Security
Trust an open network of strangers' GPUs
Anyone can run a node, so the protocol assumes nodes may lie. Four independent checks catch bad output, a reputation score compounds the signal, and stake gets slashed when fraud is proven on-chain — honesty is simply the cheaper strategy.
Four layers of verification
A · Statistical re-runs
~5% of jobs are re-run on oracle-controlled nodes and compared by embedding cosine similarity (not hashes — floating-point makes exact matches impossible). Below 0.70 flags an anomaly and opens a dispute.
B · Format & length
100% of jobs get cheap deterministic checks — non-null, correct format, token count in range, no repeated-token loops. Violations penalize reputation instantly, no dispute needed.
C · Economic stake
Every node posts ≥100 $QAIS as slashable collateral. A node earning cents per job won’t risk thousands in stake to cheat — the math favors honesty.
D · Requester feedback
Requesters submit a satisfaction signal, weighted by their own reputation. A soft input only — it nudges the score but can never trigger a slash on its own.
Before each job, a node publishes a signed commitment to hash(model_id · weights_hash · backend · node_id) — proving which model ran without revealing the output.
Reputation — five weighted dimensions
One score in [0, 1], a weighted blend of five signals. Accuracy uses a single exponential moving average, so a node earns trust gradually and loses it fast — anomalies and lost disputes decay the score 10–20× quicker than a normal pass.
EMA of verified job outcomes (sampled re-runs)
Availability over a 30-day rolling window
P95 response time vs the network median
Active days, saturating at one year
Staked $QAIS, saturating at 10,000
New nodes start at 0.70. The composite score gates matching and pricing — a low score simply wins fewer jobs — but never triggers a slash on its own. Snapshots commit on-chain every 24 hours.
Slashing
Proven bad behaviour burns stake. A verified-bad result slashes 1%; losing a dispute slashes 20% of the node's stake (split below). Soft signals — uptime, latency, accuracy trends — move the reputation score, not the stake.
of stake slashed + the job refunded
of stake — FAST oracle or STANDARD commit-reveal panel
Slashed stake is partly destroyed, deepening the deflationary pressure.
The party who raised a winning dispute is rewarded from the slash.
The remainder funds protocol operations.
| Violation | Stake slashed |
|---|---|
| Verified-bad result (Layer-B or Layer-A caught a bad output) | 1% of stake + job refunded |
| Lost dispute — FAST oracle or STANDARD commit-reveal panel | 20% of stake |
| Stake drops below the 100-$QAIS minimum after a slash | node suspended until re-staked |
Disputes — commit-reveal arbitration
Contested jobs go to a five-member panel drawn from the staked arbitrator pool. Votes are committed as hashes, then revealed together — no arbitrator can copy another's vote, killing herd bias.
- 1
File. The protocol's verification oracle raises a dispute against a provider, posting a 50 $QAIS bond (refunded on a win, burned on a loss).
- 2
Commit (48h). Five arbitrators from the staked pool each submit
hash(vote · salt). No one sees another's choice. - 3
Reveal (24h). Everyone reveals vote + salt simultaneously; a 3-of-5 supermajority decides the outcome.
- 4
Resolve. A challenger win slashes 20% of the provider's stake; the winning-side revealers split a reward carved from it (a silent panel returns the bond and slashes no one). The design grades each vote against the oracle-verified truth — rewarding a correct dissenter most — which is computed off-chain today.
On-chain contracts
Nine contracts, OpenZeppelin-based (AccessControl · ReentrancyGuard · Pausable · SafeERC20), deployed directly — non-upgradeable, with custody held via multisigs. Live on Arbitrum One:
| Contract | Responsibility | Address |
|---|---|---|
| QUAISToken | ERC-20 with burn(); fixed 1B supply, no mint after genesis. | 0x1e89e050e68e81c32980205ec0db444ede3f4e2c |
| NodeRegistry | Stake, tiers, reputation storage, suspension/deactivation. | 0x60c87b02db5aabd27ff5f72a447b9fba4fbbd6b0 |
| JobEscrow | Per-job fund locking, verified release, refunds, job records. | 0x386c0257f56287da2e20b4376f579664eac71e09 |
| DisputeResolution | FAST-track dispute hook: oracle auto-resolve + 20% slash, split burn/challenger/treasury. | 0xe5c53ac5f54ff2c677aeb8e5de150ee735017ab2 |
| ProtocolTreasury | Fee accrual, burn execution, staker + operations allocation. | 0x6d13d0f94ef912c6817a74c632a378997eacf776 |
| CreditAccount support | Pre-funded deposits + EIP-712 capped batch settlement. | 0x8cd56e8c58d9a98beae719838c6e4b3520b462c6 |
| StakingRewards support | Distributes the 20% staker share of protocol fees. | 0xea85cc592027e005d1bd3243966fe7e13c943fb0 |
| ArbitratorPool support | Staked arbitrator set for the STANDARD dispute track; join / slash / enumerate. | 0xc68227c2b7e8ed0f6a1013f6f4fe888759c78397 |
| StandardArbitration support | STANDARD-track 5-member commit-reveal panel; reward/slash settlement. | 0x8e19c71658c70bff746fd94b24c6957bdc818d02 |
Settlement can't over-charge you
Requesters pre-fund a credit account, then sign one EIP-712 spending cap off-chain. The gateway batches thousands of jobs into a single settlement transaction, but can only ever settle at the prices in your signed job specs — and never beyond the cap. Worst case, a compromised gateway settles agreed work; your principal is never at risk, and you can revoke in one transaction.
Figures reflect the protocol design in the token economics spec; parameters are governance-adjustable, and the network is live on Arbitrum One.