Trustworthy DeFi Bots: ERC-8004 Onchain Reputation for Automated Trading

Trustworthy DeFi Bots: ERC-8004 Onchain Reputation for Automated Trading

DeFi trading bots that can't prove their identity are a liability — and if you're building automated strategies across Jupiter, Aave, Hyperliquid, or Lido, you already know the pain of stitching together 13 different SDKs just to get one bot talking to multiple protocols. There's a better way: a single unified API layer with built-in onchain reputation so your bot isn't just capable — it's verifiable.

The Real Problem: Fragmentation and Trust

If you've ever built a multi-protocol DeFi bot, you've lived the integration nightmare. Jupiter has its own SDK. Aave has another. Hyperliquid is a completely different beast. Drift, Kamino, Pendle, Polymarket — each one requires its own authentication logic, its own transaction construction, and its own error handling. By the time you've wired all of that together, you've written more glue code than actual trading logic.

But there's a deeper issue that doesn't get talked about enough: trust. When your bot executes autonomously — swapping, lending, staking, opening perp positions — how does anyone know it's behaving within sanctioned parameters? How do you prove, on-chain, that your agent has a track record of legitimate operation? ERC-8004 is designed to answer exactly that question, and WAIaaS has it built in.

What ERC-8004 Actually Does

ERC-8004 is an onchain agent reputation and validation standard. It lets a smart contract or protocol check whether an agent has an established reputation before allowing it to interact. Think of it as a credit score for bots — except it lives on-chain and can't be faked.

WAIaaS integrates ERC-8004 directly through its action provider system. The erc8004 provider is one of 15 DeFi protocol integrations baked into the platform, and there are dedicated MCP tools for it: erc8004-get-agent-info, erc8004-get-reputation, and erc8004-get-validation-status. You can query reputation, validate an agent's standing, and enforce a REPUTATION_THRESHOLD policy — all through the same API your bot already uses for swaps and lending.

This matters because DeFi protocols increasingly want to know who (or what) is calling them. An agent with a proven on-chain track record is fundamentally different from an anonymous wallet that just appeared. ERC-8004 gives your bot a verifiable identity that compounds over time.

One API Across 15 Protocols

Before diving into reputation mechanics, let's be concrete about what "unified API" actually means here. WAIaaS integrates 15 DeFi protocol providers:

Solana: Jupiter (swap), Jito (staking), Kamino, Drift, Hyperliquid
EVM: Aave v3, Lido (staking), Pendle, Zerox, D'CENT
Cross-chain: LI.FI, Across
Other: Polymarket, XRPL DEX, ERC-8004

Every single one of these is accessible through the same REST API pattern. Your bot authenticates once with a session token, and then calls whichever protocol it needs. Here's what a Jupiter swap looks like:

curl -X POST http://127.0.0.1:3100/v1/actions/jupiter-swap/swap \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer wai_sess_<token>" \
  -d '{
    "inputMint": "So11111111111111111111111111111111111111112",
    "outputMint": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
    "amount": "1000000000"
  }'

That's it. No Jupiter SDK. No custom RPC handling. No transaction serialization. The same pattern applies whether you're calling Aave, Lido, or Hyperliquid. Your bot sends a JSON payload with the action parameters; WAIaaS handles protocol-specific construction, signing, and submission.

Building a Reputation-Aware Trading Bot

Here's where it gets interesting from a design perspective. A reputation-aware bot isn't just one that has a good reputation — it's one that enforces reputation checks before interacting with counterparties, and builds its own reputation through consistent, policy-compliant behavior.

Step 1: Set Up the Bot's Identity

Start with the WAIaaS CLI to provision a wallet and create a session for your trading bot:

npm install -g @waiaas/cli
waiaas init
waiaas start
waiaas quickset --mode mainnet

quickset creates wallets and MCP sessions in one step. For a trading bot, you'd then create a dedicated session with constrained permissions — your bot gets its own JWT session token (wai_sess_...) that defines exactly what it can do.

Step 2: Configure Policies That Build Reputation

ERC-8004 reputation is built through consistent, bounded behavior. WAIaaS's policy engine enforces those bounds automatically. With 21 policy types and 4 security tiers (INSTANT, NOTIFY, DELAY, APPROVAL), you define guardrails once and the system enforces them on every transaction.

For a DeFi trading bot, a typical policy stack looks like this:

# Spending limit: small trades instant, larger trades require approval
curl -X POST http://127.0.0.1:3100/v1/policies \
  -H "Content-Type: application/json" \
  -H "X-Master-Password: my-secret-password" \
  -d '{
    "walletId": "<wallet-uuid>",
    "type": "SPENDING_LIMIT",
    "rules": {
      "instant_max_usd": 100,
      "notify_max_usd": 500,
      "delay_max_usd": 2000,
      "delay_seconds": 900,
      "daily_limit_usd": 5000
    }
  }'

You'd layer this with ALLOWED_TOKENS (default-deny token whitelist), CONTRACT_WHITELIST (only your known protocol contracts), PERP_MAX_LEVERAGE (cap leverage for Hyperliquid or Drift), and VENUE_WHITELIST (restrict which DEXes the bot can touch).

The REPUTATION_THRESHOLD policy is the ERC-8004 integration point: it blocks transactions from agents whose on-chain reputation score falls below a configured minimum. If your bot is interacting with a counterparty agent, you can require that agent to meet a reputation threshold before the trade proceeds.

Step 3: Check Reputation Before Trading

Through the MCP interface, your AI agent can query reputation state before executing. The 45 MCP tools include three specifically for ERC-8004:

• erc8004-get-agent-info — retrieve agent metadata and registration status
• erc8004-get-reputation — get the current reputation score
• erc8004-get-validation-status — check whether an agent passes validation

In practice, a Claude-based trading agent configured via MCP can run a check like "verify the counterparty agent's reputation before executing this trade" as a natural language instruction. Claude calls the appropriate MCP tool, gets the validation status, and proceeds (or doesn't) based on the result.

Step 4: Simulate Before You Execute

Reputation isn't just about who your bot interacts with — it's about your bot's own track record. A bot that never fails policy checks and never reverts transactions builds reputation faster. WAIaaS's dry-run API lets you validate every trade before committing:

curl -X POST http://127.0.0.1:3100/v1/transactions/send \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer wai_sess_<token>" \
  -d '{
    "type": "TRANSFER",
    "to": "recipient-address",
    "amount": "0.1",
    "dryRun": true
  }'

Run this before every execution. If the simulation fails — policy denial, insufficient balance, gas condition not met — you learn that without burning gas or generating a failed transaction on-chain. Fewer failed transactions means cleaner reputation growth.

Step 5: Gas-Conditional Execution

DeFi bots that execute at bad gas prices get crushed on EVM chains. WAIaaS has a gas condition stage in its 7-stage transaction pipeline: transactions execute only when gas price meets your configured threshold. This isn't something you need to implement — it's built into the pipeline at stage level. Your bot submits the transaction; the pipeline handles gas gating automatically.

The TypeScript SDK Path

If you prefer SDK over raw REST calls, the TypeScript SDK gives you the same access with type safety:

import { WAIaaSClient, WAIaaSError } from '@waiaas/sdk';

const client = new WAIaaSClient({
  baseUrl: process.env['WAIAAS_BASE_URL'] ?? 'http://localhost:3100',
  sessionToken: process.env['WAIAAS_SESSION_TOKEN'],
});

// Check balance before trading
const balance = await client.getBalance();
console.log(`Balance: ${balance.balance} ${balance.symbol} (${balance.chain}/${balance.network})`);

// Execute action and poll for confirmation
const sendResult = await client.sendToken({
  type: 'TRANSFER',
  to: 'recipient-address',
  amount: '0.001',
});

const POLL_TIMEOUT_MS = 60_000;
const startTime = Date.now();
while (Date.now() - startTime < POLL_TIMEOUT_MS) {
  const tx = await client.getTransaction(sendResult.id);
  if (tx.status === 'COMPLETED') {
    console.log(`Transaction confirmed! Hash: ${tx.txHash}`);
    break;
  }
  if (tx.status === 'FAILED') {
    console.error(`Transaction failed: ${tx.error}`);
    break;
  }
  await new Promise(resolve => setTimeout(resolve, 1000));
}

Handle policy denials explicitly — your bot's error handling should distinguish between retryable errors and hard policy blocks:

try {
  const tx = await client.sendToken({ to: '...', amount: '1.0' });
} catch (error) {
  if (error instanceof WAIaaSError) {
    console.error(`API Error: [${error.code}] ${error.message}`);
    // error.code examples: INSUFFICIENT_BALANCE, POLICY_DENIED, TOKEN_EXPIRED
  }
}

A POLICY_DENIED error is not retryable — don't hammer the API. Log it, alert, and wait for human review via the APPROVAL flow.

Approval Flow for High-Stakes Trades

When a trade exceeds your DELAY tier threshold, it goes into a queue. The human owner receives a notification and must approve via WalletConnect or Telegram before execution. This is the APPROVAL security tier in action:

curl -X POST http://127.0.0.1:3100/v1/transactions/<tx-id>/approve \
  -H "X-Owner-Signature: <ed25519-or-secp256k1-signature>" \
  -H "X-Owner-Message: <signed-message>"

For a DeFi bot, this is the right behavior for large positions. Your bot proposes the trade; a human reviews and signs off. The ERC-8004 angle here is that consistent use of proper approval flows — rather than trying to circumvent limits — is exactly the kind of on-chain behavior that builds long-term reputation.

Quick Start: DeFi Bot in 5 Steps

1. Install and start:

   npm install -g @waiaas/cli
   waiaas init && waiaas start
   waiaas quickset --mode mainnet
   

2. Configure policies via the REST API — at minimum: SPENDING_LIMIT, ALLOWED_TOKENS, CONTRACT_WHITELIST

3. Set up MCP for AI agent access:

   waiaas mcp setup --all
   

4. Install the TypeScript SDK and wire up your trading logic:

   npm install @waiaas/sdk
   

5. Deploy with Docker for production:

   git clone https://github.com/waiaas/WAIaaS.git
   cd WAIaaS
   docker compose up -d
   

What's Next

The combination of 15 integrated DeFi protocols, a 21-policy enforcement engine, and ERC-8004 onchain reputation means you can build bots that are not just capable but auditable and trustworthy by design. Every trade within policy bounds, every simulation before execution, every approval for high-stakes positions — it all compounds into a verifiable track record.

Explore the full codebase and self-host your own instance at https://github.com/waiaas/WAIaaS, or check the documentation and hosted options at https://waiaas.ai. The OpenAPI spec is available at /doc and the interactive reference UI at /reference once your daemon is running — start there to understand the full surface area before wiring up your strategy.

Tags: #defi #web3 #blockchain #tutorial