Move digital assets within your limits.

The delegation pointed to a sweeper contract. It could move funds and collect new deposits without another wallet signature. This was one part of the multichain theft.

Need delegates? Choose which contracts can act for your wallet and on which networks. Require approval before granting that access, or keep delegation off entirely.

Choose who can act for your wallet

authority "delegation-control" {
    intent = "evm.7702"
    version = "1"

    config {
        chainId = 1
    }

    approver security {
        type = "reference"
        id = "security"
        ref = "security@sha256:<digest>"
    }

    policy "delegation-control" {
        allow when {
            chainId == 1
            address == "0x1111111111111111111111111111111111111111"
            nonce == 7
        }

        require security
    }
}

The compromised Safe interface hid a transaction that gave the attacker control of the wallet.

The mandate and approvals are cryptographically bound to the exact transaction and signing key. A different recipient, amount, or transaction requires a new mandate and fresh approvals.

A phished npm account let the attacker publish modified JavaScript through the usual package channel.

Choose the contracts and methods your services may use, then set limits for each call. Unlisted calls can’t get your signature. MPC keeps a compromised app from extracting the full key and signing around those controls.

Choose contracts and methods

contract usdc: evm {
    address = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"

    fn transfer(to: address, amount: uint256)

    fn approve(spender: address, amount: uint256)
}

let USDC = 1000000
let router = "0xe592427a0aece92de3edee1f18e0157c05861564"

approver treasury {
    type = "reference"
    id = "treasury"
    ref = "treasury@sha256:<digest>"
}

approver security {
    type = "reference"
    id = "security"
    ref = "security@sha256:<digest>"
}

policy "token-spending" {
    allow "transfer" when {
        usdc.transfer != null
        usdc.transfer.amount > 0
        usdc.transfer.amount <= 10000 * USDC
        transaction.value == 0
        transaction.gasLimit <= 100000
    }

    allow "bounded-allowance" when {
        usdc.approve != null
        usdc.approve.spender == router
        usdc.approve.amount > 0
        usdc.approve.amount <= 1000 * USDC
        transaction.value == 0
    }

    allow "revoke-allowance" when {
        usdc.approve != null
        usdc.approve.amount == 0
        transaction.value == 0
    }

    require 2 of [treasury, security] if (
        usdc.transfer != null and usdc.transfer.amount > 1000 * USDC
    )
    require security if (usdc.approve != null and usdc.approve.amount > 0)
}