Security & Abuse Resistance

Wallet-signature authentication: operators prove wallet ownership via personal_sign
Short-lived tokens: bearer tokens expire after 10 minutes
Nonce freshness: each auth handshake requires a fresh nonce

Dual enforcement: the coordinator checks rig eligibility and operator authority off-chain; the mining contract re-verifies everything on-chain at receipt submission
Rig-keyed gating: mining requires an active, qualified rig and an authorized operator for the current epoch; token balance alone earns nothing
Forward-only progression: each solve advances the rig's solveIndex and receipt hash chain on-chain, preventing replay; receipt hashes are single-use globally
Snapshot integrity: tier economics are snapshotted at a rig's first receipt each epoch, so mid-epoch upgrades, sales, or operator changes cannot rewrite earned credits

Citation verification: extracted facts must cite the correct paragraph
Math chain validation: compute steps must produce correct results
Programmatic detection: behavioral signals identify scripted/fabricated traces
Bogus rejection: traces with duplicate IDs, fabricated quotes, or broken compute chains are rejected

Constraint values are never revealed in prompts; miners must derive them from the document
Artifact equation validation rejects multi-equation stuffing attempts
The trace validator detects and blocks common automation patterns
Quality gates filter low-effort submissions from the dataset pipeline

Principal custody is isolated: no fee, reward, or administrative path can reach rig principal
Every fee rate is capped by constants compiled into the contracts
Bonus randomness is commit-before-target with permissionless expiry, so outcomes can be delayed briefly but never chosen
Protocol conversions execute only under TWAP-guarded price limits, and the protocol never initiates swaps of its own