Understand the boundaries.

Why a compromised agent key cannot drain these funds

A session key on BNB Smart Chain can be scoped to a target contract and a set of selectors, but not to the arguments of a call. Scope an agent to Aave's withdraw(asset, amount, to) and it picks to itself. The router exists to take that choice away. Every claim below is in contracts/src/AgripinaaYieldRouter.sol.

• Three entrypoints, none of which takes an argument

  toAave() (0xdb1a4d6d), toVenus() (0x88b480df), and toIdle() (0x18b5e866). A key scoped to this address and these three selectors has nothing left to choose beyond which of the three to call.

• Every recipient is hardcoded to msg.sender

  Aave mints its aTokens straight to the calling account, the Venus vTokens minted in a call are transferred back to it, and an unwind sends the stablecoin back to it. The contract has no address parameter anywhere for a caller to point at itself.

• Delta accounting, so a donation cannot be swept

  _collectUsdt records the router's balance on entry and pays out only what that call brought in. Anything sitting in the router beforehand, whether a stray transfer or a deliberate donation, stays where it is. This is the fix for audit finding L-1, and it is why the router being empty is a property rather than a coincidence.

• No owner, no admin, no upgrade path

  No owner variable, no privileged role, no proxy, no delegatecall, no selfdestruct. Runtime bytecode cannot change after deployment, so a security fix requires a new address instead of silently changing either contract above.

What the fuzzers checked

contracts/test/fuzz/RouterFuzz.sol drives deposits, rotations, withdrawals, and out-of-band donations across three independent actors, against mocks of BSC USDT, Aave V3, and Venus. It asserts two properties:

• echidna_no_actor_exceeds_deposits: no actor ever holds more value than they deposited, so an attacker who deposited nothing ends with nothing, and nobody sweeps another actor's principal.
• echidna_router_holds_only_donations: the router never custodies more than what was donated to it.

The repository runs stateful Medusa properties alongside fork tests against BNB Smart Chain state, including donated balances, ordinary venue debt, Venus VAI debt, same-target no-ops, and zero-share mint protection.