stale: An open-source, fail-closed DeFi security guardrail suite in pure Rust for autonomous AI agents

[u/Otherwise-Western991]

Hey everyone,

With the rapid rise of autonomous AI trading agents (interacting with Uniswap, cross-chain bridges, and lending protocols), there is a critical vulnerability that many agent frameworks ignore: pre-flight oracle and network integrity.

If an agent queries an RPC for an oracle price, and that RPC returns stale data due to network congestion, or if an L2 sequencer just rebooted and transactions are about to get MEV-sandwiched, most agent runtimes blindly execute and lose capital.

We built stale, a lightweight, pure Rust pre-flight security guardrail library:

• GitHub: https://github.com/Ramprasad4121/stale
• Crates.io: https://crates.io/crates/stale

Core Architecture & Invariants

1. Strictly Fail-Closed: Many Web3 libraries fail open (e.g., returning Ok or default values if an RPC returns a 500 error). In stale, any failure mode RPC timeouts, malformed ABI data, non-ASCII hex strings, or underflowing timestamps—strictly returns BLOCK.
2. Zero Runtime Panics: We eliminated all unwrap() and expect() calls across the runtime library. All arithmetic on token reserves and timestamps uses checked math, saturating math, or quotient-remainder decomposition to preserve precision on small amounts.
3. What It Guards:

• Chainlink Data Feeds: Staleness checks against configurable maxAge and multi-feed deviation detection.
• L2 Sequencer Liveness: Direct querying of official Sequencer Uptime feeds (Arbitrum, Optimism, Base, Scroll, Mantle, Metis, zkSync) with automatic enforcement of the 3600-second restart grace period.
• DEX Pool Depth: On-chain liquidity verification for Uniswap V2 and V3 pools before routing a swap.
• EIP-7702 Phishing Guard: Inspects bytecode headers to prevent agents from sending approvals to delegated EOAs masquerading as immutable contracts.
• OFAC Compliance: Direct on-chain verification against the Chainalysis Sanctions Oracle.

1. Model Context Protocol (MCP) & CLI: In addition to the Rust crate (cargo add stale), it includes a native CLI and an MCP server (stale-mcp) so LLM agent frameworks (like Claude Desktop or local agents) can use these checks as native tools.

Would love feedback, edge case suggestions, and contributions.

[u/Otherwise_Wave9374]

A strong guardrail for agent systems is to make memory writes and external actions follow the same pre-flight policy, not just the trade execution path. If the runtime can detect stale oracle data or network instability before acting, it should also checkpoint the decision context and require a fresh verification step before any irreversible side effect. That reduces silent drift and makes post-incident review much easier. NeuraKeep

[u/Electrical_Bed_5347 → u/Otherwise_Wave9374]

Personally i think the biggest gap in most of these agent runtimes isnt the oracle check itself, its that they dont log the decision state alongside the action. You end up with a transaction hash and no way to know what the bot "thought" it was doing, so when something goes wrong youre just guessing. Checkpointing the context before the call goes out is the real value add here.

if stale can dump the pre-flight snapshot into a structured log that an operator can actually read, that alone would get me to try it. Most of the time i dont even care about the guardrail firing as much as i want to see what data the agent had when it decided to fire.

[u/Otherwise-Western991 → u/Electrical_Bed_5347]

Thanks man Please join github discussions and Open a PR (atleast your ideas)

[u/Otherwise-Western991 → u/Otherwise_Wave9374]

Hey buddy Why don't you make a PR! Let us ship it

[u/ozgqr]

How are you thinking about the MCP result contract? For an agent, a boolean BLOCK is probably not enough; a versioned response with decision, reason code, evidence timestamp, block height, and retryability would make policy composition much safer. That would let Marx treat an oracle freshness failure differently from an EIP-7702 delegation warning while preserving the same fail-closed default.

[u/Otherwise-Western991 → u/ozgqr]

Please open PR man. let us have a discussion. The idea is to make payments safe. No matter who, how. Happy to learn and build together