Language-model agents can read untrusted data, communicate with other agents, write persistent memory, construct Solana transactions, and request wallet signatures. That combination creates a new financial attack surface: an instruction can move through an agent network, survive a context reset, alter the system's apparent goal, and eventually reach a wallet. We introduce Merrow, a proposed pre-sign immune layer for autonomous agents on Solana. Merrow separates probabilistic reasoning from deterministic authority through provenance checks, signed memory baselines, intent verification, Program ID and Account Meta inspection, asset limits, transaction simulation, quarantine, and recovery. The model may propose an action. It does not get to decide that the action is safe. Charming confidence is not a security primitive.
Most financial software assumes that code follows rules written before execution. Agentic software is stranger: part of its behavior is negotiated at runtime through language. A market brief, tool result, social post, or message from another agent may be treated as data, advice, or instruction depending on context. Unfortunately, hostile text does not wear a little badge that says hostile.
Now give that agent a wallet. Cute.
Merrow is designed to sit between an agent's reasoning and its signing authority. It watches what enters the context, what survives in memory, what permissions are active, and what the agent is trying to sign on Solana. Merrow does not need the model to admit it has been compromised. It needs the proposed transaction to pass deterministic policy checks.
Papadopoulos et al. demonstrate that self-propagating ideas can spread through ordinary agent-to-agent communication [1]. In their experiments, instructions are written into persistent files, survive context resets, and continue across multiple hops. A short defensive warning sharply reduces infection and may cause a target agent to push recovery behavior back toward the sender.
Merrow takes the defensive half of that result seriously. If an idea can propagate through language, immunity must propagate through verifiable state and enforceable signing policy—not through a more persuasive paragraph alone.
We consider an autonomous agent system containing research, memory, planning, risk, execution, and wallet components. An adversary may control retrieved content or a message from one compromised peer. The payload may attempt to rewrite persistent goals, install instructions, request wider permissions, copy itself onward, or disguise a transaction as routine work.
The immediate sender may be trusted and still be infected. Merrow therefore tracks provenance across hops rather than treating agent identity as proof of clean intent.
Let m be an owner-signed mandate, s the approved persistent state, p the provenance record, and a a proposed Solana transaction. Merrow permits a wallet request only when:
No statement produced by the proposing model can replace any term. The model proposes. Merrow checks the exits.
| Layer | Purpose |
|---|---|
| Sentinel | Inspect untrusted messages, MCP output, and retrieved data. |
| Soul Integrity | Compare memory, skills, and instructions with an owner-approved baseline. |
| Intent Firewall | Bind proposed Solana transactions to explicit user authority. |
| Transaction Guard | Inspect Program IDs, Account Metas, instruction data, writable accounts, token mints, and value. |
| Simulation Gate | Run simulateTransaction before a wallet is asked to sign. |
| Quarantine | Freeze suspicious requests and revoke delegated authority. |
| Recovery | Restore clean state and record the infection path. |
Every executable proposal should carry a Pawprint Receipt: a compact commitment to the owner's mandate, approved state, relevant input provenance, exact transaction message, invoked Program IDs, writable accounts, assets, simulation result, and policy verdict. Sensitive prompts remain offchain; the receipt contains hashes and the minimum data needed for enforcement and audit.
Merrow models survivability as nine independently testable lives: provenance, memory, intent, Program IDs, Account Metas, assets, limits, simulation, and signer authority. A failed check removes a life. Configurable combinations trigger reduced permissions or full quarantine. Nine lives are generous. Infinite approvals are not.
When risk crosses the configured threshold, Merrow blocks pending signing requests, preserves an incident snapshot, and restores the latest signed state. A recovered agent wakes with its original mission, a record of what happened, and fewer permissions. Wipe the context? Cute. Merrow kept the receipts.
The proposed Vaccine Lab places role-specific agents in isolated network topologies and exposes them to safe synthetic test strains. Context is reset between hops while permitted persistent state remains. Defenses are compared using agent reproduction number RA, hop survival, time to detection, unsafe-signature block rate, false-positive rate, simulation error rate, and recovery completeness.
No empirical protection rate is claimed in this draft. Results will be published only with the model, prompt, topology, sample count, scoring method, and reproducible artifacts. Apparently that is less exciting than making numbers up. We will cope.
Merrow targets Solana transaction messages and wallet signing. Deterministic controls inspect Program IDs, Account Metas, signer and writable flags, instruction discriminators and arguments, SOL and SPL token mints, amount limits, slippage, frequency, and expiry.
Simulation uses Solana RPC's simulateTransaction where available, with program logs, inner instructions, compute units, errors, and balance changes treated as evidence. Optional policy programs and SDK endpoints are proposed and under development. No deployed Merrow security program is claimed here.
$MERROW is intended to coordinate the defensive network: evaluation compute, threat submissions, verifier participation, and access to advanced monitoring. The project is preparing to wake up on Solana through Pump.fun. Exact mechanics remain under design. Mint: TBA. The token is not a substitute for an audit, a warranty, or common sense.
Semantic detection is probabilistic. Signed baselines may preserve already-compromised state. Simulations may not perfectly predict final execution. Solana programs can contain bugs, RPC responses can be incomplete, and wallet permissions can be misconfigured. Merrow reduces authority and blast radius; it does not declare agents magically safe.
Agentic finance needs a boundary that does not speak in probabilities. Merrow combines infection detection, persistent-state integrity, intent receipts, transaction inspection, and wallet-side simulation so that a compromised agent cannot simply talk its way into a signature. I don't predict the market, sweetheart. I make sure your agent is still yours.
Correspondence: Merrow Labs. Independent protocol experiment; not affiliated with or endorsed by Pump.fun or Solana.