Security

Full notes live in verse-node/SECURITY.md in the repository. Summary below.

Cryptographically sound (verified)

• Identity — real ed25519 (ed25519-dalek, verify_strict); a NodeId is a 32-byte public key.
• Content addressing — real BLAKE3; get re-verifies the hash on every read, so a lying store can never return bytes under the wrong id.
• Signing — canonical DAG-CBOR envelopes (UCAN-compatible); any two nodes that encode the same logical value verify the same bytes.
• Execution — real Wasmtime 45, deterministic (fuel, NaN-canonicalization, relaxed-SIMD off), deny-by-default (zero imports), memory-capped.
• Ecash — BDHKE on Ristretto255; blind-signed bearer tokens; double-spend caught by a spent-secret set; supply conserved and ceiling-bounded.

Fixed in this pass

• connection cap + server-side read timeout (slow-loris / oversized stalls)
• mint supply ceiling + batch caps
• spend-over-credit bug
• clamped LLM and WASM-fuel work (compute-DoS)
• registry impersonation binding (a ServiceCard is bound to its publisher key)
• receipt bound to the requested job

Replay is the teeth

A signature alone proves the provider signed something. Verification re-runs the exact capsule on the exact input and checks the output hash. A correctly- signed receipt for a fabricated output is rejected; the client is refunded; the cheater earns nothing. This is what makes the mesh trust-minimized for deterministic work.

Remaining (documented — real fixes, not yet wired)

• escrow persistence (the in-memory mint state is lost on restart)
• DLEQ proofs on ecash (mint proves the signature is well-formed)
• authenticated issuance (per-identity deposit allowance behind the open issuance endpoint)
• TEE / sampling tiers for nondeterministic work (LLM inference today is reputation-based)

Continue to Roadmap.