Aleph Hackathon

Clara is a 100% on-device AI crypto guard — a browser extension backed by a local engine (plus a desktop app) that sits in front of your wallet. It translates in both directions: it explains what you're about to sign in plain language, and it builds transactions from plain words. Nothing ever leaves your machine (local LLM via QVAC).

The core design idea

▎ The policy engine decides. The model only narrates.

Most "AI explains your transaction" tools ask a small model "is this safe?" — exactly where a 1–4B model hallucinates, and a confident false "looks safe" is worse than no tool. Clara inverts this: the safety verdict is deterministic, and the model only puts it into friendly words — so it structurally cannot hallucinate "looks safe" on a dangerous transaction.

How it works — two directions through one shared engine

Direction 1 — Transaction → plain language (the guard): site asks your wallet to sign → decode the calldata (viem, deterministic) → policy verdict (WDK rules) → ALLOW / DENY + which rule fired → local LLM narrates the verdict in plain words → you see it, and can block it — before your wallet ever signs A guard rejects any narration that contradicts the verdict; on failure it uses the raw policy reason verbatim, never fabricated. It flags real drain patterns specifically — unlimited approvals, setApprovalForAll, Permit2 batches, blind-signs, spending-cap breaches.

Direction 2 — Plain language → transaction (build by talking): you type "send 0.001 ETH to alice" → local model calls a validated tool (can't invent a tx) → resolves to a real {to, amount} → re-checked through Direction 1's explainer BEFORE you confirm → you confirm → YOUR wallet signs (or Clara's testnet wallet as fallback) The two directions cross-verify each other — construct can't build something explain would have blocked.

Why it's trustworthy

• Local & non-custodial: everything runs on your device (loopback engine at 127.0.0.1:8787); the guard wraps any EIP-1193/EIP-6963 wallet (MetaMask, Rabby…) and holds no keys — your wallet signs.
• Defends real attack classes by mechanism, not prompt text: tool-redefinition (schemas rebuilt every turn + zod), encoding/obfuscation bypass (evaluates the decoded operation), multi-turn decomposition (session-scoped caps), and reasoning-trace leakage (<think> stripped).
• Evidence, not vibes: on the benchmark, 0 missed drains and 0 incorrect transactions built across the adversarial/ambiguous set.

Vault Guardian Submissions

All seven rooms cleared. The key insight: every defense blocks the word itself, so each passkey had to come from something that wasn't the word — polite direct asks early on, mirroring the guardian's own promise back at it, roleplaying inside its fiction to make it recite spellings "as a rite," and one-bit / fragment extraction (yes-no questions, "how does it start / end," cross-checked across rewordings) to rebuild words the output filter would never emit whole; L7's compound key was pieced from a half leaked via a fake guardian-to-guardian handshake, a part it volunteered in plain sight, and a number a length-oracle kept repeating. Encodings (base64/ROT13/leet), direct jailbreaks, and system-prompt dumps never worked in any room — the input filter is purely lexical while the output judge adapts within a session, and the guardian can't read its own secret, so every leak was the model drifting toward the answer under social pressure, not reading it. Full L1–L7 writeup with passkeys and per-room techniques: vault-guardian-submission.md