The problem Aegis solves

What Aegis is

Aegis is an automated crypto trading agent. You deposit funds, and on a schedule it reads market data, decides how to split your portfolio across five assets, and makes the trade that moves you closest to that target. A robo-advisor, essentially.

Two things make it different from every other trading bot:

• It runs inside a secure enclave, a hardware-isolated part of the processor that can produce a cryptographic receipt proving exactly which code and which AI model produced a decision. That receipt gets written to a smart contract before any money moves.
• It trades inside a shielded pool (Railgun), where balances are encrypted commitments rather than public numbers. Your positions never appear on the blockchain.

Why that combination matters

Most trading bots are a black box with a Twitter account. You hand over funds, get a performance chart, and take the operator's word that the strategy is what they claimed. Nothing stops them from swapping the model out or rewriting the story after a bad week.

The obvious fix is to put the bot on-chain, where everything is public and verifiable. But that trades one problem for a worse one: your entries, your sizing, and eventually your whole strategy become a public document that anyone can read and trade against.

So you're stuck picking between trustworthy but exposed and private but unverifiable.

Aegis gets both. You can verify the agent did what it said. You can't see what it holds.

Who'd use it

• A DAO or small fund whose members need the treasury strategy to be auditable, without publishing every position to competitors.
• Anyone delegating to a bot without handing over custody. The agent signs with a key restricted to one function on one contract with zero ETH attached — and that contract has no ability to move a token. It's not that we trust it not to steal; it structurally can't.
• Users who need compliance without surveillance. Every trade passes a sanctions-list check before it can execute, proving the funds aren't tainted without revealing which funds they are.

Challenges we ran into

1. An attestation proves what was decided, not what was done

We realized that proving an AI decision doesn't guarantee the executor actually follows it. Our allocation was correctly hashed, attested, and recorded on-chain, but the trading code was still executing a fixed swap.

We fixed this by making plan_rebalance derive the trade directly from the attested allocation. It compares current holdings with the target and closes the largest gap. The caller can cap the trade size, but cannot choose the trade direction.

2. Finding a model small enough, but good enough

One of the harder parts was finding a model that was small enough to run comfortably inside the enclave while still being capable of making reasonable trading decisions. Larger models gave better reasoning, but increased memory usage and inference time, which isn't ideal for a constrained environment.

We tested smaller models and found that some struggled with basic allocation and reasoning tasks, while larger models were more capable but harder to fit within our constraints. We eventually settled on Qwen 2.5 3B, which gave us a good balance between model capability, inference time, and the resource constraints of the enclave.

3. Making private settlement observable enough to debug

Shielded transactions are great for privacy but make debugging much harder because you can't simply look at a public wallet balance and see what happened. We had to build our own execution checks around transaction receipts, events, and shielded-state updates so the system could verify that a trade actually settled without exposing the portfolio itself.

4. Testnet has no private mempool to hide in

We built private transaction submission to prevent swaps from sitting in the public mempool, but found it wasn't useful on Sepolia because there are effectively no MEV builders there. We sampled 60 blocks and found zero MEV-builder blocks, while mainnet had 22 of 30.

So Aegis chooses the submission route based on the chain: private on mainnet, public on Sepolia, while reporting the actual execution price and surrounding swap activity instead of claiming protection that the network can't provide. The unshield → swap → reshield process remains atomic either way.