What the agent actually sees

Paste anything a hostile token could put in its name field. The panel on the right is what reaches the language model's context.

This is not a demonstration reimplementation. The page is driving solana_core::sanitize compiled to WebAssembly, the same function the plugins call on real on-chain data. If it behaves here, that is because it behaves.
Pick an attack above, or type your own.
Try to beat it. The win condition is not a slogan, it is the contract the property tests assert, and this page re-checks all six clauses against the real output on every keystroke. You have beaten it if the panel below ever says BEATEN: that means an input reached output that is over the 96-character cap, or still carries a control, format, bidi or zero-width character, or has a leading space, a trailing space or a doubled space, or is not idempotent. The same clauses run as assert_output_contract in crates/solana-core/tests/properties.rs over 1,024 generated cases per property, so beating it here means those tests are wrong. Where we have already been wrong is published in docs/WHAT-WE-GOT-WRONG.md.

Raw field, invisibles revealed


    

    

      
What reaches the model

      

    

  


  


  


  

    
What this deliberately does not do

    
It does not decide whether a token is safe, and it does not drop suspicious content.
       Structural characters are removed because they have no legitimate place in a name, and
       the field is length-capped. Injection framing is only labelled, never deleted:
       dropping it would hide from the model that the field tried something, and a false
       positive would silently destroy a legitimate name. The label is the defense, and the
       decision stays with the approval gate and the on-chain spend cap.

    
Cap here is 96 characters, the default for a short label field. Source:
       crates/solana-core/src/sanitize.rs. Properties covering totality,
       idempotence and the bound: crates/solana-core/tests/properties.rs.