01The problem
The world has a shortage of accessible GPU compute and, at the same time, an enormous amount of it sitting idle — in home rigs, in small studios, in racks that are busy eight hours a day. The gap is not hardware. It is trust.
A renter handing money to a stranger's machine has to believe three things at once: that the GPU is real and is the model claimed, that it will actually be available when the job starts, and that if it is not, there is recourse. Centralised clouds answer all three with a brand. Decentralised markets have mostly answered them with self-reported specs and an uptime dashboard, which is why the good hardware stays where the brands are.
WRAITHGRID answers each of the three with a mechanism rather than a promise: hardware proves itself cryptographically before it can list, keeps proving it on a clock, and stands behind every job with collateral a quorum can slash.
02Architecture: a soul and a body
Two tokens exist per physical GPU, and the split between them is the whole design.
SOUL — the identity
A soulbound token (ERC-5192) minted once per physical card. It is non-transferable by construction: there is no code path that moves one between wallets. It records the hardware fingerprint, the device key that machine signs with, its verified class, and the timestamp of its last proof of life.
Crucially, reputation is keyed to the hardware fingerprint, not to the token. A provider can retire a card and enrol it again, but it comes back with its record — the completed jobs, the failures, and any ban. Identity laundering by re-minting does not work.
SHELL — the licence
A freely tradeable ERC-721 representing a claim on a slice of what that GPU earns. Licences bind to the hardware and the operator that issued them, so a brief outage and a re-enrolment does not destroy what a holder bought, while a card that genuinely changes hands does not carry the previous operator's obligations to a stranger.
Supporting contracts
AttestorSet— the root of trust. An M-of-N quorum of independent attestors, with one shared EIP-712 domain and a strict-majority threshold enforced in code.GridMarket— listings, escrow, bonds, job lifecycle, disputes, and pull-payment settlement.GridConfig— every economic parameter, each hard-capped so governance can tune but never expropriate.SoulVault— custody for mint deposits, staked through a liquid-staking vault.
03Proof of compute
Enrolment is not a form. An attestor issues a challenge that could not have been precomputed:
a random seed, a matrix dimension, an iteration count, and a random projection vector. The
machine must compute C = A·B in fp16 on the device and return
v = C·r before a deadline derived from the model being claimed. The same
arithmetic runs on every class — CUDA, ROCm, Metal, or numpy on a CPU — so one verifier
covers all of them.
Verification uses Freivalds' algorithm: the attestor checks
v == A·(B·r) with two streaming O(n²) passes instead of redoing O(n³) of work.
Checking is thousands of times cheaper than cheating, and cheating costs the same as being
honest. No accelerator is needed to verify — the attestor checks on a CPU.
Two bounds, not one. Measured throughput must land between roughly 35% and 110% of the claimed model's peak. The lower bound stops a weaker device claiming a stronger model. The upper bound catches one fast card answering challenges on behalf of twenty claimed ones — the failure mode a naive "is it fast enough?" test misses entirely.
The random matrices are generated by a counter-based PRNG that both the prover (Python, on the device) and the verifier (JavaScript, on the attestor) implement identically. A parity test pins them together, because any drift between the two would fail every honest machine on the network.
04What can carry a soul
A grid that only accepts one vendor's accelerators is not a decentralised data centre, it is a resale channel. Four classes of machine can be enrolled, and the interesting problem is not admitting them — it is admitting them honestly, because an hour of a CPU is not an hour of an H100 and a market that pretends otherwise burns its renters once and never sees them again.
| Class | Probed with | Identity comes from | Reward x |
|---|---|---|---|
| NVIDIA GPU | nvidia-smi | driver UUID, board serial, PCI address, VBIOS | 1.00 |
| AMD GPU | rocm-smi | unique id, serial, PCI address, VBIOS | 0.95 |
| Apple silicon | system_profiler | platform UUID, hardware serial, chip, model | 0.85 |
| CPU | cpuinfo and the platform's board serial | a synthesised id: model, core count, board serial | 0.35 |
| Browser tab | navigator.gpu | the adapter WebGPU will describe, plus a key the browser keeps | 0.50 |
Identity is hashed with the class mixed in, so a CPU and a GPU can never collide even if their raw strings did. Each class also has its own strong fields, and how many of them the probe actually produced sets a trust tier — Verified, Attested or Declared — which multiplies rewards by 1.0, 0.8 or 0.5 for the life of the enrolment. A container that hides the board serial is not rejected. It earns less, permanently, and says so on its own listing.
WCU: one number, measured not claimed
Capability is expressed in Wraith Compute Units. One WCU is roughly one RTX 4090 running dense FP16:
WCU = (0.55 × TFLOPS fp16 + 0.30 × bandwidth GB/s ÷ 40 + 0.15 × min(memory GB, 256) ÷ 2) × class multiplier ÷ 100
Throughput dominates because it is the part a challenge can actually verify. Bandwidth and capacity carry real weight because a model that does not fit does not run at any speed. Capacity is capped so a machine cannot buy a tier with RAM alone. Deposit, reward weight and capability tier — Flagship, Datacenter, Prosumer, Workstation, Light — all follow from the same number, so there is exactly one place where a device's worth is decided.
WCU is not the price hint. Nobody rents a 96-core EPYC to do matrix multiplication; they rent it for cores, memory and IO on data prep, indexing, CI and transcode. Priced off its FP16 number it would list at three cents an hour when the same box rents for over a dollar. So the suggested price is computed the way each class is actually bought — accelerators on throughput, Apple on unified memory, CPUs on cores and RAM — while WCU stays the unit for rewards and deposits, where verifiability is what matters. Listings set their own price regardless; the hint is a starting point, not a rule.
An unrecognised CPU still enrols, on a generic template scaled to the cores and memory it actually has. An unrecognised accelerator does not: deposit, reward weight and the attestor's throughput band all key off the model, and a guess there is a mispriced listing rather than a cosmetic gap.
The browser is a real provider, with real limits
A tab can carry a soul. WebGPU is enough to run the same challenge every other class runs: a tiled matrix multiply in WGSL, generating its matrices from the same counter-based PRNG, verified by the same Freivalds check on the same attestor. Nothing is relaxed for it.
Three things about the class are different, and all three are visible rather than hidden:
- It cannot name its own hardware. WebGPU will not identify the silicon - that is a fingerprinting surface browsers deliberately closed - so a tab is not matched to a model at all. It is placed in a capability band by what it actually sustained under challenge, and its identity is a key the page generates and keeps, which identifies the browser profile rather than the card. That is the weakest identity on the grid and sits permanently at the lowest trust tier.
- It cannot hold residency. The class serves language models, and the weights already occupy what a tab is allowed to allocate. Browser jobs therefore carry no commitment, are marked unprotected on chain, and what they sell is a token stream rather than an exclusive machine. Section 5 explains why that distinction is on the record.
- It has no address. A tab cannot accept a connection, so it dials out to a relay and is served through that socket, proving it is the machine by signing a fresh nonce with the same device key the registry holds. The bearer token for a job is minted by the relay and reaches the renter only inside the sealed endpoint document - holding the ciphertext is not enough to use it. The cost is that the relay can see that traffic, which is stated in every browser job's endpoint document; run your own if it matters.
The class is worth very little per tab - a few cents an hour, because WebGPU cannot reach tensor cores and a browser is several times slower than a native runtime. It is in the protocol because there are a great many tabs, and because it is the only way onto the grid with nothing installed on either side.
05Exclusivity, and why it is the hard part
Proof of compute establishes that a machine exists and is as fast as it says. It does not establish that the machine is yours for the hour you paid for. A provider can pass every enrolment challenge honestly and then sell the same card to four renters at once, and every naive countermeasure fails:
- Ask it how busy it is. Self-reported, and a provider willing to oversell is willing to lie about it.
- Commit to a buffer in VRAM. Proves possession, not exclusivity. The buffer can live in host RAM and be answered over PCIe in microseconds.
- Prove the bandwidth that would separate VRAM from host RAM. Correct in principle and unverifiable on chain: a contract cannot recompute a checksum over gigabytes.
What WRAITHGRID actually does
When a machine accepts a job it allocates a large buffer on the device — currently 60% of its attested memory — fills it deterministically from a seed neither side chose alone, and commits to a Merkle root over its 1024 blocks in the same transaction that takes the job. Then it holds it, for as long as the job runs.
That allocation is not paperwork; it is the mechanism. Two jobs cannot both hold 60% of one machine. Overselling stops being a policy someone has to enforce and becomes a thing that will not fit.
Anyone may then demand a block. The index comes from the hash of a block that had not been
mined when the commitment was made, so nothing can be precomputed and no answer prepared in
advance. The answer is the block's hash and its Merkle path, signed by the device key —
a relayer holding the data cannot stand in for a card that has gone away. Answer inside the
window and the job carries on. Fail to, and anyone at all can call
claimBreach: the renter gets the full price back and the provider's
bond, and the failure lands on the hardware's permanent record. No quorum, no arbiter, no
human judgement anywhere in the path.
The check that makes it worth anything. The commitment carries how much memory is held, and the contract measures it against the device's attested capacity. Without that, a provider could commit a single 64 MiB block on an 80GB card, answer every challenge instantly, and sell the rest of it twice over. A job may also be accepted with no commitment at all — but it says so on chain, and a renter who cares can refuse to let the clock run on one.
Alongside it, a device may publish signed telemetry — memory in use, process count, the set of jobs it believes it is running — against a recent blockhash. This is deliberately not presented as proof. Its value is that it converts oversubscription from something a provider can deny into something a renter can prove: read the same counters from inside your own container, and a mismatch is a signature over a false statement. That goes to the quorum and costs the whole mint deposit plus a permanent ban on the hardware. The cryptography bounds the cheap attack; the economics handle the rest.
06The 72-hour rule
There are two different questions inside "is it online", and conflating them makes a GPU market either expensive or unreliable. Is it up right now is needed in seconds and does not need to be on chain. Is this still a real, present machine at all is needed in days and absolutely does.
A soul must produce a device-signed proof of life at least every 72 hours.
Miss it and isLive() returns false — computed, never stored, so it takes effect
the instant the clock passes with no keeper, no transaction, and nobody watching. The machine
cannot list, cannot be rented, and cannot mint licences.
Why heartbeats cannot be faked ahead of time
Each proof commits to the hash of a recent block, and the accepted block number only ever moves forward. A month of heartbeats cannot be signed in advance and dripped out from a machine that is switched off, and a captured heartbeat cannot be replayed later.
Why this is safe for honest operators
Accepting a job is itself a proof of life, so a busy machine never lapses. And the three-day cooldown that stops a provider retiring out of an in-flight dispute is deliberately not applied to a liveness lapse: a power cut is not a dispute-dodge, and making a four-hour outage cost four days off the grid would be indefensible. Coming back is immediate — but you come back with your record.
A permissionless expire() lets anyone sweep a lapsed soul, freeing its
fingerprint for whoever holds that card next and paying the caller a small bounty out of the
expired deposit. Cleanup funds itself.
07Collateral and disputes
Providers stake collateral per card. Accepting a job locks a bond out of it, sized as a share of the job's value. The renter's escrow settles on one of three paths:
- Confirmation — the renter got its compute and says so; settlement is immediate.
- Timeout — the renter went quiet; anyone may close the job once the dispute window passes with no dispute raised.
- Ruling — the renter disputes, and an attestor quorum signs a resolution refunding up to 100% of the price and slashing up to 100% of the bond as damages on top.
Collateral is keyed by (hardware, staker) rather than by token id. Two properties fall out of that, both intentional: a provider's money survives the soul being burned by retirement, revocation or the liveness rule, and withdrawal is self-authorising — a caller can only ever address its own bucket, so there is no ownership check to get wrong.
This was a bug before it was a design. The first implementation authorised
withdrawal against ownerOf, which reverts once a soul is burned. Under a
72-hour expiry rule that would have confiscated a provider's collateral on every power cut.
It was found by writing a test to prove it, and the test is kept as a regression.
08Who decides, when it is genuinely contested
Most failures are not arguments. A machine that stops holding the memory it sold is caught by the residency probe and settled arithmetically. A job nobody accepted is reclaimed by its renter on a timer. Neither needs an opinion, and neither gets one.
What is left is genuinely contestable: was the machine usable, was it running the workload that was ordered, was throughput anywhere near what the listing claimed. The market has always settled those by attestor quorum - but what the quorum did with a dispute was a person forming a view. That is slow, it does not scale, and it was the one place in the protocol where the answer depended on who was asked.
A jury panel replaces the judgement, not the quorum. Independent operators each run a model of their own choosing, read the same evidence, and return a structured verdict. Four properties of asking a model to move somebody's money, and what each one forces:
| The problem | What it forces |
|---|---|
| Models are not deterministic | Two runs of one prompt can disagree, so no single verdict can be the rule. The contract takes the median of the panel, and a lone outlier moves nothing. |
| The evidence is written by the disputing party | Handing a model attacker-controlled text is prompt injection with a payout attached. Evidence is committed by hash before any verdict exists, so it cannot be revised once a ruling starts to look unfavourable; and a verdict is two numbers and a reason code from a closed set, so an instruction smuggled into the evidence has nothing to steer. |
| Whoever runs the model is the arbiter | "Ask one model" means the holder of one API key decides, which re-centralises exactly what the quorum distributes. Each juror records which model produced its verdict, so a ruling reached by three copies of one model is a legible fact rather than a hidden one. |
| Copying is cheaper than thinking | A juror who can read the votes already cast will follow them, and a panel that copies is one juror wearing three hats. Votes are committed hidden and revealed afterwards. |
Escrow is never frozen by jurors going quiet. A panel that does not turn up can be abandoned by anyone once its windows close, and the job falls back to the quorum's own resolution path. An automated arbiter that can hold somebody's money hostage by doing nothing would be worse than no arbiter at all.
None of this makes a model's judgement correct. It makes a single model's judgement insufficient, makes the evidence it saw fixed and public, makes who decided visible, and keeps the money moving whatever the panel does. The objective mechanisms remain the ones worth trusting most; this is for the cases where nothing objective exists.
09Compute licences
A licence comes in two flavours, chosen when it is minted.
A yield licence pays its holder a fixed share of the gross revenue of every job that GPU settles, for as long as they hold it — plus a referral cut on jobs they source. A compute licence instead entitles the holder to a number of GPU-seconds per epoch on that card, redeemable at zero marginal cost: the purchase price is the prepayment.
The guardrails that make the second safe to sell:
- Oversell cap — total entitlements on a card cannot exceed a fixed share of wall-clock per epoch. A provider cannot promise more hours than it has.
- Same bond, same teeth — a redeemed job locks the provider's bond exactly like a paid one. The licence is a collateralised claim, not a promise.
- Use it or lose it — entitlements expire per epoch, so a provider can plan capacity.
Aggregate licence share per GPU is capped at 25% by default and can never exceed 30%, a constant in the contract. Combined with the protocol fee and referral, the provider always keeps the clear majority of what a job earns — asserted as a fuzz test, not a policy.
10The mint deposit
Minting a soul requires locking MON. The protocol stakes it for the life of the NFT, keeps the staking yield, and returns the principal when the card leaves. Note what that is not: it is not a fee. What the provider pays is the opportunity cost of the float.
One mechanism, three jobs:
- It makes spamming fake hardware cost capital as well as compute — and the deposit scales with the class being claimed, because faking an H100 is worth more than faking a 4090.
- It gives the protocol revenue on day one, at zero utilisation, before a single renter arrives.
- At current rates the yield on a deposit roughly covers the gas that same GPU spends proving it is alive. The network pays for its own heartbeat.
| Class | Deposit | Yield / yr |
|---|---|---|
| Consumer — 4090, 5090 | 15 MON | 1.24 |
| Prosumer — A6000, L40S | 30 MON | 2.48 |
| Datacenter — A100, H100, H200, B200, MI300X | 60 MON | 4.96 |
Verified against mainnet, not assumed. The vault is tested against the live
shMON contract on a Monad fork: a 15 MON deposit mints 9.3376 shares at a rate of 1.6063,
maxWithdraw returns 14.8955 MON, and the exit completes in the same transaction
with no request queue. That is a 0.697% exit spread, and it confirms the two properties the
design depends on — native MON in, synchronous MON out.
Principal returns in full on a voluntary retirement, minus the reaper bounty on a liveness
expiry, and is forfeited to the insurance fund on a quorum revocation for fraud. Returns are
credited to a pull-payment ledger rather than pushed, because pushing would let a provider
whose address cannot receive MON block expire() forever and squat its
fingerprint past the 72-hour rule.
11Reaching the hardware
This is where decentralised compute usually fails quietly. A datacenter card has a public IP; a 4090 in a spare room has a router with no inbound ports. A design that only works for the first is a cloud reseller with extra steps.
renter publishes job spec (image, ssh key, ephemeral X25519 key) → relay
commits specHash on chain when opening the job
agent reads spec, starts the container, opens an outbound tunnel
seals the endpoint to the renter's key, publishes the blob → relay
commits endpointHash on chain with its signed acceptance
renter fetches blob, checks keccak(blob) == endpointHash, decrypts locally, connects
Both hashes are on chain, so neither side can later claim a different spec was agreed or a different endpoint delivered. The relay is a content-addressed bulletin board: it can withhold, but it cannot lie, and anyone can run one. Three transports sit under the same flow — direct for public IPs, an outbound tunnel for machines behind NAT, and a fallback TCP relay. The sealed endpoint carries the SSH host key fingerprint so the renter pins it and no intermediary can interpose.
12Economics
Listings are priced in stablecoins. A provider quoting a dollar rate and being paid in a volatile asset is taking a trade it did not ask for, and the first drawdown empties the grid. $WRAITH does the jobs a stablecoin cannot: rewarding proven availability, rebating renters, buying capacity, and capturing fees.
| Parameter | Launch | Hard cap |
|---|---|---|
| Protocol fee | 2.5% | 10% |
| Referral to the sourcing licence | 1.5% | 5% |
| Aggregate licence share per GPU | 25% | 30% |
| Provider bond per job | 20% | 50% |
| Licence royalty to the provider | 2.5% | 10% |
| Licences per GPU | — | 8 |
Emissions
Providers earn $WRAITH per settled WCU-hour: capability actually proven, multiplied by time actually paid for. A machine at 1.00 WCU — roughly an RTX 4090 — earns the base rate for an hour of work; an H100 at 5.75 WCU earns 5.75 times it. A fully refunded job earns nothing, a partially refunded one earns proportionally less, and a provider renting their own machine through a second wallet earns nothing at all.
Accrual happens in the settlement transaction, as a callback the market makes after every balance is already credited — wrapped in a try/catch, on a bounded gas stipend, into a pull-payment ledger. A rewards contract cannot hold a job hostage, cannot make settling unaffordable, and has nothing to drain if it reenters. Emissions are claimed, never pushed: an ERC-20 transfer to an unknown address can fail, and a failed push inside settlement would burn the stipend for nothing.
Availability
A second, deliberately smaller rate pays for time a machine was provably online and listed at a real price: one $WRAITH per WCU-hour. Which is exactly one an hour for a 1.00 WCU machine - an RTX 4090, the unit the whole scale is defined against - and that machine's capability times it for anything else. Being online while refusing to rent is not availability, it is a signer running a heartbeat loop, and it earns nothing.
| Machine | WCU | Per hour online |
|---|---|---|
| H200 | 13.12 | 13.12 |
| H100 SXM | 5.75 | 5.75 |
| RTX 4090 | 1.00 | 1.00 |
| M3 Max | 0.37 | 0.37 |
| Desktop CPU | 0.05 | 0.05 |
| Browser tab | 0.0045 | 0.0045 |
It scales with capability rather than being a flat rate per machine, and that is the one decision here worth defending. A flat rate is simpler to state and it is exactly what breaks it: a browser tab is 0.0045 WCU and the cheapest soul in the system to mint, so paying it what an H100 gets makes opening tabs the best return on the grid by a factor of roughly 1,278, and the supply side fills with tabs. Pricing availability the way everything else on the grid is priced closes that without needing a rule about it.
It is pulled rather than pushed, and that is a hard constraint rather than a preference. The
obvious design accrues in the heartbeat itself. The registry's heartbeat makes
no external call and the registry is immutable on mainnet, so hanging anything off the beat
means a new registry - which orphans every soul, every licence bound to a hardware
fingerprint, and every reputation record already on chain. So availability reads liveness
instead of being called by it: anyone may poke any machine, and the money goes to that
machine's owner regardless of who paid the gas.
The cost of reading rather than being called is that the contract only ever sees the latest proof, never the ones between. It cannot distinguish six hours of honest four-minute heartbeats from one beat six hours ago and one now, so it takes the safe reading and credits at most one staleness window per call. A provider poking at least once per window is paid for every second; one poking less often is paid less than it earned; and nobody is ever paid for a gap. The provider daemon pokes on the same loop it heartbeats on, so the honest path is the automatic one. Both rates draw on one per-machine ceiling, so a machine cannot earn its daily cap twice - once for working and once for existing.
There is a third source of availability income that mints nothing at all: the MON mint deposit is staked while the machine is enrolled, and that yield accrues whether the grid is busy or idle.
Two backstops, both governance-set and both revocable. A per-machine cap bounds what one soul can extract in an epoch, because self-dealing through a fresh wallet costs the protocol fee and gas but is not impossible. And the contract never accrues past its own balance: a receipt it cannot honour is a worse failure than emitting less, so when the seed runs low the provider and renter shares scale down together rather than one being paid in full and the other zeroed.
Seeded supply is not trapped. Governance can withdraw anything not already owed to somebody, at any time, with no timelock — but nothing that has already been earned, which is the one restriction that has to exist for the promise to mean anything to a provider.
The loop
compute demand ─┬─▶ protocol fee (2.5%, USDC) ──┐
│ │
└─▶ mint deposits (MON) staked ┤─▶ treasury ─▶ buy $WRAITH
~8.3% APR │
licence sales ──────────────────────────────────┘
(priced in WRAITH: buying capacity means buying the token)
│
emissions ◀── settled WCU-hours · rebates ◀────┘
(paid to the providers and renters who supply and consume compute)
Two of the three inflows do not depend on anyone renting anything: staking yield accrues on every locked deposit whether the grid is busy or idle, and licence sales are capacity bought forward. That is what lets the buyback begin on day one rather than waiting for utilisation the network does not yet have.
Supply
$WRAITH is a 1,000,000,000-supply ERC-20 already live on Monad. Of the founding position, 100M is committed to seeding the grid and the remainder is retained.
| Allocation | Tokens | Purpose |
|---|---|---|
| Provider emissions | 50M | Paid per settled WCU-hour, capped per machine, decaying as real revenue arrives. |
| Renter rebates | 25M | Cash-back on spend, so early renting undercuts the incumbents outright. |
| Licence & liquidity seeding | 15M | Depth for the pairs the licence market needs. |
| Reserve | 10M | Audits, incidents, the thing nobody has thought of yet. |
Buybacks convert usage into token demand. They are a mechanism, not a promise about price, and nothing in this paper is investment advice.
13For providers
Bringing a card onto the grid, in the order it happens:
- Key — the agent generates a device key that stays on the machine and controls no money.
- Scan — it reads the hardware fingerprint from the driver: UUID, serial, PCI location, VBIOS.
- Prove — each attestor issues its own challenge; the card runs every one of them.
- Enrol — the quorum's signatures plus the MON deposit mint the soul.
- Stake and list — post collateral and publish a per-second rate.
- Run — the agent heartbeats, accepts jobs, provisions containers and tears them down.
Key hygiene is part of the protocol, not a suggestion. Three keys with three jobs: the device key lives on the box and signs liveness and acceptance but controls no funds; an optional relay key holds a little MON to pay for heartbeat gas; the provider wallet owns the soul and the money and never needs to touch the rented-out machine.
14Scale
Monad's throughput is what makes per-second settlement and frequent liveness proofs viable at all. Measured costs, at the gas price observed on mainnet — and noting that Monad charges the gas limit rather than gas used, so these are close to real rather than optimistic:
| Operation | Gas | MON |
|---|---|---|
| Heartbeat | 79,837 | 0.0081 |
| Accept a job | 104,146 | 0.0106 |
| Open a job | 223,607 | 0.0228 |
| Settle | 185,753 | 0.0189 |
| Enrol a GPU | 223,136 | 0.0228 |
Heartbeats are the only cost that scales with fleet size rather than revenue, which makes them the number to watch: roughly 1 MON per GPU per year at two proofs a day once batched. Against a card earning tens of dollars a day that is noise — and it is roughly what the mint deposit's staking yield throws off, which is not a coincidence but the reason the deposit is sized where it is.
15Risks and honest limits
Read this section twice. Every item here is a real limitation, not a formality.
A colluding attestor quorum can mint a fake soul. The quorum is the root of trust. Mitigations are operational: a strict majority enforced in code, independent infrastructure per attestor, public transparency of what each has vouched for, instant revocation by removing a key, and hardware bans on proven fraud. Launch runs a single attestor, which means single-party trust over identity until more are added.
- Exclusivity is enforced by residency, and residency has an edge case. A provider must hold 60% of the device's attested memory for the life of every job and answer unpredictable challenges from it, which makes selling one machine twice fail to fit rather than fail a policy — see section 5. What the chain cannot verify is where those bytes physically live. A provider willing to keep the buffer in host RAM and answer over PCIe can still pass, and the defence there is economic rather than cryptographic: the buffer is sized against the device, the answer is timed, and being caught costs the whole mint deposit plus a permanent ban on the hardware. That is a bound on the attack, not its elimination, and it is stated here as such.
- Nothing here makes a provider trustworthy inside the container. Someone with physical access can read what runs on their own machine, and no amount of proving the hardware exists changes that. Confidential computing is the real answer - an H100 in CC mode or an SEV-SNP report is a signed statement from the silicon that the host cannot see inside the enclave - and it fits this design as one more attestation claim on top of the ones already collected, raising the trust tier rather than replacing anything. It is not built. Until it is, treat every provider as able to read your prompts and your weights, and do not send either if that is unacceptable.
- Dispute rulings are human judgement. The chain enforces the ruling, not its fairness. The one exception is a residency breach, which is settled arithmetically with nobody's opinion involved — which is exactly why it is the mechanism worth trusting of the two.
- CPU identities are correlated, not unique. A CPU has no equivalent of a driver UUID, so its fingerprint is synthesised from model, core count and a board serial that is often blank in a VM. Two identical cloud instances can be hard to tell apart. That is why the class sits at the lowest trust tier and the lowest reward multiplier rather than being refused: the honest position is to price the uncertainty, visibly, on the listing itself.
- Deposits sit in third-party staking code. Exposure is capped, the venue is swappable by governance, and an emergency exit moves everything to plain MON without a redeploy — but the risk is real and is disclosed rather than engineered away.
- The relay can withhold. It cannot lie, because every blob is addressed by a hash that also lives on chain. Run more than one.
- Alpha. 163 contract tests with fuzzed invariants, a mainnet fork test, 58 offchain tests and a full end-to-end run establish that the protocol does what this document says. They do not establish that nobody will find something none of them thought to look for. Cap what you put at risk to what you would shrug at losing.
16Roadmap
- Deployed. The protocol is on Monad mainnet: soulbound identity, the 72-hour liveness rule, hardware-keyed collateral, the staked mint deposit, residency proofs, compute licences and the jury. Addresses are below. Five device classes are attestable and the browser is one of them.
- Next: the grid stops being empty. The first machines, a seed fleet across all five classes, and the indexer that lets the dashboard scale past walking every soul id.
- The economy. The emissions contract is written, tested and deployable; what remains is governance seeding it, setting a rate against a runway it can read, and attaching it. After that: WRAITH-priced licences, and fee and float buybacks.
- Worth trusting. This is the one that matters, and none of it is done. More independent attestors with a strict-majority threshold - today there is one, which means one party decides what hardware is real. Three or more jurors on independent infrastructure, because until then no dispute can reach a panel. Governance on a multisig rather than one key. Confidential computing as an additional attestation claim.
17Deployed addresses
Monad mainnet, chain 143. Everything below is verifiable without trusting this page: the dashboard and the telemetry page read these same contracts from your own browser, and the agent binary talks to them directly.
Every one of them is source-verified, with an exact match on both the creation and the runtime bytecode, on Sourcify and on the instance behind monadexplorer.com - so the code above each address is the code that is running, and you can read it there rather than take our word for what it does.
| Contract | Address | What it holds |
|---|---|---|
| GpuSoul | 0xCB1394a5221A3dF71bA37F04D9254C51ACE0Ea74 | soulbound hardware identity, liveness, reputation |
| GridMarket | 0xFB60130eE6E4C824E3ab44cC9d0f92355a8A28E8 | listings, escrow, bonds, settlement |
| ComputeShell | 0x4897d9226F44824e095AE06825d85f1B8F1A3513 | tradeable licences over a slice of one machine |
| SoulVault | 0x82AEca473b018D405e20a8AB7FA585AE34Dd06A1 | the staked mint deposits, and their yield |
| ResidencyProbe | 0xC57349FAD99cEaFe50cE8655Ab64fBb514B9c87A | the exclusivity challenge, and objective slashing |
| AgentJury | 0xA2ecb5C4E2A163633E2a8ceE2676c5E73967069a | disputes decided by a panel of models |
| AttestorSet | 0x125DC3b6950a708504e4F519fe9CA4D88C51d826 | who may vouch for hardware, and the threshold |
| GridConfig | 0x75910f04181244D425c18b091a02E1b53dbBC8C9 | fees, deposit curve, payment tokens |
| SoulArt | 0x87E676Fe3514209D209cA7F330e909ab5A62Eb50 | the on-chain art, redrawn from live state on every read |
| ShellArt | 0xF7243Ea1Cd1109c4058576Bf88172fF69742589a | the same, for licences |
| RelicVault | 0x47013f22ebA1326B09B806942E6CB77Fd9d93B23 | the wrapper that lets a retired soul be sold on an ordinary marketplace |
| WraithRewards | 0x8C185fB69788aB2b409A3cA9018c3C2F9634EC07 | the emissions hook, called last on every settled job |
| YieldRouter | 0x995646F55408788f5e3a4E8beF65631a17144b56 | where protocol fees and deposit yield are pointed |
One attestor, and no jurors yet. The set has a single attestor and a threshold of one, so identity currently rests on one party rather than a quorum - the architecture is a threshold scheme, but the parameters are not yet. The jury holds no jurors, so every dispute falls back to that same attestor. Both are additions, not rewrites, and both are named in the roadmap above. Size what you put on the grid accordingly.
The order matters more than the dates. Attestor decentralisation is the item that gates real value moving through the grid, and it is deliberately placed before scale rather than after.