I pulled the inference attestation contract at 02:40 GST, six weeks after the round closed. The pitch deck promised decentralized AI for real-time financial modeling. The contract promised something narrower.
It committed to a Merkle root. Three validator signatures co-signed it every block. Twenty-three leaves, one per feature the model consumed — that was the claim in the documentation. I reconstructed the leaf set from the published feature schema and walked the tree.
Eleven leaves.
Twelve features were unaccounted for. Six of them — funding-rate skew, venue concentration, oracle deviation, order-book depth at the 2% band, cross-margin utilization, and stablecoin peg divergence — are the inputs that decide when a position gets liquidated. The other six were cosmetic: two volatility proxies, three macro prints, and a sentiment index scraped from a social API that no longer resolves.
The attestation contract had been written against schema v1. The model was trained on schema v3. Nobody diffed them. The $100 million round closed on a Merkle tree that does not match its own model card.
I do not trust the pitch; I audit the structure. What follows is the audit.
Verifiable AI on-chain collapses into four architectures, and the market treats them as interchangeable. They are not.
zkML proves the forward pass inside a circuit. For a seven-billion-parameter transformer, the proving cost is measured in minutes and hundreds of dollars per inference, and proof size scales with the computation graph. Production deployments exist. None of them are serving a lending market with sub-second liquidation requirements.
Optimistic ML assumes the inference is correct and allows a fraud proof inside a challenge window. Verification requires re-running the model. Re-running the model requires the weights. Most teams publishing under this banner have not published weights, which converts the fraud proof into a promise with a timer on it.
TEE attestation roots trust in hardware — Intel SGX, AMD SEV-SNP, NVIDIA confidential computing. The cryptographic guarantees are real. The trust assumption moves into a supply chain with its own disclosure history, and that supply chain does not answer to a token holder.
Input commitment hashes the inputs, runs the model off-chain, and posts the output alongside the input root. It proves nothing about the computation. It proves only that the operator saw a specific set of numbers before producing a specific answer.
The project I audited deployed architecture four and marketed architecture one.
That gap is not an engineering failure. Input commitment is the rational design under current proof economics. The failure is in how the market prices the distinction. The round was sized against a zkML narrative and settled on a logging system.
The capital environment made this inevitable. Over the eighteen months preceding the round, allocations into anything labeled autonomous, agentic, or inference-adjacent grew faster than the engineering capacity to evaluate them. Diligence teams that could read a Solidity contract could not read a model card. The reverse was also true. The gap between those two skill sets is where a hundred million dollars went.
The protocol itself is not trivial. It is a cross-margin lending venue with roughly $800 million in open interest across four collateral assets, a 70% maximum LTV on majors, 45% on the long tail, and a liquidation engine that pulls from the AI oracle every twelve seconds. Governance holds a two-of-three multisig over the oracle's fallback curve. The oracle's output feeds directly into the interest rate model and the liquidation threshold. When the oracle is wrong, the position is not merely mispriced. It is closed.
Reconstructing the leaf set was mechanical. The attestation contract emitted a bytes32 root and a uint8 schemaVersion. The contract's schemaVersion was hardcoded to 1. The feature manifest published in the repository was versioned 3. Two commits separated them, nine months apart.
Version 1 defined eleven features. Version 3 defined twenty-three. The diff was never propagated to the on-chain commitment.
// attestation.sol (deployed)
bytes32 public constant SCHEMA_HASH = keccak256("feature-schema-v1");
uint8 public constant SCHEMA_VERSION = 1;// model-card.json (published) { "schema_version": 3, "features": [ ... 23 entries ... ] } ```
The leaf ordering problem compounded it. Merkle trees are order-sensitive. Even if the operator had included all twenty-three features, the tree would resolve to a different root unless the leaf index matched the off-chain construction exactly. I found no published canonical ordering. I found three different orderings across the repository, the whitepaper, and the audit report the project commissioned — from a firm whose name appears in the acknowledgments section of the whitepaper, which is not where audit firms usually appear.
The audit report itself is worth a paragraph. It runs forty-one pages. Thirty-six of them describe the minting contract, the access control modifiers, and the upgrade proxy. Four pages cover the oracle. The oracle is the only component that touches user funds in a way the multisig cannot reverse. The word schema appears once, in a footnote, referencing a document that had been renamed two months before the report was published.
Nine months. Three orderings. One hardcoded constant. This is what passes for verifiable inference.
The eleven features that were committed had their own problem. I traced the upstream feeds for a thirty-day window ending at the round's announcement.
Two of the five price venues in the training set were the same entity operating under different branding, sharing a settlement wallet on the same chain. On that wallet, 94% of notional volume over the window was self-matched — orders filling against orders from the same cluster, with a median holding period of eleven seconds and a median size of $1,900. Real flow does not look like that. Market-making flow does not look like that. Wash trading looks like that, and wash trading is cheap to produce when the venue and the counterparty share a treasury.
The model learned those prints as signal. It learned them because the training pipeline weighted venues by notional volume, and self-matched volume is notional volume. The weighting function was not malicious. It was naive, and naivety in a weighting function is indistinguishable from manipulation in its output.
Bias in this context is not a philosophical complaint. It is arithmetic. If 40% of the training gradient on the price-discovery head comes from a venue whose prints are generated by the operator of that venue, then the model's output on that head is a function of the operator's own inventory decisions. The oracle is not measuring the market. It is measuring its data suppliers.
I ran the reverse test. I removed the two venues and retrained the price head on the remaining three. The out-of-sample R-squared dropped from 0.81 to 0.34. The model was not predicting price. It was predicting one venue's order flow, and that venue happened to co-move with price during the training window because the window was a trending market and everything co-moves with everything in a trending market. Strip the trend and the correlation is gone. The team will present the 0.81. The 0.34 is the number that survived.
Follow the output. The oracle's price head feeds a lending market. That market's interest rate model is a kinked linear function, and the AI layer sits on top of it as a multiplier.
Let U be utilization: borrows divided by deposits plus borrows. Let U* be the kink. Then:
if U <= U*:
rate = base + (U / U*) * slope1
else:
rate = base + slope1 + ((U - U*) / (1 - U*)) * slope2base, slope1, slope2, and U* are governance-set constants. On this protocol they were last changed four months before the oracle launched, by a vote with 3.1% turnout, where the top two wallets held 61% of the participating stake.
The AI multiplier m is bounded in [0.8, 1.2] by the oracle contract's own clamp. So the entire adaptive surface is a bounded perturbation of four constants that a handful of wallets set in a low-turnout vote.
This is the same structure that has been running in lending markets since 2019. The curve was arbitrary then and it is arbitrary now. It was not derived from a market-clearing condition. It was not fit to observed borrower elasticity. It was chosen because it produces a chart that looks reasonable at a governance forum, and because the parameters are legible to a token holder who will not read them. Every lending venue with a kink is running a version of the same number, and the number traces back to a spreadsheet someone defended in a Discord thread.
Wrapping it in an inference model changes the presentation. It does not change the degrees of freedom. Liquidity is a mirage; solvency is the only truth. The rate is a number that two wallets agreed on, multiplied by a number a model guessed, clamped to a band that a third wallet chose.
I measured the pipeline end to end. Batching interval on the upstream data feed: 90 seconds. Inference latency: 4.2 seconds at p50, 19 seconds at p99 during the retraining window. Block time on the settlement chain: 12 seconds, probabilistic finality for the purposes of the liquidation engine. Liquidation bot decision latency: 6 seconds, measured from a mempool sample of 1,400 liquidation transactions across the venue and two of its competitors.
Total: roughly 112 seconds from price change to liquidation, before congestion. Under load, the p99 path extends past four minutes.
I ran a Monte Carlo. Ten thousand paths, thirty-day horizon, four collateral assets with a correlation matrix estimated from the trailing 180 days. Two regimes: base, and correlated jump, where the off-diagonal correlations in the tail move to 0.85 — which is what happened in March 2020 and again in May 2022, and which every risk model that survives a crisis eventually admits it cannot predict.
Base case: probability of bad debt exceeding $50 million in a thirty-day window is 0.7%. Correlated jump case: 11%.
The number that matters is not the probability. It is the shape of the loss. In 91% of the paths that produced bad debt above $50 million, the loss concentrated in a single eight-minute window. The protocol has a 48-hour governance timelock on parameter changes and no circuit breaker on the oracle feed. The mechanism that would need to respond in eight minutes is governed by a process with a 48-hour floor.
The architecture is not exposed because the model is wrong. It is exposed because it is slow, and the slowness is structural. A faster model does not fix it. Fewer batching intervals does not fix it. Only a liquidation mechanism that does not depend on a 112-second pipeline fixes it, and that mechanism costs money to run, and the money is currently being spent on the model.
The protocol's access page lists three tiers. Retail users complete KYC through a third-party provider and receive a non-transferable access token. Institutions sign a side letter and are whitelisted at the contract level.
The oracle feed is permissionless. Any address can read the price, any address can compute the same liquidation threshold, and any address can act on it. The compliance perimeter encloses the people who want to deposit. It does not enclose the people who can extract.
I mapped the flow. The three largest addresses by realized liquidation profit over the audited window were all funded from a single bridge deposit two hops removed from a mixer. None of them had KYC. They did not need it. They needed a read function and a public RPC.
The honest user pays for the compliance layer. The extractor does not. This is not a novel finding. It is the standing structure of every tiered-access DeFi venue, and it has been for six years.
The project announced a second product during the round: soulbound reputation tokens for oracle accuracy, non-transferable, issued to validators and data providers based on historical performance.
The concept has been available for three years. Adoption is near zero. The reason is not technical. It is that a permanent, publicly readable, non-revocable accuracy record is a liability to every party whose accuracy is being recorded. A data provider with a bad quarter does not want that quarter on-chain forever. A validator with a slashing event does not want it to be the first result when an institutional counterparty runs a wallet screen. The demand side of reputation is real. The supply side is not. Nobody volunteers for a permanent credit record, and no amount of cryptographic elegance changes what the record is.
The last piece is the upgrade authority. The oracle's fallback curve is controlled by a two-of-three multisig. The token's voting power concentration: the top ten wallets hold 44% of circulating supply, of which four are labeled in the project's own documentation as foundation, team, and two investor vehicles with lockups that expire in eleven months.
The AI multiplier clamp is contract-level and cannot be changed without an upgrade. The upgrade path runs through the same multisig. So the decentralized AI oracle can be reconfigured in the time it takes two of three keyholders to sign a transaction, and the market that depends on it has no visibility into that until the next block.
Emotion is a variable I exclude from the equation. The equation is: governance-set constants, multiplied by a bounded multiplier, multiplied by a 112-second lag, multiplied by concentrated upgrade authority. Every term is auditable. Every term was audited. No term was reported.
Here is what the bulls got right, and it is more than the skeptics will concede.
The commitment architecture is the correct engineering choice. zkML at the frontier is a research program with a cost structure that does not clear for latency-sensitive applications. Optimistic ML requires weight disclosure that no competitive team will accept, because weight disclosure is the entire asset. TEE attestation imports a supply chain risk that is worse than the problem it solves, at least until the attestation stack itself is auditable by the people who depend on it. Committing to inputs is the only design that ships today, and shipping is not a sin.
The teams building this are not frauds. They are responding to an incentive gradient. The gradient says: raise on the AI narrative, deploy the cheapest architecture that satisfies a surface-level definition of verifiability, ship before the narrative rotates. Every actor in the market is on the same gradient. The VCs who funded it are on it. The auditors who signed off on the wrong leaf ordering are on it. The token holders who voted with 3.1% turnout are on it.
And there is a real function being served. The AI layer does adapt risk parameters faster than a governance vote. On a pure latency basis, the multiplier moved within its band fourteen times over the audited window in response to changing conditions; a governance process with a 48-hour timelock would have moved zero times. If the band were set by someone with the data and the mandate to set it, a bounded, fast-adapting multiplier is a better control system than a quarterly vote. That is a defensible position and I will hold it against the record.
The bulls are also right that the market does not price this distinction, and they are right that it will not, until it does. That is not a reason to stop auditing. It is the reason the audit is the only thing in the room with a positive expected value.
The engineering is defensible. The disclosure is not. A system that commits to eleven features while documenting twenty-three, that publishes three leaf orderings, that hardcodes a schema version nine months stale, is not failing at cryptography. It is failing at bookkeeping — and bookkeeping is the part that makes cryptography mean anything. A Merkle root over the wrong leaves is a signature on a document you did not write.
Three standards would close most of this gap, and none of them require new cryptography.
A machine-readable model card, versioned in the same repository as the attestation contract, with a CI check that fails the build if the schema hash in the contract does not equal the schema hash in the card. That is a three-line script. It would have caught the eleven-of-twenty-three discrepancy before deployment.
A provenance manifest enumerating every training data source, with the venue identity resolved to a settlement address, not a brand name. Two venues sharing a wallet is a fact that a manifest makes visible and a whitepaper makes invisible.
An input commitment that covers the full feature set, not a selected subset, with the selection function itself committed and versioned. If the operator wants to exclude features, the exclusion has to be part of what is signed.
None of this proves the model is correct. Nothing proves the model is correct. But it proves that the operator is describing the system they actually deployed, which is a lower bar and a necessary one.
The next $100 million round is being raised right now on a Merkle root that nobody has walked. The question is not whether the tree matches the card. The question is who is going to check, and whether they will be paid before the round closes or after the position liquidates.