Halter

Halter is a spending firewall for AI agents on NEAR. One prompt injection can empty an agent's wallet, so Halter puts the limits on-chain, in the agent's own account. The account has no full-access key; its only key is a function-call key that may call execute, propose and report_scam on itself. Every payment passes the Halter Wallet contract: per-payment and rolling-24h caps, owner approval above a threshold and for first-time receivers, contacts and denylist, a contract-call allowlist, a rate limit and a guardian kill switch. Before paying, the contract asks the Halter Registry, a shared, bonded scam blocklist any agent can report to, via a cross-contract call that fails closed; owner approvals are re-checked. Agent-side, Halter Scout scores the receiver (registry, account age and activity, recent code changes, lookalike names, history) and answers allow, warn or block; the guard refuses on block and asks the human on warn. An MCP server gives any AI agent these payment tools while holding only the restricted key. We published the agent's private key on a red-team page: anyone can sign real testnet transactions with it and try to drain the wallet, including prompt-injecting the agent with or without our guard. Our 15-attack suite stops 15/15, and judges can rerun it with no setup. With six real models on NEAR AI Cloud, 7 of 24 attack decisions paid the attacker; in the on-chain run Halter blocked every one before signing. We audited our own contract and fixed what we found (registry check before the approval queue, storage-griefing caps, queue flooding), each with a regression test. NEAR makes this possible: function-call keys, contract-managed keys and cross-contract callbacks let the rules live in the account itself instead of on a custodian's server. MIT, 56 contract tests, 13 Scout tests, CI.