The AI can trade. It can never withdraw.
Every Chog owns an ERC-6551 wallet only its holder controls. To let the AI trade it, the holder grants one contract, AnimrTradeGuard, never the AI's key. This page reads that contract live from Monad.
- fork tests failed
- None of 37
- Hard cap per trade
- 50%
- Withdrawal functions
- none
What it guarantees
One narrow door, and it opens inward
The AI never holds the keys to a Chog's wallet. The holder grants one contract, AnimrTradeGuard, and that contract can only make bounded swaps whose output lands back in the same wallet.
No recipient, no token, no calldata
trade() takes none of them: every swap is CHOG ⇄ WMON on one fixed pool, and the output lands back in the same Chog wallet.
The holder's limits, under hard ceilings
Each holder sets a per-trade cap, a daily budget and a pace. The contract caps them at 50% of a balance per trade, 100% of the vault per day and 2% slippage. Trading runs both ways; buy-only is an optional holder switch, off by default.
Every fill clears a TWAP floor
Each swap must clear a minimum output from the pool's 30-minute TWAP, so a sandwich can't drain a trade.
Off in one transaction, dormant on sale
The holder can disable the AI or revoke the guard at any time. Sell the Chog and the permission goes dormant: the buyer opts in under their own limits.
The AI can
- Swap CHOG ⇄ WMON, both ways, inside this Chog's own wallet, on one pool, within the holder's limits.
The AI can never
- Withdraw or transfer tokens out of the wallet
- Choose the recipient, token, router or calldata
- Move or sell the NFT
- Exceed the per-trade cap, daily budget or pace the holder set
Limits bound what the AI can do, not whether it profits: trading can lose value.
Read live from Monad
Who holds which role, right now
The House Chog's vault
Guarded: the AI trades it, nobody can take it.
From a decision to a swap
The holder grants the guard, never the AI
One Tokenbound setPermissions([guard], [true]) from the Chog's holder lets this contract execute for the wallet. The AI's key gets nothing on the wallet itself.
The holder sets the limits
A per-trade cap, a daily budget, a minimum gap between trades and a slippage limit, all under the contract's ceilings. Buy-only is an optional extra switch.
The AI decides, then calls trade()
The Chog's AI decides on 0G Compute. Its operator key can call one trading function, trade(): which Chog wallet, buy or sell, how much, a minimum out and a deadline. Nothing else.
The guard checks everything first
The pause flag, the holder's grant and limits, the daily budget, the pace and the TWAP floor. Any miss reverts with a readable reason, such as TradeRejected("exceeds daily cap").
The swap lands back in the same wallet
CHOG ⇄ WMON on the one pool fixed at deployment. Nothing can be sent anywhere else.
Tested against forked Monad mainnet: 37 AnimrTradeGuard fork tests, 36 pass, 1 skipped by design (0 failures), Oct 21 2026. The skipped test needs an ungrown oracle; the live pool's is already grown.