The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Warda listing page.
Give agents money. Not unlimited authority.
An open protocol for creating, delegating, verifying and enforcing cryptographic economic grants for autonomous software agents, on Kaspa.
A principal commits funds to a grant and defines what the agent may do with them. The property that matters:
The agent cannot exceed the authority encoded in its grant — even if the agent itself, its wallet software, or the Warda backend is compromised.
Enforcement is not a policy in a database. It is a Toccata covenant: the settlement layer refuses to produce a valid transaction.
An agent was prompt-injected and told to pay an address outside its allowlist. The network refused the transaction.
| Legitimate spend — accepted | 36f3dff2e5218651d80e62f1c7e620313a58fbc6ecd18a81d68050a33544fb55 |
| Prompt injection — refused | e251a20effea166c90f9cf4f19e28073856e57b3dc9ef0209269347e7a1396f1 |
Same grant, same address, same key — differing in one field, the payee. Full detail in DEPLOYED.md.
The spend and delegation covenants exist and are proven against
TxScriptEngine — the same script engine a Kaspa node uses to validate a
transaction. 33 covenant tests, 45 protocol tests, sub-second, no node required.
| Protocol semantics | @warda_protocol/core, 45 tests |
| Spend covenant | proven, 1,810 bytes |
| Delegation covenant | proven, conservation demonstrated |
| Consensus limits | measured — LIMITS.md |
| Signing path | verified — SIGNING.md |
| On a public network | testnet-10 — DEPLOYED.md |
Nothing here has touched mainnet, and Silverscript itself is pre-v1 and may break without notice.
Each row below has a flip test: a spend the engine accepts, with exactly one field changed. Because the baseline passes, the rejection can only be caused by that field.
| Attack | Verdict |
|---|---|
| Prompt injection to an unlisted payee | rejected |
| Overspend past the per-transaction cap | rejected |
| Payment diverted after a valid proof | rejected |
| Agent rewrites its own authority | rejected |
| Successor state not advanced | rejected |
| Delegation escalation, on every axis | rejected |
| Authority created by delegating | rejected |
| A correctly formed spend | accepted |
This distinction matters more than it looks. The engine collapses every failed
require into one opaque VerifyError — it never says which rule rejected. So
assert!(is_err()) against a baseline that never passed proves nothing at all: a
malformed script produces the same verdict as a working per-spend cap.
The interesting parts of this project are the things that turned out not to be true. Each of these cost real debugging and is written up:
tx.daa is write-only, so
epochs need a different construction; expiry cannot be enforced — it is a
reclaim right, not a spend prohibition@warda_protocol/core internals and design rulesThe single best example: byte constant LEAF = 0x00 compiles to an empty
byte array, because Kaspa script encodes zero as the empty string. The Merkle
leaf domain separator silently vanished — the source read as domain-separated,
the bytecode was not. No code review catches that, and no test comparing one
implementation to itself catches it either, because both sides were consistently
wrong. It took per-opcode tracing against the real engine.
The presentation-layer challenge, covenant-side allowlist narrowing (a child currently inherits its parent's allowlist rather than narrowing it), multi-level delegation beyond one generation, and the hosted services.
MIT.