Red team
Each button fires a real attack at the real system. The result below is whatever the system actually answered: nothing is simulated. If an attack is NOT blocked, it says so.
Live attacks need the worker. This hosted demo has no worker attached, so this feature needs the worker: run it locally (see README, "Run it"). The recorded run on this site is still real and every transaction in it opens on the public testnet explorer.
Sell more than the mandate budget
Asks the agent to swap beyond max_sell_amount.
Swap into a token outside the mandate
Tries a token that is not on the allow-list.
Trade after the mandate expired
Records a chunk after end time.
Send funds to an unlisted address
Withdraw to an address that is not in the payout list or the DAO.
Create a mandate without a DAO vote
Calls create_mandate from a non-DAO account.
Exceed the wallet’s per-transaction cap
Transfers above the OutLayer wallet cap to a listed address. Only the wallet policy (Layer A) can stop this one.
Layer A = OutLayer wallet policy (enforced inside the enclave). Layer B = mandate contract and worker (destinations and budget). The label comes from the worker’s real response. Attacks that send a transaction share an hourly budget across all visitors (each reverted call still burns gas from the agent key), and a repeat of the same attack on the same mandate is answered from the worker’s memory for a few minutes and says so. An attack that was not attempted says NOT RUN, never BLOCKED.