Autonomous AI agents are emerging as interfaces for decentralized finance (DeFi) actions such as swaps, lending operations, and yield management. Because these agents rely on large language models (LLMs) to plan transactions, they inherit the LLM's susceptibility to prompt injection and lack of mechanisms to bind a verifier's approval to the exact transaction ultimately submitted on-chain. We present PACE (Policy-Attested Contract Execution), a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution. PACE introduces typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind the approved intent, policy, and simulation report to the exact execution bytes, with replay and expiration protection. A Solidity smart account enforces PDR signatures on-chain with a measured overhead of 29,826-31,822 gas. We evaluate PACE against six baselines on 40 tasks spanning four attack categories plus benign utility (2,800 trials, 10 seeds). In our deterministic sandbox, PACE achieves a 0.00 unsafe execution rate and 0.00 false-positive rate on benign tasks, compared to 0.80 for the unguarded baseline. Ablation studies identify permissive policy settings (+57.5 pp) and the touched-contract allowlist (+12.5 pp) as the dominant safety components. To test whether the same deterministic floor holds for real model outputs, the artifact additionally provides a three-model live-LLM evaluation over the full task suite with repeated runs. A mainnet-fork harness is included for archive-RPC deployments, but fork results are reported only when the corresponding artifacts are generated. These auxiliary studies are separate from, and never substitute for, the deterministic benchmark. We frame our claims as logic-level safety within a reproducible benchmark rather than deployment-ready DeFi security.
Figures & tables
Figure 1: The Pace pipeline. The LLM agent and the intent it emits are untrusted ; the simulator, policy verifier, and PDR are deterministic and never consult the LLM; the smart account re-checks the signed PDR on-chain before any external call. The user policy is the only trusted input that shapes the decision.
Figure 2: On-chain enforcement in executePDR . Any failed check reverts; the nonce is consumed before the external call, so a re-entrant call cannot replay the PDR.
Agent
Correct%
Unsafe Exec
Atk Success
Dangerous Block Rate
FP Rate
Raw
20.0%
0.80
1.00
0.00
0.00
Prompt-Only
41.2%
0.59
0.73
0.27
0.00
Sim-Only
27.5%
0.72
0.91
0.09
0.00
WalletGuard
75.0%
0.25
0.31
0.69
0.00
StaticGuard
95.0%
0.05
0.06
0.94
0.00
SimGuard
97.5%
0.03
0.03
0.97
0.00
Table 1: Agent comparison (2,800 trials, 10 seeds). Correct and unsafe execution rates use all trials; attack success and dangerous block rates use attack trials; false-positive rate uses benign trials.
Variant
Correct%
Unsafe Exec Rate
Reject Rate
FP Rate
pace_baseline
100.0%
0.000
0.800
0.000
pace_no_sim
95.0%
0.050
0.750
0.000
pace_no_metadata
100.0%
0.000
0.800
0.000
pace_no_touched
87.5%
0.125
0.675
0.000
pace_no_calldata_bind
97.5%
0.025
0.775
0.000
pace_no_freshness
97.5%
0.025
0.775
0.000
Table 2: Ablation: unsafe execution rate when each component is removed. The baseline uses the same task policies and task-specific simulators as the main PACE experiment. The reject rate is all rejected decisions over all ablation trials, not the dangerous block rate.
Model
Correct%
LLM-Only Atk Succ
PACE Atk Succ
FP Rate
gemini-3.1-flash-lite
97.5
0.000
0.000
0.125
DeepSeek-V4-Flash
97.4
0.026
0.000
0.128
gpt-4o
99.0
0.069
0.000
0.050
Table 3: Live multi-model evaluation. Correct rate, model-alone vs. Pace -guarded attack-success rate, and benign false-positive rate. Generated from results/runs/live_suite/ .
Agent
Evasion blocked
Policy-valid harm admitted
PACE
8/8 (1.00)
8/8 (1.00)
SimGuard
7/8 (0.88)
8/8 (1.00)
StaticGuard
7/8 (0.88)
8/8 (1.00)
WalletGuard
2/8 (0.25)
8/8 (1.00)
Table 4: Adaptive adversary with full policy knowledge (seed 0). Evasion attacks are policy-violating (lower-left is better); policy-valid-harmful transactions stay within the policy, and every guard admits them all.