Add sign-safe — offline signing-time transaction safety gate

[lrafasouza]

sign-safe v0.6.4 — offline pre-sign transaction review for Solana agents

Submitting sign-safe for the Solana AI Kit skill bounty.

• Repo: https://github.com/lrafasouza/sign-safe-skill
• Installable from npm: npx sign-safe <tx.b64> — https://www.npmjs.com/package/sign-safe
• Current public commit: e288e9d (this PR pins the submodule to it)
• Version: 0.6.4
• License: MIT
• Kit integration PR: feat: add sign-safe — offline signing-time transaction safety gate solana-ai-kit#34
• Public CI (green, Node 20 + 22): https://github.com/lrafasouza/sign-safe-skill/actions/runs/28447798616

Problem

Agent wallets increasingly receive transaction bytes from tools, protocols, and other agents. A spending limit or a post-hoc debugger does not protect the signer if the transaction itself silently transfers authority, delegates spend rights, changes ownership, abuses durable-nonce flows, or hides the dangerous action behind a proposal/execution wrapper.

sign-safe answers the pre-sign question: what am I about to authorize?

What it does

An offline, deterministic review gate. It decodes opaque Solana transaction/message bytes (legacy + v0 + Address Lookup Tables), derives writable/signer roles, clear-signs supported program instructions, detects danger primitives, computes signer outflow, and emits a machine-readable verdict — SIGN / HOLD / REJECT — with the CLI exit code mirroring it (0 / 10 / 20). The core has zero runtime dependencies; any RPC work is isolated behind adapters so the engine stays deterministic and testable.

What's new since v0.5

• Published to npm (sign-safe): npx sign-safe <tx.b64> for humans, npx sign-safe-mcp for agents, plus a library import.
• Real on-chain attack evidence: the two real Drift Protocol (~$285M, Apr 1 2026) exploit transactions, decoded offline → both HOLD (durable-nonce + Squads v4). See docs/real-attacks.md. Honest framing: HOLD = stop + human review; documented incidents, not "every attack."
• IDL-cross-verified registry: 69/69 Anchor instruction discriminators checked programmatically against canonical on-chain IDLs.
• Mutation + fuzz testing: Stryker (70.2% behavioral kill rate) + fast-check — 44,288 single-byte mutations of an authority transfer, 0 ever flip to SIGN (fail-closed, falsifiable).
• Benign corpus 100 → 500 real mainnet txs; precision 18.4% SIGN / 81.6% HOLD / 0% false-REJECT.

Validation

One line, no clone:

npx sign-safe <tx.b64>

Or reproduce the full suite from the public repo:

git clone https://github.com/lrafasouza/sign-safe-skill
cd sign-safe-skill
npm ci
npm run verify:all
npm run demo:attack-pack

Current evidence at e288e9d:

• 803 tests across 42 files
• TypeScript build clean
• fixture runner: 80 PASS / 0 FAIL
• attack replay: 37/37 held or rejected before signing; False SIGN: 0, plus 2 real Drift transactions held
• npm audit --omit=dev: 0 vulnerabilities; zero runtime dependencies
• public CI green on Node 20 and Node 22: https://github.com/lrafasouza/sign-safe-skill/actions/runs/28447798616

Honest limits

• SIGN does not mean "all risk is gone"; it means the transaction matches recognized benign patterns under the current policy.
• The 37/37 malicious result is for the curated replay pack, not a universal detection claim.
• sign-safe is pre-sign review, not on-chain enforcement. It complements simulation, wallet UX, human review, Squads policies, and runtime spending controls.

Why it fits the bounty

A reusable skill for agent wallets: a deterministic pre-sign review layer that runs offline, is tested exactly, ships on npm, and fails closed into HOLD/REJECT instead of silently approving opaque transaction bytes.