> For the complete documentation index, see [llms.txt](https://gotts.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gotts.gitbook.io/docs/prd-shared/safety-layers.md). # Safety Layers > **Last Updated**: 2026-02-19 | **Referenced by**: [MCP Server PRD](/docs/gotts-safe-mcp-server/mcp-server/09-safety.md), [Agents PRD](/docs/agents/agents/11-safety.md), [Vault PRD](/docs/gotts-vaults/vault/10-safety.md) > > This is the **single source of truth** for the defense-in-depth model used across all Gotts components. Do not redefine these layers in other documents; reference this file instead. *** ## 15-Layer Defense-in-Depth Model The model comprises 15 layers (0-10, 2.5, 13-15) organized into four zones: **Identity & Access** (0, 15), **Preventive** (1-3, 2.5), **Reactive** (4-6), and **Enforcement** (7-10, 13, 14). | Layer | Name | Purpose | Scope | Type | Bypass-Proof? | | ----- | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | -------------- | ---------------------------------- | | 0 | ERC-8004 Identity Verification | Agent must have registered identity NFT; reputation determines deposit caps and fee tiers | Vault only | Gate | No (admin can update adapter) | | 1 | Wallet Architecture | TEE key management (keys never in agent memory); per-agent scoped wallets; Privy/ZeroDev providers | All | Preventive | **Yes** (cryptographic) | | 2 | Prompt Security & Hallucination Detection | Input sanitization, CaMeL dual-LLM architecture, context integrity monitoring, data/decision separation; hallucination detection via on-chain grounding (agents must verify all data against on-chain state before acting) | All | Preventive | No (12% bypass rate per Anthropic) | | 2.5 | MCP Integrity Verification | Tool provenance signing, independent state verification via separate RPC, MCP-Guard 3-stage detection (96% accuracy), memory integrity hashing | All | Preventive | No (probabilistic) | | 3 | TEE-Enforced Policy Engine | Privy signing policies; calldata constraints enforced at signing time; per-agent spending limits; nonce management (assigned at signing, dedup retries) | All | Cryptographic | **Yes** (cryptographic) | | 4 | Time-Delayed Execution | Announce-wait-execute pattern; variable delays (Routine=0s, Standard=10min, Elevated=1hr, High=24hr, Critical=48hr) | Vault/Proxy | Reactive | No (requires monitoring) | | 5 | Active Monitoring + Cancel Authority | MonitorBot watches pending operations; CancelAuthority can veto before execution; multi-channel alerting | Vault/Proxy | Reactive | No (requires monitoring) | | 6 | Pre-Flight Simulation | `eth_call` fork simulation of exact calldata; divergence tolerance check; state change verification | All | Enforcement | No (state can change) | | 7 | On-Chain Guards | Safe Transaction Guards, ERC-7265 circuit breakers, token allowlists, slippage caps enforced at contract level | All | Immutable | **Yes** (cryptographic) | | 8 | Post-Trade Verification | Receipt parsing, outcome comparison (expected vs actual), anomaly detection, performance tracking | All | Enforcement | No (post-hoc) | | 9 | Agent Reputation | ERC-8004 identity + on-chain performance history; 5-tier trust system; endgame defection detection (D-028) | All | Enforcement | No (reputational) | | 10 | NAV Circuit Breaker + Position Monitoring | Adaptive CFI-driven thresholds (D-026); withdrawal velocity dampening; strategy pause on drawdown; emergency shutdown | Vault only | Vault-specific | No (configurable thresholds) | | 13 | V4 Hook Safety Checks | Validate hook permissions flags, verify `onlyPoolManager` access control, audit delta accounting, check HookRank safety scores. Prevents Cork Protocol-style exploits ($11M, May 2025). | V4 only | Enforcement | No (static analysis) | | 14 | Reputation-Gated Tool Access | ERC-8004 reputation tier determines which MCP tools an agent can invoke. Higher-risk tools (execute\_swap, vault\_rebalance) require higher reputation scores. Middleware enforcement in Gotts Safe. | All | Enforcement | No (configurable tiers) | | 15 | SIWE + OAuth 2.1 Authentication | Sign-In with Ethereum (EIP-4361) for agent identity proof; OAuth 2.1 for remote MCP server access; bearer token authentication for Streamable HTTP transport. | Remote only | Gate | No (session-based) | ### Key Properties * **Layers 1, 3, and 7** provide cryptographic enforcement that cannot be bypassed even by a fully compromised LLM. * **Layers 0 and 10** are vault-specific extensions; the core MCP server implements layers 1-3, 6-9, 13, and 14. * **Layers 4-5** are provided by the `packages/agent-proxy/` module and are usable outside the vault context. * **Layer 2.5** addresses the research consensus that the MCP interface -- not smart contracts -- is the primary attack surface for AI agents in DeFi (CrAIBench arXiv:2503.16248, TradeTrap arXiv:2512.02261). * **Layer 13** is V4-specific: hooks are validated before pool interactions involving hooked pools. * **Layer 15** applies to remote (Streamable HTTP) deployments only; local stdio deployments skip authentication. ### Scope Matrix | Component | Layers Implemented | | ----------------------------------------- | --------------------------------------------- | | Gotts Safe (`packages/safe/`) | 1, 2, 2.5, 3, 6, 7, 8, 9, 13, 14, 15 | | Agent framework (`packages/safe/agents/`) | 1, 2, 2.5, 3, 6, 7, 8, 9, 14 (via MCP server) | | Vault package (`packages/vault/`) | All (0-10, 2.5, 13-15) | | Proxy module (`packages/agent-proxy/`) | 4, 5 (standalone) | ### TEE Limitations The TEE.Fail attack (ACM CCS, October 2025) and Battering RAM (IEEE S\&P 2026) demonstrated that physical side-channel attacks using <$1K-$50 hardware can break Intel SGX, TDX, and AMD SEV-SNP. TEE is necessary but not sufficient — defense-in-depth across all 15 layers is critical. Time-delayed proxy execution (Layer 4) is the primary security primitive that no hardware attack can bypass (D-036). **Gotts uses Privy** (TEE + Shamir's Secret Sharing) as the primary Layer 1 and Layer 3 provider. Local private key (raw EOA key in `.env`) is available for dev/testing only — it provides no TEE isolation and no policy enforcement.