Address substitution
Clipboard hijackers swap the destination the moment a user pastes it.
Open-source grant proposal · TheDAO Security Fund
Self-custody fails at the moment of signing.
This proposal builds a self-serve app that turns on audited Safe and Zodiac modules with sensible defaults, adds the pre-signature checks that do not exist yet, and scopes an AI agent so it holds no key. Everything ships under Apache 2.0.
An early piece of milestone B is already working: try the signing check.
Goal $135,000Qualifies at 25%4 milestonesApache 2.0Status in October 2026: proposed, not started
Why this matters
No contract was broken.
The Bybit theft in February 2025 took about $1.5 billion, and no contract was broken. Signers approved what they were shown. The money leaves because a person told a machine to send it and the machine obeyed.
The controls that help already exist as audited Safe and Zodiac modules. What does not exist is a way for an ordinary person to turn them on without reading module documentation. That is what this builds.
Address poisoning
A zero-value ERC-20 transfer still emits a Transfer event, so a lookalike address lands in history and gets copied back out.
Unbounded approvals
A signature granted once keeps working long after the site is forgotten.
Keys handed to software
People wire AI agents to wallets with a private key: the hot-wallet mistake with something faster at the controls.
In scope
What gets built
- A self-serve web app: connect a Safe, pick a profile, and it deploys and configures the modules. No config files and no module documentation.
- Defaults chosen before anyone configures anything, every control adjustable afterwards, and an assistant that explains each choice and never signs.
- Deterministic pre-signature checks: address similarity to prior counterparties, unlimited approvals, first contact with a contract, and destination against stated intent.
- A model-assisted review layer over the signer’s own history that reports only. Models report; code decides.
- An agent mode: a Roles configuration in which an AI agent holds no key and can call only what its role permits, revocable in one transaction.
- One document read two ways: a written Rule 206(4)-2 analysis for advisory firms, and plain guidance for an individual. It is a milestone C deliverable and has not been written yet.
Out of scope
What it will not do
- Custody of anyone’s keys.
- A new token standard, smart-account standard, wallet, or fork of Safe.
- A hosted service required to use it. The app is self-hostable and the configuration works without it.
- Any check that can block a transaction on a model’s say-so.
- Formal verification of Safe or Zodiac.
It configures the Zodiac Roles Modifier, the Zodiac Delay Modifier and Safe’s Allowance Module, which are already deployed and audited. No new contract carries user funds.
Milestones
Paid only when each one is accepted.
An independent technical reviewer with no ties to the team decides whether each milestone passes. The largest milestone pays only on adoption by Safes outside Protocol Wealth, verifiable onchain by anyone.
Milestone A
$20,000
The module set and its defaults
- A versioned Safe and Zodiac configuration covering daily limits, dapp allowlists, two-factor approval and delayed recovery, public under Apache 2.0
- A published threat model naming which attacks each control stops, and which it does not
- At least 30 test cases in public CI, each asserting a refusal as well as an allow
- Deployment on at least two public testnets, addresses in the README
Milestone B
$35,000
Pre-signature checks
- Deterministic checks for address similarity, unlimited approvals, first contact with a contract, and destination against stated intent, each tested in public CI
- A model-assisted review layer with no authority to sign or block, with that boundary demonstrated in a public test
- The address-poisoning check runs at or below $0.001 per transaction, with method and results published
- A public recording of a poisoning transaction being refused, with each decision logged readably
Milestone C
$30,000
The self-serve app
- A deployed app taking a person from a connected Safe to full configuration without editing a config file
- Default profiles published with their reasoning
- Agent mode in the app: an AI agent scoped by a Roles module, holding no key
- At least 10 people outside Protocol Wealth complete setup unassisted and say so publicly
- The Rule 206(4)-2 analysis published, plus documentation for undoing every control
Milestone D
$50,000
Adoption
- At least 100 Safes outside Protocol Wealth running the configuration, listed publicly and verifiable onchain
- Those Safes hold at least $20,000,000 in total, excluding every Protocol Wealth client and firm address, with the excluded list published
- At least 3 named teams or wallet interfaces confirm in writing that they have integrated it
- At least 2 registered advisory firms outside Protocol Wealth confirm publicly that they use the guidance
Summarized from the proposal as filed. The milestones are a draft until the grant agreement fixes them.Read the full text.
Commitments
What the team commits to
- Everything ships under Apache 2.0 in a public repository from the first milestone.
- Protocol Wealth maintains the app and configuration for 12 months after the last milestone.
- No new trusted party: no Protocol Wealth server is required, and no RPC provider, indexer, wallet, signer or model vendor is mandatory.
- Every control can be turned off, with the removal path documented and tested in public CI.
- Recovery is time-delayed, visible onchain before it executes, and cancellable by the owner.
- The project never holds a key, and no user is shown a seed phrase to copy somewhere unsafe.
The team
Who does the work
Nick Rygiel
Managing Partner, CTO and CISO. Named maintainer.
Adam Blumberg
Managing Partner and Chief Compliance Officer.
Jason Leupold
Managing Partner and CIO.
Brandon Hunt
Engineering contractor leading smart-contract delivery.
Work this builds on is already public: nexus-core (Apache 2.0) and pw-redact (MIT).
How to back it
Donate, or pledge and pay only if it is fully funded.
Donate
On the initiative page
Donations are made in USDC on TheDAO Security Fund’s page, under its donation terms. Current totals are shown there.
Open the initiativePledge
Commit now, pay at the goal
A pledge is a public commitment paid only when the entire goal is reached. Email TheDAO Security Fund to add one.
[email protected]The vote
25% before mid-November 2026
An initiative funded or pledged to 25% of its goal qualifies for TheDAO Security Fund’s year-end 2026 vote, where it can be funded the rest of the way. The initiative page shows the current deadline.
How the fund worksOpen source, not an advisory service
This is an open-source software project. Backing it does not create an advisory relationship with Protocol Wealth and is not an investment. Protocol Wealth LLC is the named grant recipient, and payments follow TheDAO Security Fund’s milestone rules.
Protocol Wealth does not ask its advisory clients, or the vendors it uses for client accounts, to fund this work. Client Safes and client assets are excluded from every adoption figure.