Security
Trust an open network of strangers' GPUs
Anyone can run a node, so the protocol assumes nodes may lie. Four independent checks catch bad output, a reputation score compounds the signal, and stake gets slashed when fraud is proven on-chain — honesty is simply the cheaper strategy.
Four layers of verification
A · Statistical re-runs
~5% of jobs are re-run on oracle-controlled nodes and compared by embedding cosine similarity (not hashes — floating-point makes exact matches impossible). Below 0.70 flags an anomaly and opens a dispute.
B · Format & length
100% of jobs get cheap deterministic checks — non-null, correct format, token count in range, no repeated-token loops. Violations penalize reputation instantly, no dispute needed.
C · Economic stake
Every node posts ≥100 $QAIS as slashable collateral. A node earning cents per job won't risk thousands in stake to cheat — the math favors honesty.
D · Requester feedback
Requesters submit a satisfaction signal, weighted by their own reputation. A soft input only — it nudges the score but can never trigger a slash on its own.
Before each job, a node publishes a signed commitment to hash(model_id · weights_hash · backend · node_id) — proving which model ran without revealing the output.
Reputation — five weighted dimensions
One score in [0, 1], a weighted blend of five signals. Accuracy uses a single exponential moving average, so a node earns trust gradually and loses it fast — anomalies and lost disputes decay the score 10–20× quicker than a normal pass.
New nodes start at 0.70. The composite score gates matching and pricing — a low score simply wins fewer jobs — but never triggers a slash on its own. Snapshots commit on-chain every 24 hours.
Slashing
Proven bad behaviour burns stake. A verified-bad result slashes 1%; losing a dispute slashes 20% of the node's stake (split below). Soft signals — uptime, latency, accuracy trends — move the reputation score, not the stake.
| Violation | Stake slashed |
|---|---|
| Verified-bad result (Layer-B or Layer-A caught a bad output) | 1% of stake + job refunded |
| Lost dispute — FAST oracle or STANDARD commit-reveal panel | 20% of stake |
| Stake drops below the 100-$QAIS minimum after a slash | node suspended until re-staked |
50% — burned
Slashed stake is partly destroyed, deepening the deflationary pressure.
30% — challenger
The party who raised a winning dispute is rewarded from the slash.
20% — treasury
The remainder funds protocol operations.
Disputes — commit-reveal arbitration
Contested jobs go to a five-member panel drawn from the staked arbitrator pool. Votes are committed as hashes, then revealed together — no arbitrator can copy another's vote, killing herd bias.
- File. The protocol's verification oracle raises a dispute against a provider, posting a 50 $QAIS bond (refunded on a win, burned on a loss).
- Commit (48h). Five arbitrators from the staked pool each submit
hash(vote · salt). No one sees another's choice. - Reveal (24h). Everyone reveals vote + salt simultaneously; a 3-of-5 supermajority decides the outcome.
- Resolve. A challenger win slashes 20% of the provider's stake; the winning-side revealers split a reward carved from it (a silent panel returns the bond and slashes no one). The design grades each vote against the oracle-verified truth — rewarding a correct dissenter most — which is computed off-chain today.
On-chain contracts
Nine contracts, OpenZeppelin-based (AccessControl · ReentrancyGuard · Pausable · SafeERC20), deployed directly — non-upgradeable today, with admin/pauser held on a separate cold key (a multisig + timelock is the mainnet plan). Live on Arbitrum Sepolia:
| Contract | Responsibility | Address |
|---|---|---|
| QUAISToken | ERC-20 with burn(); fixed 1B supply, no mint after genesis. | 0x5532663d…b25531 |
| NodeRegistry | Stake, tiers, reputation storage, suspension/deactivation. | 0x31651e2e…38c8a5 |
| JobEscrow | Per-job fund locking, verified release, refunds, job records. | 0x00543940…1e2956 |
| DisputeResolution | FAST-track dispute hook: oracle auto-resolve + 20% slash, split burn/challenger/treasury. | 0xafbc2f5c…fcbcd5 |
| ProtocolTreasury | Fee accrual, burn execution, staker + operations allocation. | 0xe4e48c61…3c870e |
| CreditAccount support | Pre-funded deposits + EIP-712 capped batch settlement. | 0xa878682a…45b56f |
| StakingRewards support | Distributes the 20% staker share of protocol fees. | 0xf29a1cc4…5c300e |
| ArbitratorPool support | Staked arbitrator set for the STANDARD dispute track; join / slash / enumerate. | 0xd2455983…7234e6 |
| StandardArbitration support | STANDARD-track 5-member commit-reveal panel; reward/slash settlement. | 0x694543d3…c63f22 |
Settlement can't over-charge you
Requesters pre-fund a credit account, then sign one EIP-712 spending cap off-chain. The gateway batches thousands of jobs into a single settlement transaction, but can only ever settle at the prices in your signed job specs — and never beyond the cap. Worst case, a compromised gateway settles agreed work; your principal is never at risk, and you can revoke in one transaction.
Figures reflect the protocol design in the token economics spec; parameters are governance-adjustable and the network is currently testnet only.