Last updated 9 November 2026
Security
Found a problem? Please tell us before telling anyone else. Here's how, and what we already know is weak.
Reporting a vulnerability
- Write to the GPUChain team with the steps to reproduce it and what an attacker could gain.
- Test only on Base Sepolia and against your own wallets and jobs. Don't touch other people's data, and don't degrade the service for others.
- Give us a reasonable time to fix it before you publish. We'll credit you if you want.
What protects money today
- Payouts need EIP-712 signatures from 2 of 3 registered verifiers, bound to this chain, this contract and this job, with an expiry.
- Payouts plus the refund must equal the budget exactly, or the contract rejects the verdict.
- The coordinator can't move funds. If it disappears, anyone can trigger a refund after the deadline and a grace period.
- Money is pulled by its owner with
withdraw(), never pushed.
What protects your machine as a provider
- Only approved workload templates run. Arbitrary code is not accepted yet.
- Checkpoints are safetensors and JSON, never pickle, and are checked for size, shape and bad values before loading.
- In Docker mode the job has no network, no extra capabilities, a read-only root and memory limits.
Known limits
- The contracts are unaudited.
- Verifiers, the arbiter and the coordinator are all run by our team. If they collude, they can approve a bad result.
- A provider can read the data of the job it runs. Confidential training would need hardware attestation we don't have.
- GPU details reported by a provider are self-reported, not proven.
- The evaluation set is public, so a provider could in principle train on it.