Demo Agents

Why this page exists

Reading Agentic Smart Contracts gets you the thesis. Reading one demo end-to-end gets you the intuition. The pattern is the same in all thirteen, so a single worked example is enough — the rest are listed at the bottom for when you want to see the same shape applied to bridges, governance, music criticism, or aircraft type certification.

We picked the Aave Oracle for the walkthrough because it is the densest version of the pattern: real DeFi protocol on the receiving end, single canonical historical failure to point at, and the agent's output is the load-bearing piece of the whole stack.

The failure

Mango Markets, October 2022, $116M. The attacker pumped MNGO on a thinly-traded venue, the oracle the lending protocol depended on accepted the manipulated price as truth, and the contract dutifully approved a borrow against collateral that was suddenly "worth" far more than it actually was.

The industry response was bigger oracles — more nodes, longer TWAPs, more aggregation. None of that addresses the structural issue: the contract has no way to decide whether the price it received corresponds to anything real. It can only verify that someone signed it.

An agent can. It reads the underlying venues directly, asks whether they cohere, and either returns one reconciled price or refuses. The refusal is the part that changes the shape of the failure.

What the agent does

The Aave Oracle demo deploys Aave V3 unmodified, swaps its Chainlink-shaped price feed for an agent-written one, and points the agent at three real venues. The agent runs on a schedule (every ~60s), reads each venue, reconciles depth-weighted, and writes one of two things into the feed contract:

• PRICED — a single reconciled number plus the reasoning hash
• REFUSED — an empty price slot plus a reason hash explaining which venue diverged

When the feed is REFUSED, Aave's getAssetPrice() reverts with PriceRefused, and every operation that touches that asset's value — new borrows, liquidations — halts. Withdrawals continue because they don't need a price.

function latestRoundData() external view returns (
    uint80 roundId, int256 answer, uint256 startedAt,
    uint256 updatedAt, uint80 answeredInRound
) {
    if (decision == Decision.REFUSED) {
        revert PriceRefused(reasonHash);
    }
    return (currentRound, price, startedAt, updatedAt, currentRound);
}

What to notice: the contract has no logic for "is this price reasonable." That decision is the agent's job — the contract just enforces the agent's answer. Same separation the rest of the docs argue for, applied to the most-attacked component in DeFi.

The receipt

Every tick — PRICED or REFUSED — lands on Base Sepolia as a transaction signed by the agent EOA, with a bytes32 reason hash pointing at a Vercel Blob that contains the full dossier (every venue's response, the depth-weighted reconciliation, and the LLM output verbatim).

Re-running the agent against the dossier reproduces the decision. The chain proves who and when; the dossier proves what was decided and why. Anyone — an auditor, a depositor, a rival protocol — can rebuild the agent's reasoning from the same inputs and check whether the refusal was the right call.

The other twelve

Same pattern, applied to twelve other surfaces. Each demo's page in the repo names the specific failure it reproduces and the external feeds it consumes.

Dig deeper