1. Contract Deployment & Nonce Management

Challenge: Initially faced "nonce has already been used" errors when deploying multiple contracts sequentially on Anvil.

Root Cause: The ethers.js v6

JsonRpcProvider

was caching transaction counts, returning stale nonces even after transactions were mined due to Anvil's instant mining.

Solution: Disabled provider caching by setting

cacheTimeout: -1

in the provider configuration. Also fixed the HDNodeWallet derivation path to use root

m

instead of default depth 5.

2. Architectural Pivot: Off-Chain to On-Chain Enforcement

Challenge: Initially built AgentGuard with off-chain policy monitoring (logging-only mode), but this created race conditions where transactions could be executed before policy checks completed.

Solution: Made a major architectural change to pure on-chain enforcement:

• Introduced SmartWallet contract that routes all transactions through Sheriff
• Sheriff.check() now blocks violating transactions on-chain with revert
• Removed the off-chain PolicyEngine in favor of trustless on-chain validation

This was a breaking change but resulted in stronger security guarantees.

3. ERC20 Amount Limit Enforcement

Challenge: How to enforce per-token spending limits when the Sheriff contract receives arbitrary calldata?

Solution: Implemented calldata decoding in Solidity to extract transfer amounts:

• Decode function selector (first 4 bytes) to identify transfer type
• For

  transfer(address,uint256)

  : decode amount from bytes 36-68
• For

  transferFrom(address,address,uint256)

  : decode amount from bytes 68-100
• For

  approve(address,uint256)

  : decode approved amount

This allows Sheriff to enforce different limits for different tokens dynamically.

4. Policy Decision API Design

Challenge: Creating a clear, deterministic API for policy violations that both contracts and off-chain tools can understand.

Solution: Implemented structured response system:

• PolicyContext

  struct with all transaction metadata (wallet, caller, target, value, data, timestamp)

• PolicyDecision

  struct with boolean allowed flag, uint8 violation code, and bytes32 policyId

• PolicyCode

  enum with specific codes: OK, AMOUNT_EXCEEDS, DENYLIST, NOT_IN_ALLOWLIST, VALUE_EXCEEDS, INVALID_SELECTOR, UNAUTHORIZED
• Events emit full context for observability:

  PolicyChecked

  ,

  ExecutionEvaluated

  ,

  ExecutionSucceeded

This makes debugging and monitoring much easier.

5. Aerodrome Integration on Base Fork

Challenge: Testing with real DeFi protocols (Aerodrome) required forking Base mainnet, but Aerodrome contracts weren't deployed on testnets.

Solution:

• Built the system to work with Anvil's

  --fork-url

  for Base mainnet
• Documented requirement to use

  base-mainnet

  fork (not testnets)
• Created demo scenarios that actually swap on Aerodrome pools
• Pre-funded SmartWallet with test tokens to enable realistic testing

6. Developer Experience: CLI Configuration

Challenge: Balancing flexibility with simplicity in policy configuration.

Solution:

• Created TypeScript-based config file (

  agent-guard.config.ts

  ) with Zod validation
• Auto-generate

  .agentguard.env

  with deployed addresses after

  npx agent-guard run

• Provide helper functions like

  addSafeERC20Selectors()

  for common patterns
• Split library exports from CLI entry point for programmatic usage

The result is a system that's both powerful and approachable for hackathon developers.