📄 Protocol Specification v1.0.4 • Published September 2026 • AegisNet Research Group

Operational AI Infrastructure & Autonomous DeFi Safeguards

A technical architecture unifying autonomous AI agent execution with ENSv2 Hierarchical Identity, Zero-Knowledge World ID Biometric 2FA, 1inch SwapVM Opcode Positioning, and Uniswap v4 Agent-Gated Liquidity.

1. Abstract & Problem Statement

The rapid emergence of autonomous AI agents operating on public blockchain networks introduces the Web3 AI Agent Trust Trilemma:

⚠️ The Web3 AI Agent Trust Trilemma

Key Compromise Risk: Exposing private keys to autonomous agent loops risks catastrophic loss of capital if the model is exploited or prompt-injected.
Absence of Verifiable Human Intent: Onchain smart contracts cannot natively distinguish between an autonomous routine check and a high-stakes unauthorized drain.
Fragmented DeFi Execution: Traditional DEX interfaces require manual multi-step transactions, incompatible with microsecond multi-hop agent strategy execution.

AegisNet solve this trilemma by introducing a zero-friction, multi-layer security matrix. Agents are assigned granular, revocable identity subnames under root ENS namespaces (`agent1.aegisnet.eth`), restricted by contract-level Enhanced Access Control (EAC), and gated by Zero-Knowledge World ID biometric 2FA whenever transaction values exceed configurable thresholds (e.g. $1,000 USD).

2. ENSv2 & Enhanced Access Control (EAC)

AegisNet leverages ENSv2 to create hierarchical agent namespaces. The root owner (e.g., `aegisnet.eth`) delegates agent subnames (`agent1.aegisnet.eth`) using `AegisSubnameRegistry.sol`.

Each subname is linked to an AgentPermissions record containing strict onchain parameters:

biometricThresholdUSD: Dollar threshold (in 18-decimal precision) triggering mandatory biometric verification.
dailySpendingLimit: Aggregated 24-hour spending cap.
whitelistedTargets: Approved target contract routers (e.g., 1inch SwapVM Router, Uniswap v4 Pools).
textRecords: ENSIP-26 key-value pairs defining agent.capabilities and operational metadata.

struct AgentPermissions {
    bytes32 subnameNode;
    string subname;
    address agentAddress;
    address ownerAddress;
    uint256 biometricThresholdUSD;
    bool isActive;
    uint256 dailySpendingLimit;
    uint256 currentDailySpent;
    uint256 lastSpentTimestamp;
}
      

3. World ID Zero-Knowledge Biometric Interception

When an agent requests execution via AegisExecutionManager.sol, the contract evaluates the transaction value against the agent's threshold. If valueUSD >= biometricThresholdUSD, the transaction is intercepted and placed into a pending state.

🔒 Biometric Interception Flow

1. Agent submits proposed transaction payload.
2. Contract emits ExecutionRequested(requestId, requiresBiometrics = true).
3. Operator scans World ID QR code or biometric prompt (Orb / Selfie Check).
4. Zero-knowledge proof (Semaphore protocol) is generated with signal = requestId.
5. Proof is verified onchain via IWorldID.verifyProof() or signed by an authorized relayer.
6. Transaction transitions to isVerified = true and executes automatically.

4. 1inch SwapVM & Aqua Protocol Opcode Routing

AegisNet integrates 1inch SwapVM custom opcodes to achieve atomic, multi-step DEX swaps and automated yield farming position management.

Opcode	Byte Code	Description & Execution Target
`OP_EXCHANGE_SWAP`	`0x01`	Atomic multi-token DEX swap through 1inch Aggregation Router v6.
`OP_SPLIT_ROUTE`	`0x02`	Splits trade volume across parallel liquidity pools to minimize slippage.
`OP_AQUA_DEPOSIT`	`0x05`	Deposits agent capital into 1inch Aqua yield positioning strategy.
`OP_AQUA_WITHDRAW`	`0x06`	Rebalances position and harvests accumulated yield back to vault.

5. Uniswap v4 Agent-Gated Hook

AegisUniswapV4Hook.sol attaches to Uniswap v4 pools, implementing the beforeSwap hook callback. When a swap is attempted, the hook verifies that the caller originates from an authorized AegisExecutionManager transaction for a valid ENS subname, blocking frontrunning bots and unverified MEV searchers.

6. Cryptographic Formalisms

Let $ S \in \{0,1\}^{256} $ be the root node hash $ \text{keccak256}(\text{bytes32}(0), \text{keccak256}(\text{"aegisnet.eth"})) $. For any subname label $ l $, the agent subname node is:

$ N_{\text{agent}} = \text{keccak256}(S \mathbin{\Vert} \text{keccak256}(l)) $

For transaction value $ V_{\text{USD}} $, execution permission $ P_{\text{exec}} $ is defined by:

$ P_{\text{exec}} = \mathbb{I}\left(V_{\text{USD}} < T_{\text{bio}}\right) \lor \left(\mathbb{I}\left(V_{\text{USD}} \ge T_{\text{bio}}\right) \land \text{VerifyZKProof}(\pi, \text{nullifierHash}, N_{\text{request}})\right) $

7. Threat Model & Security Assurance

The protocol is engineered to resist private key leakages, prompt injection attacks, replay attacks, and unauthorized contract calls:

Nullifier Tracking: Used nullifiers are recorded in mapping usedNullifiers, preventing proof reuse across requests.
Target Whitelisting: Agents can only execute calls against explicitly whitelisted contracts.
Daily Cap Rolling Window: 24-hour spending resets prevent cumulative capital depletion.

8. Deployed Contracts & Roadmap

Contract Name	Sepolia Testnet Address
`AegisSubnameRegistry`	`0x09FfDB167F80fF9E4C5BE64C24bEbeCF1F4B4625`
`AegisExecutionManager`	`0xC65d65A48cB24CA9bd6df02Ea83Ef44571E5594c`
`AegisSwapVMAdapter`	`0xc2CA4DB9A01367fA06F56dcf8681993b517D19f1`
`AegisUniswapV4Hook`	`0x0F491f0D3CfB919A259E69F974Ae772912f13B2e`