plus recovery documentation covering how to undo every control ### Adoption - $50,000 (adoption) - At least 100 Safes outside Protocol Wealth running this configuration, addresses listed on a public page and verifiable onchain by anyone - Those Safes hold at least $20,000,000 in total value, excluding every Protocol Wealth client and firm address, with the excluded list published and the total recomputable from public chain data - At least 3 named teams or wallet interfaces confirm publicly, in writing, that they have integrated it - At least 2 registered advisory firms outside Protocol Wealth confirm publicly they use the guidance with clients - At least 1 case, published with permission, of a check refusing a transaction the user would otherwise have signed - A written report on what adopters asked for that this does not do, published in the repository - A public metrics page covering Safes configured, total value secured, checks fired, refusals and open issues, updated from onchain data ## Links https://github.com/Protocol-Wealth/nexus-core https://github.com/Protocol-Wealth/pw-redact https://protocolwealthllc.com/opensource https://github.com/gnosisguild/zodiac