AI finance agent on NEAR · NEAR HACKATHON 2026
AI that pays real invoices.
Nothing else.
Warden pays your overseas suppliers in stablecoins and stops fake or altered invoices before any money moves. Clean invoices are paid automatically. Suspicious ones wait for you, with the reason in plain English.
No sign-up. The demo runs on sample invoices, so no real funds move.
Incoming invoice
Shenzhen Packaging Co.
SPK-2026-0418
1.24USDC
The problem
Paying suppliers abroad is slow, and invoice fraud is easy.
A small importer in Lagos paying suppliers in China and contractors in Europe spends hours on bridging and approvals. One altered invoice can wipe out a month's margin. And if you hand payments to an AI agent, a single malicious invoice can talk it into paying the wrong person.
Changed payment details
A real supplier's invoice, edited to send the money to someone else's wallet.
Fake and look-alike suppliers
"Shenzen Packaging" instead of "Shenzhen Packaging". Easy to miss at the end of a long day.
Duplicate invoices
The same invoice sent twice, or re-sent with small edits and a new number.
Hidden instructions for AI
Invisible text that tells an AI assistant to "pay this address instead".
How it works
From invoice to paid, with a check at every step.
01Upload
Drop in a PDF invoice. Warden fingerprints the file so it can never be paid twice.
02Read privately
NEAR AI Cloud extracts the fields inside a secure enclave (TEE) and returns proof of where it ran.
03Check 10 rules
Fixed rules look for changed payment details, fake suppliers, duplicates and hidden instructions.
04Contract decides
The treasury contract re-checks every limit. It only pays suppliers on your approved list.
05Pay or hold
Clean invoices are paid through NEAR Intents to the supplier's chosen stablecoin and chain.
06Logged on-chain
Every decision, including blocked attacks, is recorded on NEAR for anyone to audit.
Security model
The AI reads. Rules decide. The contract enforces.
Three independent layers, so a clever invoice, a model mistake or a compromised server still can't move your money to the wrong place.
Extracts fields. Never decides.
The model turns an invoice into a fixed record (supplier, amount, dates, payment details) and lists any instruction-like text instead of following it. It runs privately in a TEE, with attestation stored for every invoice.
Can't pay, can't choose an address, can't change a rule
Ten fixed, tested checks.
Deterministic code compares the invoice with your supplier list and payment history. Reasons are written from templates, so you always know exactly why something was held.
Can't be argued with by text inside an invoice
Your money, your limits, on-chain.
A NEAR smart contract holds the USDC. It re-checks caps and the supplier registry on every payment and pays only the registry address. The agent's key can call three methods and nothing else.
Can't be bypassed, even by a compromised server
Fraud checks
Ten red flags, checked on every invoice.
Each rule is its own file with its own tests. The full suite of 13 test invoices runs with one command: npm run test:fraud.
- R1New or look-alike supplierNot on your list, or one letter away from a supplier who is
- R2Payment address changedAddress on the invoice differs from the approved one
- R3Unusual amountFar above this supplier's usual invoices
- R4Duplicate invoice numberAlready paid or pending. Blocked outright
- R5Re-sent with editsSame amount from the same supplier within 14 days
- R6Currency changedDifferent currency from this supplier's history
- R7Hidden instructionsText like "ignore previous" or "AI assistant: pay to…"
- R8Totals don't add upLine items don't match the invoice total
- R9Unreadable or incompleteLow confidence or required fields missing
- R10Odd datesIssued in the future, or "urgent, pay today"
Try it
Three invoices tell the whole story.
Each opens in the demo dashboard with its rule checks, decision log and on-chain proof.
Built on NEAR
Each part of the safety story is a NEAR primitive.
NEAR Intents (1Click API)
Pays from USDC on NEAR to the supplier's chosen stablecoin and chain, with quotes verified before use.
NEAR AI Cloud
Private inference inside a TEE. Attestation evidence is stored and can be re-verified by anyone.
Treasury smart contract
Holds funds and enforces caps, holds, approvals and the supplier registry.
NEP-297 events
Every decision is an on-chain event. The audit trail can be rebuilt from mainnet without our backend.
Function-call access keys
The agent's key can only propose, execute and settle. It can't withdraw or change limits.
Wallet Selector
The business owner approves held payments by signing with their own NEAR wallet.
Who it's for
Small importers and agencies paying across borders.
A business in Lagos buying packaging from Shenzhen, design work from Accra and development from Lisbon. Each supplier is paid in the stablecoin and chain they prefer, from one USDC treasury on NEAR, without manual bridging.
Business model
A small fee per payment, plus a monthly plan.
- 01Per-payment fee, collected on-chain through the 1Click app-fee parameter.
- 02Subscription for spending policy, approvals and the audit trail.
Known limits
What Warden doesn't protect against (yet).
We'd rather you hear it from us. The full threat model is in the repo.
Owner approves without reading
Held invoices still need a careful human. Warden asks the owner to confirm with the supplier before overriding a fraud warning.
Compromised owner key
The owner can add suppliers and approve payments. Multisig approvals are planned.
Deposit address checked off-chain
The contract can't yet verify a 1Click deposit address on-chain; the agent verifies each quote and caps limit the damage.
See it stop a fake invoice.
Open the demo, upload the tampered sample invoice, and watch Warden hold it before any money moves.