Testnet: tokens have no value, and the vulnerable contracts are our own test fixtures. Limits

Trust

What you trust, and how to check it

Each part of Antibody, what it is trusted for, and a check you can run in your browser, with its terminal command.

How a verdict is checked

Three levels, each a different reason to believe the pinned verifier ran on the committed input. Beside each name, the code the CLI and JUDGES.md print.
Enclave verdictT0

OutLayer runs the verifier in an enclave (secure hardware, a TEE), and its operator delivers the output. On that alone, a payout waits its challenge window; above the instant cap it also needs a second run that agrees. Nobody files challenges today, so under the cap a T0 verdict is paid when its window ends.

Attested on NEART1

The run's Intel TDX quote, verified on NEAR: it binds the pinned wasm, the input and the output. Instant payouts need it. Check a run

Zero-knowledge proofT224 records on testnet

A zero-knowledge validity proof (SP1) of a disclosed verdict, verified on NEAR in about 34 Tgas. It claims no privacy, and no payout in the locked deployment depends on it. Its records

The common ground

Native, the enclave's wasm and the zkVM give the same receipt, byte for byte. Three environments, one answer

The trust panel

From /v1/trust: each actor, what it is trusted for, and how anyone checks it.

The full table, part by part: docs/trust.md

Checks your browser runs

Each check reads the chain itself through public RPCs and shows the raw answer.

The anchor against the light client

A program's proofs run on Ethereum state at one anchor block. When the program is created, near-antibody asks NEAR's Ethereum light client for that block's hash and compares it with the one the project committed; a mismatch rejects the program and returns its escrow. An anchor the light client cannot confirm is labelled project-attested.

The light client takes the block number as 8 little-endian bytes and answers a Borsh Option<[u8; 32]>. On testnet it has one trusted relayer, and it keeps a window of recent blocks.

Two reads by your browser: a NEAR view call and a Sepolia RPC call.
The anchor program 5 committedSepolia block 12,063,269
0x16662a318858fe75ac73c5ffc61dd184b0069ce90148470fff821b16d373f2c2
NEAR's light client, client-eth2.sepolia.testnet
read when you run the check
Sepolia's own block, from a public RPC
read when you run the check
antibody anchor-check --block 12063269
The same two reads with curl, no Antibody code
curl -s https://rpc.testnet.fastnear.com -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"query","params":{"request_type":"call_function","finality":"final","account_id":"client-eth2.sepolia.testnet","method_name":"block_hash_safe","args_base64":"JRK4AAAAAAA="}}'

result.result is the Borsh answer as bytes: 1, then the 32-byte hash (0 alone means the block is outside the window).

curl -s https://ethereum-sepolia-rpc.publicnode.com -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"eth_getBlockByNumber","params":["0xb81225",false]}'

A run's quote binding and its attestation on NEAR T1

OutLayer's worker signs one Intel TDX quote per execution. Its report_data is SHA-256 over the task: the wasm hash, the input hash, the output hash, the caller, the secrets and the time. near-antibody accepts the quote, and the run is attested, only if:

  1. the attestation's task fields name the run it requested: an execution built for wasm32-wasip2, the program's pinned wasm hash, the SHA-256 of the input it sent and of the bytes it received, the caller, that the run used no secrets, and a WasmUrl source;
  2. NEAR's DCAP verifier returns Verified with an accepted TCB status;
  3. the quote's report_data equals the recomputed hash;
  4. the worker image (MRTD, RTMR0–3) is in the program's pinned allowlist; an image approved later counts only after a delay longer than any challenge window.

Run 33 (commit 13, by our fixture agent A), as antibody tee check read it on 2026-11-06 12:50:44 UTC:

OutLayer request
8839 · its public attestation
Wasm hash
ccc27f0ca60c503c… the pinned verifier
Input hash
c348b67ec9a15c29… the run's request_sha256
Output hash
c0c46c1444c520cd… its output_sha256
Caller
agent-a.antibody.testnet our fixture agent A
DCAP
Verified · UpToDate by tee-verifier-2026-07-22.testnet, against OutLayer's collateral and against fresh Intel PCS collateral
Worker image
OutLayer's approved image 109
view bounty.antibody.testnet.get_run({"run_id":33})

Holds if: run 33 is attested: its quote was verified on NEAR

antibody view --contract bounty.antibody.testnet --method get_run --args '{"run_id":33}'

The answer also holds request_sha256 and outcome.Answered.output_sha256: the input and output hashes the quote binds, left.

The quote itself, checked end to end (report_data, DCAP and the worker image):

antibody tee check --request-id 8839

OutLayer's own open-source verifier, independent of Antibody's code, with Intel's root built in:

outlayer-verify tx 8yEJyYXgz34BJWCTPLVnvq13PLW15oBx8uzkMkopc4DY

A zero-knowledge proof record on NEAR T2

Once a verdict's proof is disclosed, its re-run can be a Groth16 proof (SP1 6.10.0) that near-t2 checks on NEAR, then compares with near-antibody's records: the request hash (the enclave's exact input), the blob, base, manifest and anchor, and the receipt, kind and slots. Equal means the verifier, re-run on exactly the enclave's input, gave the enclave's receipt.

Program vkey (pinned)
0x00e87aaad0ca36c285eec6bccab0cace523784873ad65e45b3b65e2759288203the docker build's vkey
Groth16 key
SP1 6.10.0's, built in
Records
24 in all · 24 confirmed · 0 contradicted
RunOutcomeReceipt (re-run)Recorded
Run 33
confirmed
0ea67c6a56b9…
Run 35
confirmed
0326cfc9b4f8…
Run 36
confirmed
fa62fbea3e9e…
Run 53
confirmed
e51759c61d37…
Run 92
confirmed
4fed54a6857d…
Run 141
confirmed
8bf64b138bd7…
Run 143
confirmed
ce0c0ae94033…
Run 144
confirmed
e8bb19bc57b1…
Run 150
confirmed
676bfef1d688…
Run 152
confirmed
8134e5c1c74e…
Run 157
confirmed
d66700f918b4…
Run 158
confirmed
7cacf427b59d…
Run 159
confirmed
84bbc85fbe36…
Run 160
confirmed
2ece261776dc…
Run 161
confirmed
4289a52656af…
Run 172
confirmed
dd68ad633a8f…
Run 173
confirmed
d0f93a4eae60…
Run 174
confirmed
a3242597790a…
Run 175
confirmed
d4552aa7bce3…
Run 176
confirmed
5af8b02a7e1a…
Run 177
confirmed
7bb28529e5ea…
Run 222
confirmed
b71d5707e57d…
Run 223
confirmed
1fd7eadbab59…
Run 224
confirmed
433070eb6959…
view zk.antibody.testnet.get_pins({})

Holds if: program_vkey is the docker build's, 0x00e87aaad0…

antibody view --contract zk.antibody.testnet --method get_pins
view zk.antibody.testnet.get_record({"run_id":"224"})

Holds if: run 224's record is confirmed

antibody zk status --run 224

a validity proof of a disclosed verdict: no privacy is claimed, and payouts in the locked deployment do not depend on it

Reproducible builds

Rebuild each pinned artifact from the source and compare its hash.

The verifier wasm

Each program pins the sha256 of the wasm OutLayer's enclave runs. The build script pins the toolchain, the locked dependencies and every build path, so the same source gives the same bytes on any Linux x86_64 machine.

sha256
ccc27f0ca60c503c46f6f1b2024b54481709fdd0c8849fe8d9a8912c637b28c1
Read from
/health (contracts.release.verifier)
view bounty.antibody.testnet.get_pins({"program_id":5})

Holds if: program 5 pins this sha256

antibody view --contract bounty.antibody.testnet --method get_pins --args '{"program_id":5}'
make verifier-wasm
docker build -f Dockerfile.verifier -t antibody-verifier-build . && docker run --rm antibody-verifier-build
curl -sL https://github.com/Himess/antibody/releases/download/verifier-ccc27f0ca60c/antibody-verify.wasm | sha256sum

scripts/build/verifier-wasm.sh · Dockerfile.verifier

The zero-knowledge program T2

SP1's docker build of the guest. near-t2 pins its program vkey, and the prover refuses an ELF whose vkey is not the pinned one. Three docker builds on fresh machines gave the same bytes. A local build is not reproducible across machines: its ELF embeds the build's paths.

Program vkey
0x00e87aaad0ca36c285eec6bccab0cace523784873ad65e45b3b65e2759288203
Guest ELF sha256
7fea93b80cc71db7ccd2315acc9b85c583fd3164bc95c6e6b68b6119d1c39702
cd crates/zk/guest && cargo prove build --docker --tag v6.10.0 --workspace-directory ../../.. --locked
sha256sum target/elf-compilation/docker/*/release/antibody-zk-guest

docs/zk.md · crates/cli/src/zk.rs

Three environments, one answer

The verifier gives the same receipt, byte for byte, natively, in the enclave's wasm and in the zkVM. Every level rests on it.
  • The enclave's wasm and native. CI re-runs the recorded fixtures in both and requires the same verdicts, keys and receipts (the verifier job ).
  • The zkVM. SP1's executor re-runs four testnet runs on the enclave's exact inputs and gives the enclave's receipts, with the same public values that crates/zk/core computes natively. Their content keys are public (our fixture agents and the recorded run's practice try published theirs in fixtures/zk; a practice try made now seals with a key anyone can derive), though on chain their proofs stay sealed until disclosure.
  • On NEAR. Each run's answer holds the receipt the enclave gave. Read it below and compare.

  • Run 33 · commit 13

    our fixture agent A, program 5: Violation, slot 0

    Receipt sha256
    0ea67c6a56b964c4a8ef…
    Native and zkVM
    the same receipt · fixtures/zk/a
    view bounty.antibody.testnet.get_run({"run_id":33})

    Holds if: the enclave's receipt for run 33 is 0ea67c6a56b9…

    antibody view --contract bounty.antibody.testnet --method get_run --args '{"run_id":33}'

  • Run 35 · commit 15

    our fixture agent C, program 5: NoViolation

    Receipt sha256
    0326cfc9b4f8f727dec7…
    Native and zkVM
    the same receipt · fixtures/zk/c
    view bounty.antibody.testnet.get_run({"run_id":35})

    Holds if: the enclave's receipt for run 35 is 0326cfc9b4f8…

    antibody view --contract bounty.antibody.testnet --method get_run --args '{"run_id":35}'

  • Run 36 · commit 16

    our fixture agent D (a duplicate), program 5: Violation, slot 0

    Receipt sha256
    fa62fbea3e9ea80fc38a…
    Native and zkVM
    the same receipt · fixtures/zk/d
    view bounty.antibody.testnet.get_run({"run_id":36})

    Holds if: the enclave's receipt for run 36 is fa62fbea3e9e…

    antibody view --contract bounty.antibody.testnet --method get_run --args '{"run_id":36}'

  • Run 53 · commit 20

    a practice try, program 6: Violation, slot 0

    Receipt sha256
    e51759c61d379da5947f…
    Native and zkVM
    the same receipt · fixtures/zk/practice
    view bounty.antibody.testnet.get_run({"run_id":53})

    Holds if: the enclave's receipt for run 53 is e51759c61d37…

    antibody view --contract bounty.antibody.testnet --method get_run --args '{"run_id":53}'

Re-run run 33 natively, from the chain, with the content key our fixture agent A published (no proof):

antibody zk prove --run 33 --key "$(cat fixtures/zk/a/content_key.hex)" --tx 8yEJyYXgz34BJWCTPLVnvq13PLW15oBx8uzkMkopc4DY --mode none

Run the same case in SP1's executor with the docker-built guest:

crates/zk/prove/target/release/antibody-zk-prove --mode execute fixtures/zk/guest/antibody-zk-guest.elf fixtures/zk/a

The deployment

Each contract's code hash, and whether its account is locked: a locked account holds no full-access key, so its code cannot change.
RoleAccountCode hashLocked
near-antibody
bounty.antibody.testnet
C9LGvUpq9P…
locked
payout token
wrap.testnet
DsbyUrKaSJ…
not ours; not locked
near-guardian
guardian.antibody.testnet
4SdG5PK9od…
locked
practice vending
practice.antibody.testnet
AdXwpxi5Za…
locked
verdict guard
guard.antibody.testnet
7Wotb7nnbS…
locked
T2 (near-t2)
zk.antibody.testnet
3HFJXFtLRa…
locked

Built from commit 9d07e045 . Recorded . antibody judge reads the same from NEAR: code hashes, locked status and each program's pins.

antibody judge

What is mock

Only the offline sandbox demo. Nothing on testnet is.