Critical-risk tools in Awesome Base
18 of the 44 tools in Awesome Base are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
hyperliquid_cancel_orderDestructiveSigns and cancels an open Hyperliquid order for a coin enabled in the WebUI policy.
-
wallet_revoke_allowanceDestructiveSets this Agent wallet
-
aave_borrowFinancialBorrows a bounded ERC-20 amount from Base Aave V3 using an enabled interest-rate mode.
-
aave_repayFinancialRepays a bounded Base Aave V3 debt amount. A Pool allowance is required.
-
aave_supplyFinancialSupplies an ERC-20 asset to Base Aave V3 for the Agent wallet or a specified beneficiary. A Pool allowance is required.
-
aave_withdrawFinancialWithdraws a bounded ERC-20 amount from Base Aave V3 to the Agent wallet or a specified recipient.
-
aerodrome_swapFinancialExecutes a bounded Base Aerodrome classic-pool multi-hop exact-input swap. A router allowance is required for the input token.
-
cow_place_orderFinancialGets a Base CoW quote, signs the EIP-712 order with the Agent wallet, and submits it to the CoW Orderbook under the configured policy.
-
hyperliquid_place_orderFinancialSigns and submits a Hyperliquid perpetual limit or IOC order with the local Agent key, subject to the WebUI coin, notional, and execution policy.
-
hyperliquid_transferFinancialSigns and moves USDC between the Hyperliquid spot and perpetual accounts with the local Agent key, subject to the WebUI execution policy.
-
morpho_borrowFinancialBorrows a bounded loan-asset amount from a Base Morpho Blue market.
-
morpho_repayFinancialRepays a bounded loan-asset amount in a Base Morpho Blue market. A Morpho allowance is required.
-
morpho_supplyFinancialSupplies a bounded loan-asset amount to a Base Morpho Blue market. A Morpho allowance is required.
-
morpho_withdrawFinancialWithdraws a bounded loan-asset amount from a Base Morpho Blue market.
-
morpho_withdraw_collateralFinancialWithdraws a bounded collateral-asset amount from a Base Morpho Blue market.
-
uniswap_swap_v3FinancialExecutes a bounded Uniswap V3 exact-input swap on Base. Quote first and supply a conservative minimumAmountOut. A router allowance is required.
-
wallet_payFinancialSends a native ETH or ERC-20 Base payment, subject to execution enablement, recipient blacklist, and optional per-asset amount caps.
-
zeroex_swapFinancialFetches a 0x AllowanceHolder quote and broadcasts its transaction from the Agent wallet after contract, amount, and simulation guards pass.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.