Critical-risk tools in Aibtc
31 of the 327 tools in Aibtc are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
bitflow_cancel_orderDestructiveCancel a Bitflow Keeper order. Cancels a pending order before execution. No API key required — uses public endpoints (500 req/min). Note: Bitflow is only available on mainnet....
-
bounty_cancelDestructiveCancel a bounty. Only the poster can call this, and only while status is 'open' or 'judging' (i.e. before any submission has been accepted). Signs with BIP-322 over: "AIBTC Bou...
-
credentials_deleteDestructiveRemove a stored credential by service and key. The encrypted store file is rewritten without the deleted entry. Tip: call `earning_opportunities` to see how to put your assets ...
-
identity_unset_walletDestructiveRemove the agent wallet association from an agent identity in the ERC-8004 identity registry. Requires an unlocked wallet. Tip: call `earning_opportunities` to see how to put y...
-
jingswap_cancel_cycleDestructiveCancel the current auction cycle if settlement has failed for too long. Can only be called 530 blocks (~17.5 min) after deposits were closed (BUFFER_BLOCKS 30 + CANCEL_THRESHOLD...
-
jingswap_cancel_sbtcDestructiveCancel your sBTC deposit from the current Jingswap auction cycle and get a full refund. Only works during the deposit phase. Works the same for both markets. Tip: call `earning...
-
jingswap_cancel_stxDestructiveCancel your token-B deposit (STX or USDCx depending on market) from the current Jingswap auction cycle and get a full refund. Only works during the deposit phase. Tip: call `ea...
-
ordinals_cancel_listingDestructiveCancel an active Magic Eden listing for an inscription. Requests a cancellation PSBT from Magic Eden. The seller signs the PSBT to invalidate the active listing and reclaim the...
-
ordinals_p2p_cancelDestructiveCancel an open offer or counter on the trade ledger. Only the parties involved in a trade may cancel it. The active wallet signs the cancellation with BIP-137 to prove authoriz...
-
pillar_direct_revoke_fast_poolDestructiveRevoke Fast Pool STX delegation from your Pillar smart wallet. Agent-signed, no browser needed. Backend sponsors gas. After revoking, STX stays locked until the current PoX cycl...
-
recover_sponsor_nonceDestructiveAttempt automated recovery of stuck sponsor transactions via the relay API, or resync the local nonce counter. Run check_relay_health first to identify stuck txids and missing ...
-
reputation_revoke_feedbackDestructiveRevoke a previously submitted feedback entry by index. Only the original submitter can revoke their feedback. Requires an unlocked wallet. Tip: call `earning_opportunities` to ...
-
stackspot_cancel_potDestructiveCancel a Stackspot stacking lottery pot before stacking begins. Cancels an unlocked pot to recover contributed STX. The pot must not yet be locked (i.e., stacking has not start...
-
wallet_deleteDestructivePermanently delete a wallet. WARNING: This cannot be undone! Make sure you have backed up your mnemonic. Tip: call `earning_opportunities` to see how to put your assets to work.
-
identity_transferFinancialTransfer an agent identity NFT to a new owner in the ERC-8004 identity registry. This clears the agent wallet association — run identity_set_wallet after if needed. Requires an ...
-
jingswap_deposit_sbtcFinancialDeposit sBTC into the current Jingswap auction cycle. Only works during the deposit phase. Amount is in satoshis (e.g. 1000 for 1000 sats). Works the same for both sbtc-stx and ...
-
jingswap_deposit_stxFinancialDeposit the token-B side (STX or USDCx depending on market) into the current Jingswap auction cycle. Only works during the deposit phase. Amount is in human units (e.g. 10 for 1...
-
lightning_claim_depositFinancialClaim a confirmed BTC L1 deposit into the Spark Lightning wallet. Call this AFTER lightning_fund_from_btc and after the on-chain transaction has 3 confirmations. Fetches a signe...
-
lightning_pay_invoiceFinancialPay a BOLT-11 Lightning invoice from the embedded Lightning wallet. Returns the payment preimage (proof of payment) and fees paid. Tip: call `earning_opportunities` to see how ...
-
ordinals_p2p_transferFinancialRecord a completed inscription transfer on the trade ledger. Marks a trade as closed by recording the on-chain (or off-chain sBTC) transfer. The active wallet signs the record ...
-
pillar_direct_withdraw_collateralFinancialWithdraw sBTC collateral from Zest on the Pillar smart wallet. Agent-signed, no browser needed. Backend sponsors gas. Tip: call `earning_opportunities` to see how to put your a...
-
sbtc_depositFinancialDeposit BTC to receive sBTC on Stacks L2. This builds, signs, and broadcasts a Bitcoin transaction to the sBTC deposit address. After confirmation, sBTC tokens are minted to yo...
-
sbtc_transferFinancialTransfer sBTC tokens to a recipient address. sBTC uses 8 decimals (same as Bitcoin). Example: To send 0.001 sBTC, use amount "100000" (satoshis). Tip: call `earning_opportunit...
-
sbtc_withdrawFinancialAlias for sbtc_initiate_withdrawal. Initiates an sBTC peg-out request to BTC L1. Tip: call `earning_opportunities` to see how to put your assets to work.
-
styx_depositFinancialFull headless BTC→sBTC deposit via the Styx protocol. Flow: reserve pool liquidity → build PSBT locally → sign with wallet keys → broadcast to mempool.space → update deposit sta...
-
transfer_btcFinancialTransfer BTC to a recipient address. Builds, signs, and broadcasts a Bitcoin transaction. Requires an unlocked wallet with BTC balance. By default, only uses cardinal UTXOs (saf...
-
transfer_nftFinancialTransfer an NFT (SIP-009) to a recipient address. Tip: call `earning_opportunities` to see how to put your assets to work.
-
transfer_runeFinancialTransfer runes to a recipient address using Runestone OP_RETURN encoding. Builds a Bitcoin transaction with a Runestone, sends runes to the recipient, and returns remaining run...
-
transfer_stxFinancialTransfer STX tokens to a recipient address. Signs and broadcasts the transaction. Example: To send 2 STX, use amount "2000000" (micro-STX). 1 STX = 1,000,000 micro-STX Tip: ca...
-
transfer_tokenFinancialTransfer any SIP-010 token to a recipient address. Supports well-known tokens by symbol: sBTC, USDCx, ALEX, DIKO Or use the full contract ID. Tip: call `earning_opportunities`...
-
zest_withdrawFinancialWithdraw assets from Zest Protocol (v0-4-market). Removes collateral and redeems for underlying assets in one atomic operation. You can use the asset symbol (e.g., 'sBTC', 'USD...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.