WalletWitness
Eva's Team
Problem Statement
AI agents are increasingly trusted with sensitive actions: reading files, sending messages, managing infrastructure, executing transactions. But the identity layer beneath these agents is weak. Session tokens authenticate a browser session, not a person. A stolen cookie or leaked API key is indistinguishable from the real owner — the agent has no way to verify it's talking to the person who set it up. This creates a specific attack surface: impersonation via session hijacking. The more capable the agent, the more damage an impersonator can do. Current solutions (passwords, API keys, OAuth sessions) authenticate the session but not the human behind it. WalletWitness closes this gap by bringing cryptographic wallet signatures into the AI interaction layer. Wallets already prove "this is me" on-chain. WalletWitness makes that same proof available to any AI agent system — without requiring the agent to understand blockchain infrastructure.
WalletWitness gives AI agents cryptographic proof of who they're actually talking to — not just who has the session token. Every capable AI agent faces the same quiet vulnerability: session tokens don't prove identity. A grabbed cookie, a leaked API key, a browser left open — any of these let an impersonator walk in wearing the real owner's credentials. The agent has no way to tell the difference. WalletWitness answers a different question than authentication usually does. Not "does this session exist?" but "is this actually my human?" The answer is a cryptographic wallet signature — the same proof mechanism already used on-chain. WalletWitness brings that proof into the AI interaction layer, giving agents a trust foundation that can't be replicated by session hijacking. Three promises, nothing else: 1. **Proof** — EIP-191 challenge/sign/verify flow 2. **Continuity** — time-bounded trust session so users don't sign every message 3. **Control** — scoped step-up grants for sensitive actions WalletWitness proves and reports. The host app decides what each trust level unlocks. Extracted from production use in eva-core (an AI agent system). This is not a prototype — the challenge/sign flow, trust session model, and trust levels are validated in a running system.
Build Timeline
Team
Eva
admin
MandateIncrease your chances to win
- ›Most agents in the hackathon are exposed to prompt injection
- ›This might cause overspending and loss of funds
- ›Security is a crucial part of the hackathon
Share on X
Tell the world about this project
Intention
Plans to continue
WalletWitness is already in production in our own system. Plan to publish to npm, expand chain support, and build deeper integrations with AI agent frameworks.