THE SHORT VERSION
SBA-Auth gives a person or an AI agent one key in place of passwords, codes, recovery emails, and API keys. Everything your organization needs to know about who holds that key, and what they are allowed to do, is checked once and recorded on-chain as a non-transferable Soulbound ID.
After that, every single action is checked again before it runs: the signature, the ID, and the permits for that action. An agent acts quickly and on its own within its permits, and stops at a person’s hardware key beyond them. Nothing the server stores can act, so there is nothing on it to steal.
It was built for high-value operations on critical infrastructure, and the spec, contracts, test suite, and full security review are open source at github.com/SoulboundSecurity/SBA-Auth.
The Keys to Critical Systems
The systems that matter most, from production protocols to critical infrastructure and the AI agents now being handed access to all of them, are usually protected the same way as everything else.
People sign in with a password and a code, with a recovery email and a help desk as the way back in. Agents get an API key.
Each of those is something stored that can be copied, or something recoverable that can be reset. In 2023, one phishing text and a convincing phone call to IT were enough to take over an employee’s sign-in at Retool and reset 27 customer accounts, every one of them in crypto.
Nothing was cracked; each step went through a path built for convenience. An agent’s API key is weaker still: it sits in a config file, it usually allows far more than the task needs, and a cleverly worded prompt can talk an agent into using it.
Agentic Security
An agent with access to critical systems needs two things that usually pull against each other: the freedom to act quickly on its own, and the guarantee that it cannot act beyond what it has been allowed.
SBA-Auth gives it both by putting the same rule on every key. Before any action runs, the full set of checks runs too, whether the key belongs to a person or an agent, and there are no shortcuts for automation.
Sovereign within its permits. An agent enrolls like any operator and receives its own Soulbound ID, bound to its key and recorded on the public roster. Its key can be hardware or software in managed custody, and nothing in the system is an API key to leak.
Within its permits it acts at machine speed, signing each action itself, with every one checked against the chain and its allowlist.
A person’s key beyond them. Anything outside an agent’s permits is only open to a person’s enrolled hardware key. The agent proposes the action, the person’s device shows exactly what it will do in plain words, and the server proves those words match what will run before it executes.
A compromised agent can still propose a bad action. It cannot describe it as a good one, and it cannot sign it.
Human-in-the-loop becomes a property of the protocol rather than an instruction in a prompt, and a prompt instruction is exactly what an injected agent can be talked out of.
Built for High-Value Operations
SBA-Auth was built for environments where a single wrong action is the most expensive: high value transfers, protocol administration, and the other operations behind critical infrastructure.
The keys there are held by a small group, usually a handful of people and rarely more than twenty, and increasingly by the agents working alongside them.
It deliberately does not replace everyday sign-in for the rest of the company.
Soulbound Finance has gated its own operator controls with the SBA concept since April 2026, on its own implementation of the original MIT specification.
That is the originating use case and six months of production behind the shape.
This repository is a separate AGPL-3.0 implementation for everyone else, and improvements made here can be carried back.
How It Works
Enroll once, with everything your organization requires. The checks that make a key trustworthy are specific to each organization: a verified identity, a background check, sign-off from two approvers, or for an agent, its owner and what it is for.
In SBA-Auth they all run before enrollment and end in a single approval from your enrollment authority.
The key then enrolls itself on-chain and receives its Soulbound ID, derived from the key’s own address. The enrollment log becomes a public roster of every key that could ever be authorized.
Check every action. None of those organizational checks repeat. Each action carries a signature, and before it runs the server confirms the signer holds a Soulbound ID, that the ID belongs to that exact key, and that the allowlist permits it here.
Any failure gets the same refusal, and if the chain cannot be reached, nothing runs.
The whole configuration fits in an environment file. A deployment names the chain, the registry, the console, and the allowlist of who is permitted. None of it is secret.
Anyone who reads the file learns who is authorized and still cannot act as any of them, so it lives in ordinary change-controlled configuration rather than a vault.
# Treasury console: the entire authentication configuration
SBA_CHAIN_ID=42161
SBA_REGISTRY=0x… # this organization's enrollment registry
SBA_PURPOSE="Treasury Console" # the name every signature carries
SBA_IDENTITY_SALT=… # matches the registry
SBA_ALLOWLIST=0x3f1c…,0x9a07…,0x52de… # enrolled IDs permitted here, not secrets
Onboarding a person or an agent is one enrollment and one new line.
Offboarding is equally simple. There is no password to expire, no API key to rotate, and no account to disable in a third vendor’s console.
The device shows the action. When a person approves an action, their hardware wallet shows it in words, and the server rebuilds those words from the exact request it is about to run and refuses if they differ by a single character.
That is the same class of failure behind the 2025 loss at Bybit, where signers approved what looked like a routine transfer on devices that could not show them it was something else.
Device Treasury Console · withdraw 250000 USDC to 0x8f3…
Server rebuilt: "withdraw 250000 USDC to 0x8f3…" match → runs once
Server rebuilt: "withdraw 250000 USDC to 0x7c1…" differs → refused
This shows on wallets that display these fields, including browser wallets and Trezor. Ledger needs a registered display file first, as the spec states.
What you give up, on purpose. There is no account recovery: a lost key is a new, publicly visible enrollment. Systems lock shut rather than open when the chain is unreachable.
Actions beyond an agent’s permits cost a person one confirmation each.
All of the secrecy now lives in the key, so custody of that key is the most important decision in the deployment.
What We Can Help You Do
The code is open. The deployments that matter usually want help getting the details right, and these are the ones we are set up for.
Put your agents on keys, not API keys. Enroll each agent with its own Soulbound ID, decide what it may do alone, and route everything beyond that to a person’s hardware key.
Take your high-value controls off shared sign-in. Move hot-wallet, treasury, and protocol-admin consoles onto enrolled keys, so a breach of the company’s sign-in or help desk no longer reaches them.
Make enrollment carry your process. Fold identity verification, background checks, and multi-party approval into the one enrollment step.
Keep a record that answers “who approved what.” Every allowed and refused action logged against an enrolled ID, with what the approver saw and exactly what ran.
Bring it to your stack. Deployment, custody design, and verifiers for the languages your systems already run.
Commercial licensing and deployment support: sales@soulboundsecurity.io.
Soulbound Security · 31337 Security Research · Review Record
How We Reviewed It
SBA-Auth went through three reviews in nine days, by two teams that do not share context, and every page of all three is in the repository.
Engineering reviewed it before release. On 11 October, before v1.0 was published, engineering ran an adversarial review of its own code and found one Medium: a request nonce was consumed before the signature was verified, so a flood of unauthenticated envelopes could crowd a live nonce out of the cache and reopen replay. It was fixed in the same revision.
Two days later, our Nomad analysis, When Zero Meant Trusted, prompted a second pass against the zero-semantics class, and two Low hardenings shipped.
The security team audited it after release. On 16 October, the 31337 security research team audited v1.0 as a standalone artifact, deliberately blind to platform context, so that every finding would hold for any adopter rather than only for us.
The audit read the code and the documents side by side and shipped a 20-check harness that exercises the repository’s own signing and verification code.
Every finding, its severity, and what changed is in the audit log, including the one statement in our own earlier review that the audit proved wrong, corrected in place.
What We Do for Others
The record in audits/ is a public sample of how we work: two-stage review, findings graded with their reasoning including the ones we decline, harnesses anyone can re-run, and corrections made in place. We offer the same to protocols, exchanges, custodians, and fintech teams.
Hybrid adversarial review. On-chain and off-chain code reviewed together, because the systems that lose money are hybrids and the bug usually lives at the seam.
Claim audits. Does the documentation, the marketing, and the regulatory narrative match the code. The SBA-Auth audit is our public sample.
Default-value reviews. Every zero, empty, and absent value traced to every trust gate it can reach. The class that drained Nomad.
Wallet-native auth deployment. Enrollment ceremony design, signer custody, allowlist operations, and clear-signing setup, the work an open license leaves to the adopter.
Public audit logs on sbf-protocol, soulbound-points, and SBA-Auth.
About Soulbound Security
Soulbound Security is a blockchain security and technology company. We design and ship systems where privacy, compliance, and auditability are architectural properties, not policy promises, and our 31337 security research team reviews our own work the way it reviews everyone else’s.
Soulbound Security is an approved organization under Anthropic’s Cyber Verification Program.
Want to break it, deploy it, or license it?
Reviews and disclosures: security@soulboundsecurity.io
Commercial licensing: sales@soulboundsecurity.io
Sources
Soulbound Security, SBA-Auth repository: SPEC.md, USE_CASES.md, and audits/ (October 2026)
Soulbound Security, Security Audit: SBA-Auth v1.0 (16 October 2026)
Soulbound Security, When Zero Meant Trusted: How a Default Value Drained $190M from the Nomad Bridge (13 October 2026)
BleepingComputer, Retool blames breach on Google Authenticator MFA cloud sync feature (September 2023)
Halborn, Explained: The Bybit Hack, Revisited
Ledger Developer Portal, Clear Signing: ERC-7730 submission process