$SAGE is live on Robinhood chain CA: 0xd07877C9879bE4D0EaBA85B29FDEce1Ef8078C41 chainsage: Trust layer for autonomous finance

ChainSage today: a verdict before an agent signs. ALLOW / REVIEW / DENY. That’s one transaction. But agents don’t think in single transactions — they think in plans. So here’s what we’re building next 🧵

Anatomy of a Drain *Most people who lose a wallet weren't hacked. They signed something. Here's exactly how it happens — and the one moment where it could have been stopped.* ## The myth of the "hack" When someone says their wallet got "hacked," the picture in most people's heads is wrong. They imagine malware, a keylogger, a leaked seed phrase. Those happen — but they're not how most wallets are actually emptied. The most common drain doesn't break into anything. It asks politely, and you say yes. The owner signs a transaction, on purpose, with their own hand — because the request looked exactly like a hundred routine ones before it. Nothing in the stack asked whether it *should* be signed. There's no judgment layer between a normal-looking request and a catastrophic outcome. That gap is the entire attack surface. Let's walk through how it actually works. (This is a defensive breakdown — enough to recognize and avoid the pattern, not a manual for running one.) ## Step 1 — the setup looks routine You end up with a reason to interact with a contract. Maybe a token appears in your wallet. Maybe a site offers a claim, an airdrop, a swap with a too-good rate. To do almost anything with a token on-chain, your wallet has to "approve" a contract to spend it. This is a completely normal mechanism — every DEX, every legitimate protocol uses it. That's what makes it the perfect cover. ## Step 2 — the approval is the attack Here's where the damage is done, and it's almost invisible. The approval request has two properties that should set off alarms, and usually don't: - **It's an *unlimited* allowance.** Instead of approving the exact amount you want to trade, the request asks for permission to spend an unlimited quantity of the token, forever. - **The spender is not who you think.** It's not a canonical, audited router. It's a contract deployed hours or days ago, with no track record. To a human staring at a wallet prompt, this looks identical to every legitimate approval. The interface doesn't say "this contract is six hours old and is asking for everything." It just says "Approve." You click confirm, because you've clicked confirm a hundred times and nothing bad happened. You just handed a stranger a key to that token. Nothing has been stolen yet. ## Step 3 — the trap springs later This is the part that makes drains so effective: nothing happens immediately. The malicious approval sits dormant. Your balance is untouched. The transaction "succeeded." Everything feels fine. Then — minutes, hours, or days later — the contract uses the permission you granted. It calls `transferFrom` and moves the entire balance of that token out of your wallet to the attacker. You authorized it back in Step 2. There's nothing to "break in" to now; the door was opened willingly, in advance. No malware. No leaked keys. A signature you gave on purpose, because the request looked normal and nothing judged it before you signed. ## The one moment it could have been stopped Every drain has a single point of maximum leverage: **the half-second before the signature.** Once signed, the approval is on-chain and the outcome is just a matter of time. Before signing, it's still a question — and the right question, asked at the right moment, stops the whole thing. That question is what ChainSage is built to ask. Before an approval is signed, the verdict engine reads the shape of the action: - Is this an unlimited allowance? - How old is the spender contract — was it deployed hours ago? - Is it a known, audited protocol, or an unknown? - Does the combination match a known drainer pattern? An unlimited approval to a freshly-deployed, unknown contract is the textbook drain setup — and it resolves to **DENY**, before the signature, with the reason in plain language. One danger signal vetoes everything else. And if the engine can't reach a confident answer, it fails toward caution — REVIEW or DENY — never a silent "looks fine.