defiloops

Sign in
Limits
Sign grant
First run

Step 1 of 4: Sign in

Checking your sign-in…

Take an asset your account supplied to Aave v3 out of the position, and send what was withdrawn back to your wallet. Two steps: lend.withdraw, then transfer.erc20 to your wallet. It closes what "USDC savings on Aave" and "Buy ETH or BTC and earn on Aave" opened: pick USDC, WETH or cbBTC and how much. A withdrawal is capped at what the account holds in Aave, so asking for more than the position, up to the slot's maximum, withdraws all of it.

What it does, each run

Lend: withdraw (USDC) lend.withdraw
Take supplied collateral back out of Aave. Carries a loan-to-value cap because removing collateral raises the ratio on whatever debt remains.
Transfer: erc20 (USDC) transfer.erc20
Move an ERC-20 token.

What it can touch

Lend: withdraw lend.withdraw
Transfer: erc20 transfer.erc20
Venues: Aave v3, and no other
Base only
Only your own account, only within the limits you sign, and only while the grant lasts. You can stop a run and revoke the grant at any time.

When a run finishes, the result is back in your wallet.

Risks

Collateral that backs a debt cannot be withdrawn: Aave refuses, and so does the loan-to-value ceiling you set, so the run fails rather than move money.
The loan-to-value ceiling you set is checked after the withdrawal and is capped at 60% by this template; with no debt the position's loan-to-value is zero.
What you withdraw stops earning the Aave supply rate once it leaves the position.
Only what was withdrawn is returned; the rest of the position stays in your account's Aave position.

How hiring works

Hiring takes two signatures and no transaction.

Sign in with your wallet: a signature, no gas, and it approves nothing.
Sign the hire grant (one EIP-712 signature, no gas): your per-run limit, your total budget and an expiry of 2 to 90 days. It names this agent, the operations and venues listed above, and Base only.
Nothing to approve: this agent draws no money from your wallet.

On-chain identity

ERC-8004 agent: #145603 on chain 8453 (Base) agent NFT on Basescan
agentRef: eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432#145603
Registry: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
Owner (the treasury Safe): 0x7702D48c2dE9745981b17Bc91e7CA762ea547c61
agentURI: ipfs://QmU8gMvwFMXXyRx6QHqLxxQRNy7RxTmWF3SdQzLy9kFMdP registration file (IPFS gateway)
IPFS CID: QmU8gMvwFMXXyRx6QHqLxxQRNy7RxTmWF3SdQzLy9kFMdP
Verification: https://defiloops.com/verify/ (signed releases, autonomous reviews, IPFS bundles)
Agent card: https://app.defiloops.com/api/agents/card?ref=eip155%3A8453%3A0x8004A169FB4a3325136EB29fA0ceB6D2e539a432%23145603

Contracts and addresses involved (Base)

Addresses come from the committed deploy records (the manifest of 2026-10-10, the chain configuration, the indexer’s labels and the signing-security record), not typed by hand. Who holds each role, what code each proxy runs, where each venue points and every delay are read on Base when this page is served, at most a minute old. Every contract a run of this agent calls, from creating your account to its last step, is listed here. A test checks this list against the deploy records.

Run path

Agent (B): 0xa5a3450Cb304Fbb4293ef97B1a944D9E13BaC586 (checks the keeper’s signature (callAdaptersSigned) and calls each step’s adapter; the relayer that sends the transaction only pays the gas)
aave v3 adapter (v1.1): 0x77aa7539a03ecCf8eE3ECFe0A63E9e62DF81239d (runs lend.withdraw)
owner transfer adapter (v1.1): 0x82c2f23A1484d1c6C6e8b28D74E6b0E775c7A481 (runs transfer.erc20)
Venue “aave_v3”: 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 (what the aave v3 adapter calls: the address the registry maps this name to, read on chain)

Account

Kernel v3.1 account factory: 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419 (makes your DefiLoops account at an address derived from your wallet)
Kernel v3.1 account implementation: 0xBAC849bB641841b44E965fB01A4Bf5F074f84b4D (the code every DefiLoops account runs)
Root validator (GatedECDSAValidator): 0xD076Ac7e59B0d79442BbC2b478D9843b7A55db62 (checks your wallet’s signature for your account, and refuses any other validator being installed)
AdapterInstaller: 0x064BcBC2294ee29aB823D7052b3a4275d8554Baa (installed in your account when it is created; it installs only adapters the registry lists)

Tokens

USDC token: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (the asset the steps move)

Registry and identity

AgentRegistry: 0x186F92092a3965f43e21BC212A35fa22633c3bd6 (creates your account (createAccount), records the agent your account appoints, lists the adapters an account may use, and keeps your spending caps)
ERC-8004 identity registry: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432 (holds the agent’s NFT)

Roles and upgrades

Contract	Role	Holder	What it can do
AgentRegistry `0x186F92092a3965f43e21BC212A35fa22633c3bd6`	guardian	`0xb3e2A671eC838A567CE9C16E147Ee7B37aa5da3D` (guardian key)	Lists and delists adapters (a new listing, or a venue pointed elsewhere, waits 3 days), suspends and resumes adapters, revokes an agent for good, curates the assets an agent may send to, and names the pauser. No function replaces it.
AgentRegistry `0x186F92092a3965f43e21BC212A35fa22633c3bd6`	pauser	nobody (the zero address)	Nobody holds it, so only the guardian can suspend an adapter.
Agent (B) `0xa5a3450Cb304Fbb4293ef97B1a944D9E13BaC586`	owner	`0xdfdac308F1bc0bbC53f1313CaBDb4919E23a3A19` (owner key, held off the servers)	Grants and revokes KEEPER_ROLE, so it decides which key may sign runs. It cannot change the Agent’s code.
Agent (B) `0xa5a3450Cb304Fbb4293ef97B1a944D9E13BaC586`	keeper (KEEPER_ROLE)	`0xE23F3FDb866f5Af363eb11fC36B1e6c7FFA642A7` (keeper key, inside the AWS Nitro enclave) KEEPER_ROLE holders cannot be listed on chain. Of the 2 keeper keys our records name, these hold it now.	Signs each run (callAdaptersSigned). It may drive only adapters the registry lists, only on accounts that appointed this Agent, and every adapter still applies your account’s owner checks and the limits you signed. It cannot call your account, the registry or the Agent itself.
AgentRegistry `0x186F92092a3965f43e21BC212A35fa22633c3bd6` implementation: `0x47fAAddC8e3fF4Dc2C71e8b7820B60839791D143`	proxy admin	`0xdfdac308F1bc0bbC53f1313CaBDb4919E23a3A19` (owner key, held off the servers; no code on chain: a key)	Replaces the contract’s code at once (ERC1967Factory.upgrade), with no delay and no veto, and can hand the admin role to another address.
AdapterInstaller `0x064BcBC2294ee29aB823D7052b3a4275d8554Baa` implementation: `0xcD62b3E12F604F31D5fF53DaE1c92EBc57C09A9c`	proxy admin	`0xdfdac308F1bc0bbC53f1313CaBDb4919E23a3A19` (owner key, held off the servers; no code on chain: a key)	Replaces the contract’s code at once (ERC1967Factory.upgrade), with no delay and no veto, and can hand the admin role to another address.
Agent (B) `0xa5a3450Cb304Fbb4293ef97B1a944D9E13BaC586` implementation: `0xDa920475a4EB06c265741a981179C02447AA92b9`	proxy admin	`0xdfdac308F1bc0bbC53f1313CaBDb4919E23a3A19` (owner key, held off the servers; no code on chain: a key)	Replaces the contract’s code at once (ERC1967Factory.upgrade), with no delay and no veto, and can hand the admin role to another address.

The protocol contracts (AgentRegistry, AdapterInstaller and the Agent) are upgradeable at once, with no delay, by 0xdfdac308F1bc0bbC53f1313CaBDb4919E23a3A19 (owner key, held off the servers; no code on chain: a key).

The UpgradeTimelock 0xeddF6Af109C2d76840687432135eF53da254AcC8 (delay: 7 days) is not their admin.

The adapters are not proxies: each is fixed code, which the manifest matched to its source build. A new adapter is a new address the guardian has to list.

The keeper

0xE23F3FDb866f5Af363eb11fC36B1e6c7FFA642A7 signs every run (callAdaptersSigned), and the Agent checks that signature on chain before it calls an adapter. It holds KEEPER_ROLE now (read on chain). Its key exists only inside an AWS Nitro enclave, as our signing-security record states (docs/security/SIGNING_SECURITY.md). The enclave’s measurement is published with the verification bundle: https://defiloops.com/verify/

DefiLoops agent

Withdraw from Aave

Withdraw USDC, WETH or cbBTC from Aave v3 to your wallet

AvailableERC-8004 Agent #145603 Basescan

What happens: Your account → The agent acts → Back to your wallet
When a run finishes, the result is back in your wallet.

Agent fee: none · gas + 100%, quoted per run, paid in USDC via x402 All fees

On-chain registration

Registration file on IPFS: ipfs://QmU8gMvw…FMdPOpen on IPFS
Registry: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
Registered by: 0x7702D48c2dE9745981b17Bc91e7CA762ea547c61
Token on Basescan: Basescan

Your wallet: Not signed in yet
Expires: Not chosen yet
Grant: Not signed yet
Approval: Nothing to approve

Hire this agent

Fees

Agent fee: none · gas + 100%, quoted per run, paid in USDC via x402

Every fee a run of this agent can cost you, split by who charges it: the agent, or the venues it uses. For each: how much, to whom, where it is set and the most it can be. Rates set on chain are read live; the rest come from the code and config that set them, not typed by hand.

Charged by this agent (DefiLoops)

Gas + 100% markup, quoted before each run and paid in USDC via x402 from your wallet; no credits. No hire fee or share of returns.

Fee	Rate (actual / max)	Paid to	Where it is set
Network gas for each run, plus the platform markup	The gas of every transaction we send for you (each step, and creating your account on the first run), plus 100% of it, quoted before each run. The quoted price and no more: you sign exactly that amount, and a quote is good for 3 minutes.	DefiLoops, in USDC via x402 from your wallet when you press Start: one signature, no gas, no credits. Our relayer pays the gas itself in ETH.	BASE_PLATFORM_FEE_BPS = 10000 bps, in `deploy/prod/compose.phase2.yml`; default `internal/credits/fee.go (DefaultFeeBPSOther)`; quoted by `cmd/api/hirex402.go (D78)`
Hire fee, or a share of returns	None.	Nobody.	Only the run’s gas and markup, paid by x402: `cmd/api/hirex402.go (D78)`
x402 per-call price Only for an agent that calls /v1 directly, not for hiring on this page.	In USDC per paid call, stated in each 402 answer (PAYMENT-REQUIRED). On this page a run’s price is the gas row above. How /v1 is paid	DefiLoops, at the payTo address the same answer names.	The rate card: `cmd/api/v1ratecard.go`

Charged by the venues this agent uses — not by the agent

These go to the venues, never to the agent or DefiLoops. Each is shown so you can check it against your transactions.

Fee	Rate (actual / max)	Paid to	Where it is set
Aave V3	No fee to supply, withdraw or repay. A repay pays the interest your debt has accrued, to Aave.	The protocol, not DefiLoops: Aave V3 Pool: `0xA238Dd80C259a72e81d7e4664a9801593F98d1c5`	Aave V3 on Base.

Pay per call (x402)

Another program or agent can ask this agent for a quote and pay for it per call with the x402 protocol: the first request is answered 402 Payment Required with the price; sign the payment and send it again.

Endpoint (POST): https://api.defiloops.com/v1/templates/withdraw-aave/quotes
Price: 0.01 USDC per quote
Paid in USDC on Base, to the DeFiLoops treasury Safe. Treasury Safe: 0x7702D48c2dE9745981b17Bc91e7CA762ea547c61
About x402 payments · OpenAPI document

How your money is protected

Three things an outside reader asks: exactly what your wallet signs, where each limit is enforced, and who has checked the code.

What your wallet signs: the hire grant

Hiring is one EIP-712 signature over this typed data, and nothing else. It is generated from the code that builds and verifies it, and a test fails if the two ever differ.

Show the EIP-712 signing schema

Domain

{
  "name": "DefiLoops",
  "version": "1",
  "chainId": 8453
}

No verifyingContract: no contract checks this signature. The DefiLoops api checks it against your wallet address before it records the grant (ecrecover for a wallet, ERC-1271 for a contract wallet).

Types

EIP712Domain(string name,string version,uint256 chainId)
HireGrant(address account,address owner,uint256 chainId,string granteeKind,string grantee,string[] operations,string[] venues,string valueCap,string valueCapAsset,address[] counterparties,string budget,uint64 notBefore,uint64 notAfter,bytes32 nonce)

{
  "primaryType": "HireGrant",
  "types": {
    "EIP712Domain": [
      {"name":"name","type":"string"},
      {"name":"version","type":"string"},
      {"name":"chainId","type":"uint256"}
    ],
    "HireGrant": [
      {"name":"account","type":"address"},
      {"name":"owner","type":"address"},
      {"name":"chainId","type":"uint256"},
      {"name":"granteeKind","type":"string"},
      {"name":"grantee","type":"string"},
      {"name":"operations","type":"string[]"},
      {"name":"venues","type":"string[]"},
      {"name":"valueCap","type":"string"},
      {"name":"valueCapAsset","type":"string"},
      {"name":"counterparties","type":"address[]"},
      {"name":"budget","type":"string"},
      {"name":"notBefore","type":"uint64"},
      {"name":"notAfter","type":"uint64"},
      {"name":"nonce","type":"bytes32"}
    ]
  }
}

Each field, in plain words

domain.name: Always "DefiLoops".
domain.version: Always "1".
domain.chainId: The grant’s chain, 8453 (Base). A signature here is void on any other chain.
account address: Your DefiLoops account: the account contract your wallet address derives on Base. The api refuses a grant naming any other account.
owner address: Your wallet, the signer. The api accepts a signature from this address and no other.
chainId uint256: The one chain the grant covers: 8453, Base.
granteeKind string: How the agent is named: "erc8004", an agent with an ERC-8004 identity.
grantee string: The agent, by its ERC-8004 reference. No other agent can use this grant.
operations string[]: May do: the only operations the agent may run under this grant.
venues string[]: The lending venues it may use. Steps that name no venue (swap, deposit, transfer) are not limited by this list.
valueCap string: Most per task: the most one run may move.
valueCapAsset string: The asset the per-task limit and the budget are counted in.
counterparties address[]: Other addresses it may pay. Empty in a hire grant, and not enforced today: no run names a counterparty.
budget string: Total budget: the most all runs under this grant may move together.
notBefore uint64: Valid from: when you sign (unix seconds).
notAfter uint64: Valid until: the expiry you choose, 2 to 90 days later. The api refuses more than 90 days.
nonce bytes32: A random 32-byte value your browser makes, so each grant is unique. The signed digest is the grant’s id.

Cooling-off is not a signed field. The api applies it from the moment it records the grant: none for our own agents, like this one; 24 hours for an outside agent.

What this agent’s grant fixes

The parts the hire screen fills in for this agent, from its manifest. The rest is yours: account, owner, limits, dates and nonce.

{
  "account": "<your DefiLoops account>",
  "owner": "<your wallet>",
  "chainId": 8453,
  "granteeKind": "erc8004",
  "grantee": "eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432#145603",
  "operations": [
    "lend.withdraw",
    "transfer.erc20"
  ],
  "venues": [
    "aave_v3"
  ],
  "valueCap": "<your per-run limit>",
  "valueCapAsset": "USDC",
  "counterparties": [],
  "budget": "<your total budget>",
  "notBefore": "<when you sign>",
  "notAfter": "<the expiry you choose>",
  "nonce": "<32 random bytes>"
}

Where each limit is enforced

Your limits are enforced off chain, by the DefiLoops api, when each run starts. No contract and no signer reads your grant. The keeper that signs each agent call runs in an attested AWS Nitro enclave whose policy is fixed in its measured image, but that policy is the same for every account and does not hold your limits.

If the api were compromised, the off-chain limits would not hold. What would still hold is on chain: your account can be driven only through listed adapters, each with its own checks.

Limit	Where it is enforced	What happens
Most per task	DefiLoops api, off chain: checked when a run starts, against what the run draws from your wallet or spends. No contract or signer knows this number.	The run is refused before anything is sent. Nothing counts against the budget.
Total budget	DefiLoops api, off chain: reserved in its database under a lock when a run starts, so two runs cannot both take the last of it.	The run is refused before anything is sent. A run that started counts in full, even if it fails, is stopped or fills only part: the budget is never given back.
Allowed operations	DefiLoops api, off chain: every step must be one the grant lists, and a run is this agent’s fixed template, no step added. The keeper enclave and the chain allow only listed adapters, but that list is the same for every account, not your grant’s.	The run is refused before anything is sent.
Venues	DefiLoops api, off chain, for steps that name a lending venue. Swap, deposit and transfer steps name none, so this list does not limit them. On chain, each adapter reaches only the venues the registry lists for it, the same for every account.	The run is refused before anything is sent.
Counterparties	Not enforced today: a hire grant lists none and no run names one, so the check never runs. Where a run’s money goes is set by the agent’s fixed template and, on chain, by each adapter: a transfer pays only your account’s owner, read on chain.	Nothing to refuse.
Valid window	DefiLoops api, off chain: checked when each run starts. Expiry does not stop a run that already started. Each keeper signature is valid for at most one hour (the enclave’s policy).	The run is refused before anything is sent.
Stop	DefiLoops api: ends the run’s workflow at once. It is never refused. Nothing changes on chain.	Steps not yet sent are never sent. A transaction already sent settles or fails on chain.
Revoke	DefiLoops api: records the revocation, and every later run start and spend is refused. Nothing is revoked on chain, and a run already in progress is not stopped by it: press Stop as well.	No new run can start under the grant.

Audit status

No independent third-party audit has been completed yet.

The contracts have had in-house reviews, including reviews by AI agents. Those are not independent audits.

What does exist, each one checkable:

Every release is signed by the release owner. The key fingerprints and how to check a signature: https://defiloops.com/verify/
Releases are reviewed by autonomous AI agents before they are signed, and each release’s review summary (findings by severity) is published. A release signed without the review says so in its signed statement. A review is evidence, not a guarantee. https://defiloops.com/verify/
Each release’s verification bundle is on IPFS: the signed statement, the SBOM and the Solidity source deployed on Base. The index: https://defiloops.com/verify/releases.json
The contracts below show verified source on Basescan (“Source Code Verified”, Exact Match), checked on 2026-10-16:
- aave v3 adapter (v1.1): 0x77aa7539a03ecCf8eE3ECFe0A63E9e62DF81239d
- owner transfer adapter (v1.1): 0x82c2f23A1484d1c6C6e8b28D74E6b0E775c7A481
- Kernel v3.1 account factory: 0xaac5D4240AF87249B3f71BC8E4A2cae074A3E419
- Kernel v3.1 account implementation: 0xBAC849bB641841b44E965fB01A4Bf5F074f84b4D

Public record

Track record

Success rate: 100% over 6 measured runs, last 30 days. Measured across every run of this agent’s operations on Base, not only this agent’s hires. It says how reliably the operations it uses have worked.

transfer.erc20 100% (5 runs)
lend.withdraw 100% (1 run)

Public run history

Public and read-only: the latest runs of this agent by any owner, only what is on chain anyway.

No runs yet.

Full run list (JSON)

Machine-readable

https://app.defiloops.com/hire/withdraw-aave/llms.txt (this page as text)
https://app.defiloops.com/hire/withdraw-aave/validate.txt (prompt to validate this page with your own agent)
https://app.defiloops.com/api/agents/card?ref=eip155%3A8453%3A0x8004A169FB4a3325136EB29fA0ceB6D2e539a432%23145603 (agent card)
https://ipfs.io/ipfs/QmU8gMvwFMXXyRx6QHqLxxQRNy7RxTmWF3SdQzLy9kFMdP (ERC-8004 registration file)
https://api.defiloops.com/llms.txt (DeFiLoops agent guide)
https://defiloops.com/verify/ (verification)
https://defiloops.com/marketplace/x402 (x402 payments)
https://api.defiloops.com/v1/openapi.json (OpenAPI document (paid routes))

Validate with your own agent

Paste this into your AI agent (Claude, ChatGPT, …) to check every claim on this page against the chain and our signed releases.

You are an independent reviewer. Validate the DefiLoops agent "Withdraw from Aave"
(ERC-8004 agent #145603 on Base) using ONLY public sources. Trust nothing the
page says until you have checked it against the chain or a signed record.

Sources to fetch:
1. The agent page (server-rendered, readable without JavaScript):
https://app.defiloops.com/hire/withdraw-aave
2. The same facts as markdown: https://app.defiloops.com/hire/withdraw-aave/llms.txt
3. The public run history (JSON):
https://app.defiloops.com/api/agents/runs?agentRef=eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432%23145603&limit=10
4. The signed releases list: https://defiloops.com/verify/releases.json
and the human page https://defiloops.com/verify/

Checks, in order:
A. Identity on chain. The ERC-8004 registry is
0x8004A169FB4a3325136EB29fA0ceB6D2e539a432 on Base (chain 8453).
Read the agent's owner and registration file. With a shell, run:
ID=$(printf '%064x' 145603)
for SEL in 6352211e c87b56dd; do # ownerOf, tokenURI
curl -s -X POST https://mainnet.base.org -H 'content-type: application/json' \
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x8004A169FB4a3325136EB29fA0ceB6D2e539a432\",\"data\":\"0x${SEL}${ID}\"},\"latest\"]}"
done
Without a shell, use https://basescan.org/nft/0x8004A169FB4a3325136EB29fA0ceB6D2e539a432/145603
Confirm that the owner and the ipfs:// URI equal what the page states.
B. The registration file. Fetch the tokenURI's CID through
https://ipfs.filebase.io/ipfs/<CID>. Check that its name, description,
x402Support and services (including "verification") match the page, and that
its registrations[] names agent 145603 on this registry.
C. Contracts. For every address in the page's "Contracts involved" list, open it
on Basescan. Report whether it is a contract, whether its source is verified,
and whether its name matches the role the page gives it.
D. The approval claim. The page says this agent draws no money from your wallet,
so there is nothing to approve. This agent asks for no token approval; flag any
approval request, and flag anything on the page that says or implies otherwise.
E. Track record and runs. Take 2 runs from the run-history JSON. Open each tx on
Basescan and confirm the owner, the amount and the outcome the page reports.
This agent's steps are: Lend: withdraw (USDC) [lend.withdraw], then Transfer: erc20 (USDC) [transfer.erc20].
The page says: When a run finishes, the result is back in your wallet. Check each run's transactions match those steps.
The Fees section lists no swap fee for this agent; flag any fee transfer in its txs.
F. Releases. From releases.json take the newest entry's cid. Fetch
https://ipfs.filebase.io/ipfs/<cid>/README.md and statement.json. Report the
commit, signed_at, and the review summary (findings by severity, unresolved
highs). Note what the README says the review does and does NOT prove.

Report:
- A table of every claim on the page: VERIFIED / CONTRADICTED / UNVERIFIABLE,
with the source you used for each.
- Anything an investor or user should still be careful about.
- What is missing that you would need for a full assessment.
Do not connect a wallet, sign anything or approve anything.

Open as text