Rollcage

Security modelv0.2 · 2026-10-15

Read-only today. The agent's key alone can't move funds by design.

What the build does today, what it never touches, and how the cosigner is designed: the keys, untrusted input, the public and private parts of the test suite, and what a claim will cover.

In one minute.

  • Today Rollcage runs one service: the agent wallet check. It reads public mainnet data and returns a report. It is read-only: no keys, no signatures, no custody, no payments.
  • Signing in signs one message in your wallet. It's a message, not a transaction, so it can't move anything, and the signature stays in your browser tab.
  • Beta: we keep request logs for 30 days; no accounts, no personal data.
  • Crash tests, the cosigner and the guarantee are in private beta. From Three keys on, this page describes their design.

The current build

What runs today.

The wallet check

  • Input: one public wallet address. Never a private key or a seed phrase.
  • It reads the balance, the token accounts and their approvals, and the last 100 transactions on Solana mainnet, through an RPC provider.
  • Output: a report. Nothing is signed, sent, approved or paid.
  • Nothing is written to a database: an answer stays in memory for 5 minutes per address, to serve repeats.

Sign in with Solana

  • Your wallet signs one message with a one-time nonce. No transaction, no fee.
  • The session and the signature stay in this browser tab and end when you sign out or close it.
  • No email, no password, no profile. Your account is your address.
  • The wallets you checked are listed for this tab only, and cleared on sign-out.

Beta: we keep request logs for 30 days; no accounts, no personal data.

The design · private beta

Three keys, one smart account.

How the cosigner is designed. The agent proposes, Rollcage checks and co-signs, your team holds the way back in. A transaction moves funds only with the agent's signature and Rollcage's co-signature.

Agent key

Proposes transactions.

Rollcage key

Co-signs only after the checks.

Owner recovery key

Held by your team.

The design: three keys around one smart account, the agent's key, Rollcage's key and your team's recovery key.

Agent key

Held by
Your agent, on your infrastructure.
Signs
Every transaction the agent proposes.
Limit
Alone, it can't move funds.

Rollcage key

Held by
Rollcage. The only key it will hold.
Signs
Only transactions that passed simulate, policy and mandate check, or that your team approved after a hold.
Limit
Alone, it can't move funds. It never starts a transaction.

Owner recovery key

Held by
Your team. Keep it offline.
Signs
Recovery: replacing the agent key or the Rollcage key.
Limit
Not used for day-to-day transactions.

The design · failure modes

If something fails.

If the agent is fooled

The cosigner checks the transaction, not the agent's reasoning. A transfer outside the mandate is held or blocked, however convincing the input that led to it.

If the agent key leaks

Whoever holds it can only propose. Every transaction still needs Rollcage's co-signature, after the same checks. Replace the key with your recovery key.

If Rollcage's key is compromised

It can't move funds without the agent's signature, and it can't start a transaction.

If Rollcage is offline

Nothing gets co-signed, so the agent can't move funds: the account fails closed. Your recovery key still works.

Untrusted input

Untrusted input is data, never instructions.

Token metadata, memos, web pages and DMs are where attacks on agents arrive. Today, the wallet check treats token names from on-chain metadata as untrusted: it cuts them to plain characters and shows the shortened mint instead of any name that reads like a link or a lure. The cosigner is designed the same way: it assumes your agent may be fooled and judges what it tries to do.

What arrives

  • Untrusted input · token metadata · redacted
  • Untrusted input · memo · redacted
  • Untrusted input · web page · redacted
  • Untrusted input · DM · redacted

Labelled by source and passed as quoted data. Never as instructions, never raw.

What the cosigner will read

  • The simulated transaction: balance changes, recipients, programs, delegates.
  • Your policy: allowed programs, per-transaction and daily limits, velocity.
  • The mandate, in your words.

What comes out

  • Allow, hold or block, with the reason in plain words.
  • In reports and on this site, untrusted input appears only as a redaction bar.

The test suite · private beta

Public families, private scenarios.

We name the families and publish the counts, so you can see what a score covers. We never publish scenario bodies: a published scenario is a recipe for attackers and a target to train against.

Public

  • Family names and scenario counts: suite v3.2, ten families, 2,140 scenarios.
  • The grading: score 0–100, 1–5 stars.
  • Certificates on Solana (SAS), once agents pass: score, stars, suite version, date, attestation ID, scope.
  • The public board, for results a team chooses to publish. It opens with the first certified agents.

Private

  • Scenario bodies: the inputs and the traps. Scenario body · redacted
  • Your report: failures, footage, fixes.
  • Your endpoint, your policy and your mandate.

Suite v3.2 · scenario families

  • Metadata injection340
  • Memo & log injection210
  • Web content injection260
  • Social DM pressure180
  • Fake claims & malicious Blinks220
  • Honeypot tokens150
  • Liquidity & slippage traps240
  • Lookalike addresses120
  • Permission & delegate abuse160
  • Mandate drift260

The core suite runs 200 scenarios drawn from these families; certification runs all 2,140. The crash-test sandbox is cloned from mainnet: it calls your endpoint and simulates what the agent proposes. Nothing is broadcast, and the test never asks for your keys.

The guarantee · private beta

What a claim will cover.

Checks can be wrong. In the guarantee's design, if Rollcage co-signs a transaction and it turns out to be a drain, Rollcage pays.

Covered

  • A transaction Rollcage co-signed that turned out to be a drain.

Not covered

  • Keys leaked outside Rollcage.
  • Transactions we didn't co-sign.

Claim timeline

  1. File

    Send the signature of the co-signed transaction.

  2. Review

    We check it against its record: simulation, policy, mandate.

  3. Decision

    Paid, or declined with the reason in writing.

  4. Payout

    Up to your coverage limit.

Planned price: 3% per year of protected balance, billed monthly, from $100 protected. For teams, 2–4% per year, cosigner included. Planned payments: x402, an exact USDC transfer for the price in the 402, with no token approvals and no delegates. Beta: calls are free; the x402 flow is the planned paid tier and is not enforced.

Hard rules

What we never do.

  • Ask for your agent's private key, your recovery key or a seed phrase.
  • Sign, send or approve anything from the wallet check.
  • Move funds with our key alone.
  • Co-sign a held transaction before a person on your team approves it.
  • Publish scenario bodies, or write out attack content anywhere.
  • Publish your report or your score unless you choose to.
  • Ask for a token approval or a delegate when you pay.

Disclosure

Report a vulnerability.

DM @rollcage_sol on X (opens in a new tab) with what you found and the steps to reproduce it. Test only against wallets, agents and funds that are yours.