llm-trading-agent-security

Sanitize all external data such as token names, pair labels, and social feeds with regex-based injection pattern detection before injecting it into an execution-capable prompt. Treat any instruction-like content in on-chain data as a potential financial attack and reject it.

Implement a SpendLimitGuard that checks each transaction against a maximum single-transaction USD cap and a rolling 24-hour daily limit, raising an error when exceeded. Enforce these limits independently from model output so the LLM cannot override them.

Simulation via eth_call reveals the actual output of a transaction before it is broadcast, letting you compare it against a mandatory min_amount_out. If the simulated result falls below the expected minimum, the transaction is aborted to prevent slippage losses.

No. Use a dedicated hot wallet holding only the funds required for the session, loaded from an environment variable or secret manager. Never point the agent at a primary treasury wallet or hardcode keys in code or logs.

A circuit breaker halts the agent when risk thresholds are breached, such as three consecutive losses or an hourly drawdown beyond five percent of portfolio value. It also halts on invalid state like a non-positive hour-start value to prevent undefined behavior.

Route transactions through a private RPC endpoint such as Flashbots instead of the public mempool, and set per-strategy slippage tolerances in basis points plus short transaction deadlines. This reduces exposure to front-running and stale execution.