Exhibit 01 · Security track · NEAR OutLayer · testnet
A white-hat finds a drain at 2 a.m. and knows the team can patch it, call it “known” and pay nothing. With Sealed, the protocol gets the exploit only once the escrow is owed. On testnet: 5 of 5 real exploits paid, 0 of 21 fakes.
SEALEDd5-real-fallback and d5-nearmiss-fallback-no-receive, re-set from corpus/results.json; block times from corpus/bench.json; replay sped up. Every tx hash opens the explorer.real Ethernaut exploits paid on the keyless demo bounty
corpus/results.jsonfakes paid: all 21 refused on chain, each with a reason
corpus/results.jsonrefusal kinds fired on chain, one tx hash each
corpus/refusals.jsonrequest → verdict, p50 of 29 runs (p95 10.85 s)
corpus/bench.jsonForm SE-12 · chain of custody
The keyless demo bounty paid each level; the keyless corpus bounty refused the fakes, all on 1 November 2026. On the right, the offline replay a judge runs from a fresh clone.
| Exhibit | Commit | Worker verdict | Outcome |
|---|---|---|---|
| Fallbackreal exploit | FNbCUc53… | 2vdtrvQm… | PAID 1 000 tUSDCdeliver AodmFQ6t… |
| Telephonereal exploit | G6cmgSjp… | 7xHaZQYz… | PAID 1 000 tUSDCdeliver DQHctP4D… |
| Delegationreal exploit | ztZrSgbB… | 68CT937P… | PAID 1 000 tUSDCdeliver 7MPsnNaa… |
| Forcereal exploit | C86BJPB8… | 22iqznng… | PAID 1 000 tUSDCdeliver Hs4NVh89… |
| Kingreal exploit | r15hDvSK… | Bbw73pxg… | PAID 1 000 tUSDCdeliver 4UGJJjij… |
| Fallbacknear-miss | DUtubHSc… | 6h8JbkoV… | REFUSEDno invariant broken |
| KingLLM-written fake | 4QAGxQ5Q… | 9UaJrTLQ… | REFUSEDno invariant broken |
| Forcewrong snapshot | 4ypmjZSr… | 4S1yFPxp… | REFUSEDno invariant broken |
| Telephonemalformed | A7e6suYG… | 2SfWcmJo… | REFUSEDexploit invalid: json |
| Fallbackabuse (keccak) | 4MV8dDw7… | AwXDN6GY… | REFUSEDno invariant broken · 479 555 711 instructions |
10 of 29 runs shown (2 of the 29 ran on a keyed test bounty). make verify re-checks every verdict from chain data, and the delivery hash and PAID of the 6 paid runs (the 5 demo-bounty exploits + 1 on the keyed test bounty); make open opens all 6 deliveries offline.
$ make replay REPLAY-OK d5-llm-qwen-king: not broken (no invariant broken) · wasm d2972cd2 · h_exploit e146589ed577… = commit · verdict = chain EVM factory 0x5dddfce5….validateInstance(0xd3264fed…, 0x20000000…) → 0 REPLAY-OK d5-nearmiss-fallback-no-receive: not broken (no invariant broken) · wasm d2972cd2 · h_exploit 68dd5b7ac73b… = commit · verdict = chain EVM factory 0x5dddfce5….validateInstance(0xd3264fed…, 0x20000000…) → 0 REPLAY-OK d5-real-delegation: broken · wasm d2972cd2 · h_exploit b107c84a7df6… = commit · verdict = chain · enc 296 B = h_enc EVM factory 0x5dddfce5….validateInstance(0x1780ddd8…, 0x20000000…) → 1 REPLAY-OK d5-real-fallback: broken · wasm d2972cd2 · h_exploit 336ea1fb468c… = commit · verdict = chain · enc 508 B = h_enc EVM factory 0x5dddfce5….validateInstance(0xd3264fed…, 0x20000000…) → 1 REPLAY-OK d5-real-force: broken · wasm d2972cd2 · h_exploit 3649a6dc71a8… = commit · verdict = chain · enc 808 B = h_enc EVM factory 0x5dddfce5….validateInstance(0xd3264fed…, 0x20000000…) → 1 REPLAY-OK d5-real-king: broken · wasm d2972cd2 · h_exploit eaefe19d7a6b… = commit · verdict = chain · enc 1816 B = h_enc EVM factory 0x5dddfce5….validateInstance(0xd3264fed…, 0x20000000…) → 1 REPLAY-OK d5-real-telephone: broken · wasm d2972cd2 · h_exploit f6278676855b… = commit · verdict = chain · enc 1400 B = h_enc EVM factory 0x5dddfce5….validateInstance(0xd3264fed…, 0x20000000…) → 1 … replay: 29 OK · 0 FAIL · verifier.wasm d2972cd2659c2ad4… $
Captured stdout of make replay (1 Nov 2026), lines selected, none edited.
Exhibit procedure · five parts, one flow
No triager decides. The rules are written before any bug exists; a TEE runs the exploit against them; the contract pays or refuses.
The pinned verifier replays the exploit in revm on the committed snapshot and asks the level's own validateInstance: the Ethernaut level's rule, not ours.
The hunter stores the exploit as an OutLayer encrypted secret, then commits H(exploit ‖ hunter ‖ salt) with a bond.
The demo and corpus bounties were created from one global contract hash with no access keys. Nobody can pull awarded escrow.
NEAR global contract · 7HtmeswB…Six refusal kinds, each fired on chain. A refused verdict or an expired award slashes the bond; the other refusals only log the reason.
The exploit goes to the protocol sealed to its key. The contract pays only if sha256(enc) equals the hash the worker attested.
Same 21 fakes · four triagers
Each slip is one of the 21 fakes that went on chain. Three LLMs read each one (with the hunter's claim, where it had one) and voted; the verifier had already run them.
Same submission per column. Third-party models, not NEAR AI Cloud, one run each; every fake a model paid is one of the 5 that carried a hunter claim. On the 15 real exploits they paid 12, 12 and 11 (one qwen call failed with HTTP 403 and counts as a refusal; one nemotron reply on a fake had no verdict and also counts as not paying). Record: baseline/run.json.
Honest by design
Testnet only. The mainnet leg is prepared (scripts/mainnet_leg.py) and has not run.README · Honest limits, item 1Worker attestation.README · Honest limits, item 2make verifyshows the request pinned the verifier hash and the operator's OutLayer worker key answered (a FunctionCall key limited to OutLayer's contract, its method list includingresolve_execution). It checks the key, not its TDX quote, and does not show the worker ran exactly those bytes.make replayre-runs the same bytes locally.
No outside users yet. The measured demo is our own hunter agent plus the fakes corpus.README · Honest limits, item 7
Questions from the bench
Each answer points at a file or a command in the repo.
No. make replay re-runs every published verdict offline with the verifier wasm each bounty pinned; make verify reads chain data from a public archival RPC (make verify-demo: the five paid runs, about 1.5 min).
That the request pinned the verifier hash and a registered OutLayer worker key answered, not that the worker ran exactly those bytes. make replay runs the same bytes on your machine.
A bond on every commit, slashed on a refused verdict, and the level's own check: 21 fakes on chain, 0 paid. The heaviest abuse input used 23.98% of the 2e9-instruction limit.
The bounties have no access keys and their rules are fixed at funding. Reserved and awarded escrow cannot be withdrawn (I4); only the unreserved pool can, after a timelock (7 days by default).
The 20 sandbox tests use a mock OutLayer and token. The 29 testnet runs use the live OutLayer worker and a test token; mainnet has not run.
On the same 21 fakes, LLM-only triage paid 1, 3 and 3 (third-party models, one run each, not NEAR AI Cloud). The executing verifier paid 0. See baseline/README.md.