DEV Community

jackpeking
jackpeking

Posted on

Why Parsing 35 Bytecode Flags in an LLM Prompt is Slowing Down Autonomous Trading Agents

#rust #ai #web3 #autonomousagents

Over the past few months building execution loops for autonomous trading agents across EVM and Solana, our engineering team ran into an architectural bottleneck: the "raw data supermarket" anti-pattern in Web3 security APIs.

When an autonomous LLM agent decides to execute an on-chain action (a swap, liquidity provision, or smart contract interaction), existing security tooling dumps 35+ unopinionated bytecode flags over HTTP:

  • is_honeypot: false
  • has_blacklist: true
  • hidden_owner_slot: 0x0...
  • sell_tax: 0.15
  • can_take_back_ownership: false

...and expects the LLM prompt to reason through what combination constitutes a critical rug pull.

The Flaws of Prompt-Level Bytecode Reasoning

Running this in high-frequency agent loops exposes two fatal problems:

  1. Latency and Token Overhead: Injecting a 2KB JSON blob of raw security telemetry into every trade evaluation burns context tokens and spikes reasoning latency by 400ms–1,200ms.
  2. Hallucination Under Ambiguity: LLMs are probabilistic engines. Under edge cases (e.g., dynamic tax hooks or multi-sig proxies), small variations in system prompts cause models to misjudge dangerous trapdoors.

First Principles: "The Verdict is the Product"

For autonomous execution pipelines, agents don't need raw telemetry; they need a deterministic go/no-go boundary.

We designed GuardDog (https://guarddog.top) around a single principle: evaluate the bytecode deterministically off-chain, and return an actionable verdict within 23ms (P95 server-side).

Verdict Specification:

  • PASS: Clean contract, mainstream liquidity verification, zero trapdoor bytecode.
  • WARN: High tax, unrenounced ownership, or unverified proxy logic (requires downstream agent risk threshold logic).
  • BITE: Verified honeypot, transfer blacklists, or malicious drain logic. Immediate execution abort.

Integrating with Rust Agents (Rig Framework)

Following the community interest check on Rig issue #2908, we submitted the integration PR to awesome-rig (PR #24) and open-sourced the Rust client guarddog-rs.

Here is the entire 90-line implementation using standard reqwest + serde:

use serde::Deserialize;

#[derive(Debug, Deserialize, PartialEq)]
#[serde(rename_all = "UPPERCASE")]
pub enum Verdict {
    Pass,
    Warn,
    #[serde(alias = "BLOCK")]
    Bite, // the API returns BLOCK; BITE is the brand name
}

#[derive(Debug, Deserialize)]
pub struct SafetyReport {
    pub verdict: Verdict,
    pub risk_score: u32,
    pub covered: bool,
    pub reasons: Vec<String>,
    pub data_limited: bool,
}

pub struct GuardDog {
    client: reqwest::Client,
    base_url: String,
}

impl GuardDog {
    pub fn new() -> Self {
        Self {
            client: reqwest::Client::new(),
            base_url: "https://api.guarddog.top/v1".to_string(),
        }
    }

    pub async fn check(&self, chain: &str, contract: &str) -> Result<SafetyReport, reqwest::Error> {
        // NOTE: the param name is `target`, not `address`
        let url = format!("{}/check?chain={}&target={}", self.base_url, chain, contract);
        self.client.get(&url).send().await?.json::<SafetyReport>().await
    }
}
Enter fullscreen mode Exit fullscreen mode

Usage in an Agent Loop: 

let guard = GuardDog::new();
let report = guard.check("solana", "TokenContractAddressHere").await?;

if report.verdict == Verdict::Bite {
    println!("Malicious contract detected: {:?}", report.reasons);
    return Ok(ExecutionResult::Aborted);
}
Enter fullscreen mode Exit fullscreen mode

Reproducible Testing: Open Benchmarks Over Marketing

To ground our detection claims, we open-sourced the Agent Honeypot Benchmark (AHB-1000) on GitHub:

  • Repository: https://github.com/guarddog-top/agent-honeypot-benchmark
  • Dataset: 1,000 real-world malicious contracts collected from academic corpora and live DEX telemetry.
  • Results: 100% dataset coverage (1,000/1,000 contracts evaluated, zero unhandled errors), 48.1% alert rate on active deceptive tokens, 0.0% false positives across top 100 mainstream liquidity pairs.

Developer Free Tier

We provide an anonymous, zero-signup free tier (50 checks/day per IP):

  • Direct endpoint: https://api.guarddog.top/v1/check?chain=solana&target=<CONTRACT>
  • LLM Machine-readable spec: https://guarddog.top/llms.txt
  • npm package: guarddog-mcp — npx guarddog-mcp runs it locally in seconds.

Let's Discuss

For developers building autonomous trading agents and MCP workflows: how are you currently handling contract risk boundaries? Do you offload deterministic checks to specialized APIs, or do you let your prompt reason over raw data?

Top comments (0)