The agent that cannot withdraw: a pattern for trading keys on Monad

Every serious loss an agent causes is a signature that was allowed. The chain did not get confused. The contract did what the key was permitted to do, and on Monad it did it inside a slot, so the story you tell afterwards has no twelve-second gap in which a human might have noticed. The design problem is not to make the model smarter, though smarter models write fewer silly calls. The design problem is to decide, in the contract, which functions the agent key may call. Research, quotes, and swaps back into a vault the owner funded are one set. Withdrawal to an address the model just invented is another set. If both sit on the same key, you do not have an agent. You have a hot wallet with a chat box, and the chat box is reachable by anyone who can put text in front of it.

The two addresses

The owner is a wallet the person holds, ideally a hardware wallet, and it is the only address that can withdraw, pause, or replace the agent. The agent is a key that can be online, because it has to sign inside the time the trade is still the trade. On this desk that key lives in the browser. The browser is a hot environment. The contract still refuses withdraw from that key. A top-up of gas is a transaction the owner signs, and the recipient is the agent address the contract already stores. If the key in the browser is not that agent, the top-up does not happen, which is the correct failure. Profit above the gas float returns to the owner and to nobody else. The destination is read from the contract, not typed into a form the model can see. A form that asks where to send the profit is the bug, even if the default looks right, because the default can be edited by the same text channel that asked for the withdrawal.

The float, in two coins

The float on this desk is 0.25 MON. It is petrol, not a fee and not a performance charge. The chain bills gas in MON. An agent with a vault full of WETH and a key with no MON cannot sell the WETH. The September product news does not change the gas token. An API you pay in USDC still needs MON for the gas of that payment. Budget both. An agent that spends its last MON on a swap and cannot pay for the exit has not finished a strategy. It has stranded the position until a human notices and tops it up. 0.25 MON is a policy, not a law of the protocol. The law is that the float is native, that it sits where the signing key can use it, and that sweeping it to zero in the name of efficiency is how you buy a stuck close. Profit is what remains after the float. Reporting the float as profit is how a dashboard shows a gain the owner cannot withdraw without breaking the next trade.

Owner withdraws. Agent trades. The contract, not the prompt, decides which is which. The float stays, because the next signature also costs gas.

The prompts that will arrive

A model with tools will be asked, by a page or a person or a document it was told to summarise, to return the funds to this new address, to approve a new router, to export the key so a migration can proceed, or to raise the floor to zero because the close is reverting. Some of those sentences will be typed by the owner on a bad day. Most of the dangerous ones will not. The correct implementation refuses the ones the contract can refuse, and the correct human response to a surprise signature request is to stop, even if the request is dressed as support. A surprise prompt is the attack. The chain being fast means you do not get a reflective pause after you have signed. You get a receipt. Read the function name, the spender, and the recipient before the signature. After the signature, reading them is archaeology.

Simulation, hash, receipt

Simulate a close and a swap before you broadcast. A revert still costs the gas used up to the revert, and a floor the pool will not meet is cheaper to discover in eth_call than in a block. The simulation is not the fill. If you book profit from the simulation, you will count coins the searcher, the next slot, or a simple mismatch will not deliver. The hash is the promise that a receipt is coming unless the rare consensus case says otherwise. Show the hash. Update the position as gone when the sell has been broadcast and the nonce has moved, or the human will fire a second sell. The receipt is the reconciliation. If it never arrives, look at the nonce and the explorer before you send another copy. Two valid sells are a short the strategy did not have on the whiteboard. Waiting forever for the receipt before you believe the first sell is how the human, or the retry loop, creates the second. Both bugs have the feeling of caution. Only one of them is caution. The other is a timeout copied from a slower chain.

What to copy if you never open this site

Put the principal behind an owner key that is not online. Put the agent key behind an allowlist of functions, enforced by the contract, not by the prompt. Make the profit address immutable, or changeable only by the owner, and never an argument of the agent’s call. Keep a native float, and if you pay third parties in USDC keep a dollar float too. Log the hash before you log the story. Point the model at the current-facts page and at the token list, and review any calldata it wrote. The Foundation’s own note on models and code says a prompt is not a proof. None of this is a forecast about the MON price. It is the minimum scaffold that lets a 300 millisecond chain be something an agent can touch without becoming the exit liquidity for its own context window. The slot will not give you time to notice a bad signature. The contract has to have noticed first.