Imagine telling a financial assistant, “Move some of my stablecoins into a lending pool.” The assistant sketches a plan: approve a token transfer, call a contract, deposit the funds. Then a detail hidden in a token name or market feed nudges it toward a different destination. In ordinary chat, a model’s mistake is usually just a wrong answer. In decentralized finance, an agent’s mistake can become a transaction that is difficult or impossible to reverse.
A new system called PACE takes aim at that gap by changing where the final decision happens. Instead of asking an AI model to reliably recognize every dangerous instruction, it treats the model as an untrusted planner. A separate, rule-bound verifier checks the proposed action, and a smart account checks the approval again before the transaction runs. The key idea is simple: let the AI suggest a move, but don’t let its suggestion count as permission.
That distinction matters because financial transactions are not just sentences. They are precise bundles of instructions: which contract to contact, how much value to send, what data to include, and what permissions to grant. PACE first turns a proposed action into a structured “transaction intent” with fields for those details. A user-defined policy can then set limits: which addresses and tokens are allowed, how much can be spent, what slippage is acceptable, and whether unlimited token approvals should be rejected.
Next comes a simulation: a preview of what the proposed transaction would do. A deterministic verifier checks both the intent and the simulation against the policy. It does not ask the AI whether the action is safe. If the checks pass, the verifier creates a signed Policy Decision Record, or PDR, linking the approval to the policy, the simulation, and the exact transaction data. Before execution, a smart account checks that signature and confirms that the transaction still matches what was approved.
That last check addresses a subtle weakness in relying on previews alone. Suppose a transaction is simulated and approved, but the data sent to the blockchain changes afterward. A preview cannot protect against a different action. PACE’s record includes a cryptographic binding to the exact data; if that data is altered, the mismatch should block execution. The researchers describe the division of labor this way: the AI proposes, the verifier decides, and the blockchain account enforces.
To test the approach, the researchers built 40 tasks covering four kinds of attacks—prompt injection, unsafe contracts, DeFi exploit patterns, and attacks involving transaction ordering or slippage—alongside ordinary tasks that should be allowed. They compared PACE with six alternatives, from an unguarded agent to systems using policy checks or simulations without the full signed-record mechanism. The deterministic benchmark ran 2,800 trials across 10 seeds.
Within that test environment, PACE made the expected decision on every task: it had a 0.00 unsafe-execution rate and a 0.00 false-positive rate on benign tasks. The unguarded baseline had an unsafe-execution rate of 0.80. The strongest comparison system that used policy checks and simulation but lacked PACE’s binding between the approved and submitted data still let a calldata-mutation attack through. In that test, the transaction changed after simulation; PACE rejected the mismatch.
The researchers also removed parts of the system to see what mattered. Making the policy permissive raised the unsafe-execution rate by 57.5 percentage points; removing the touched-contract allowlist raised it by 12.5 points. Those results point to an important, less glamorous part of the design: a gate is only as useful as the rules it enforces. A user or system designer still has to choose sensible limits and define what counts as an unacceptable action.
There is a cost to putting this checkpoint on-chain. Verifying the signed record added 29,826–31,822 gas per transaction in the researchers’ measurements—a material relative cost for simple approvals and transfers, and a smaller share for a swap. The central trade-off is clear: stronger authorization brings extra computation and depends on carefully chosen policies.
The perfect-looking benchmark result needs an equally careful reading. The main experiments used an in-memory DeFi simulator and a regex-based mock AI, not a live financial system. The authors explicitly say those results demonstrate logic-level behavior in a reproducible test, not security against adaptive attackers on real chains. Their separate live-model evaluation tested three models across 595 trials. PACE-guarded attack success was 0.000 in those runs, but benign false positives ranged from 5.0% to 12.8%. The paper also describes a mainnet-fork harness but makes no fork-result claims unless corresponding results are generated.
Even the cryptographic binding has a boundary: it can show that the executed bytes match the approved bytes, but it cannot guarantee that market conditions stayed the same between simulation and execution. Nor can a policy block a harmful transaction that obeys the policy as written. The researchers flag harmful multi-step sequences and more realistic, adaptive attacks as open problems.
PACE is not a demonstration that autonomous financial agents are ready to manage real money. It is a proposed way to move one critical safety question out of the model’s judgment and into a checkable process. As AI systems gain the ability to take actions, that shift may be more consequential than making them sound more confident: a system can remain fallible at planning while being denied the authority to carry out a plan that fails its rules.
