// Technical Whitepaper · v1 · 2026

The security layer,
documented.

An AI-native security Layer 1. Five neural models run as protocol primitives — proposer selection, pre-deploy audit, anomaly detection, routing, generation — plus native session keys so an AI agent can transact within limits a human set in advance. Quantum-safe from block zero, with continuous post-deploy monitoring and on-chain proof.

Malachite
BFT consensus
< 2 ms
VMGuardian audit
115 KB
Browser WASM
FIPS 204
ML-DSA-65 signatures
4
Shard BFT instances
41
RocksDB column families
Disclaimer. Experimental software, provided "as is" for research and education. NRO is the network's native unit of compute — not an investment instrument, no secondary market. Participation is voluntary. Use at your own risk.
§ 01 · Abstract

Security is the protocol.

Five neural networks — ConsensusAI, VMGuardian, SmartForge, NetOptimizer and Sentinel — run continuously as core protocol components, not optional plugins. The chain combines post-quantum cryptography (NIST FIPS 204, ML-DSA-65), a mandatory pre-deploy WASM security gate, continuous post-deploy monitoring with on-chain NFT certificates, native session-key account abstraction, and a browser WASM module for trustless client-side verification.

It targets four structural failures of Web3 security: the cost of audits, quantum vulnerability, the absence of continuous monitoring after deploy, and the assumption that acting on-chain always requires a human holding the master key in the loop.

§ 02 · The Problem

Audits happen once. Exploits don't.

Quantum vulnerability

Most Web3 infrastructure uses ECDSA or Ed25519 — broken by Shor's algorithm on a large enough quantum computer. NIST finalized post-quantum standards in 2024 (FIPS 203/204/205). NeuroChain uses ML-DSA-65 (Dilithium3) from day one.

Cost of audits

Professional audits cost thousands of dollars and take weeks; the majority of deployed contracts ship unaudited. NeuroChain makes audit mandatory, automatic and instant — before every deploy, at near-zero cost.

No continuous monitoring

A traditional audit is a point-in-time snapshot. VMGuardian re-audits every deployed contract on a continuous loop and issues on-chain certificates reflecting the current security score.

Agents need a master key today

Letting software transact on your behalf usually means handing it your private key outright. NeuroChain makes scoped, revocable session keys a native primitive instead.

§ 03 · Protocol Architecture

Five models, five layers.

ConsensusAI10,626 params

Biases Malachite proposer selection by trust × stake, and drives jail/slash. Trust is recomputed on-chain from blocks proposed, votes cast and recency. The only model touching consensus — and it cannot affect the 2/3 safety quorum.

Consensus · select_proposer + equivocation slashing
VMGuardian897 params · embedded MLP

WASM bytecode security. A 10→32→16→1 MLP embedded in Rust/WASM (no ONNX/libm), trained on real CosmWasm contracts plus exploit patterns. Linear instruction-aware feature decoder. 0.3×ML + 0.7×heuristic with an out-of-distribution guard.

Security · pre-deploy gate + continuous monitoring
SmartForge6,853 params

Contract generation from a natural-language description. Returns a WASM template matching intent with security annotations, ready for the pre-deploy gate.

Execution · AI contract studio
NetOptimizer1,765 params

P2P routing and shard load balancing — minimizes message hops and balances validator load across shards.

Network · routing + shard assignment
Sentinel289 params · MLP 8→16→8→1

Transaction anomaly detection at the mempool gate. Scores every TX on value, gas, nonce gap, velocity and recipient novelty; high score → rejected before the mempool.

Monitoring · mempool ingress gate

NeuroConsensus — Malachite (Tendermint BFT)

Consensus is Malachite (Informal Systems) — Tendermint BFT as an embedded Rust library with proven safety and liveness. It is generic over the signature scheme, so quantum-safe ML-DSA-65 plugs in directly. AI touches consensus only at safe seams: ConsensusAI biases select_proposer(height, round) by trust × stake; jail/slash sets voting power to zero. AI never changes the 2/3 commit quorum — the Byzantine safety proof is preserved.

Consensus:   Malachite (informalsystems-malachitebft-*), one instance per shard
Signatures:  ML-DSA-65 (Dilithium3) — plugged in as Context::SigningScheme
Proposer:    weight = trust_score × stake; deterministic seed = height·1_000_003 + round
             validators below a trust floor are excluded
Evidence:    equivocation detector over gossip → burn + jail
Application: state module (apply_tx, Merkle state root, mempool) = the state machine

4-shard architecture

Each shard runs its own Malachite instance with its own validator subset (hashed from the address). Cross-shard transfers use a 2-phase atomic commit with a relay-proof: the destination credits only after verifying the debit's Merkle proof against the source block; unconfirmed relays past a timeout are refunded.

validator_shard = hash(addr) % n_shards        per-shard heights tracked independently
cross-shard:  locked → (relay-proof verified) → committed  |  timeout → refunded
global root = SHA3-256(shard_0_root || … || shard_n_root), refreshed periodically

State — RocksDB, 41 column families

Accounts · Blocks · Txs (+ from/to/block/ts) · Stakes · Delegations · Rewards
Nodes · Humans · Contracts · Contract-state · Events · Models · Proposals · Votes
Certs · Oracle · Vault · Cross-shard (+ index) · Params · NFT · Slashes · Evidence
Checkpoints · Templates · Meta                                    — 41 CFs total

Sparse Merkle Tree per-shard roots · periodic WAL checkpoint · bounded caches

Post-quantum cryptography

TX + BFT signatures:  ML-DSA-65 (Dilithium3) — NIST FIPS 204, no fallback
Address derivation:   words → SHA3-256 → ML-DSA-65 keypair
                      address = neuro:<SHA3-256(pubkey)[..15]>.human   (address = f(pubkey))
Browser verify:       ML-DSA-65 in WASM
Roadmap:              ML-KEM (FIPS 203) · SLH-DSA (FIPS 205)
§ 04 · The Gate

Every deploy, audited by AI.

VMGuardian is a mandatory pre-deploy gate inside the Rust node — no bypass at the API level. The model is an 897-parameter MLP embedded in Rust/WASM with no ONNX or libm, trained on real mainnet contracts plus known exploit patterns. The score blends a small ML component with a heuristic rule engine, with an out-of-distribution guard that falls back to heuristic-only when the two disagree.

897 params · embedded MLP< 2 msreject above risk thresholdreal-contract training data
deploy TX → apply_tx:
  1. validate WASM magic + size ceiling
  2. hash(bytecode);  whitelisted? → skip gate, max score
  3. analyze(bytecode) → risk_score + violations[]  (ML blend + linear decoder)
  4. risk ≥ deploy_risk_threshold? → reject + log  |  else deploy
     security_score = derived from (1 − risk_score)

Detection rules

reentrancyCRITICALrisk 0.88

Dynamic call_indirect followed by a storage write — the classic drain vector behind the DAO hack and dozens of DeFi exploits.

uncapped_loopHIGHrisk 0.35

A loop with no structural bound — gas-griefing / DoS. Detected by O(n) control-stack analysis (closed a prior O(n²) scan).

unbounded_memoryMEDIUMrisk 0.45

memory.grow present — the contract can allocate arbitrary memory at runtime, risking host OOM or gas griefing.

large_import_surfaceLOWrisk 0.25

Many host-function imports — a larger attack surface if any single host function is vulnerable.

The feature extractor is a linear, instruction-aware WASM decoder — a single pass that correctly skips immediates and prefix opcode families, closing a denial-of-service vector in an earlier byte-scanning approach.

§ 05 · Execution

Real WASM, metered by fuel.

Contracts are real WebAssembly run by the wasmi interpreter with fuel-based gas — not simulated. Host functions give actual storage, balances, transfers, cross-contract calls, and node-verified context (caller, block height, historical stake).

get_storage / set_storage    — priced per byte, anti state-bloat cap
get_balance / transfer        — transfer validated against contract balance
emit_event / set_return       — events / call return data
call_contract                 — synchronous cross-contract call (bounded depth)
get_caller()                  — node-verified TX signer (not a client-supplied field)
get_block_height()            — host-verified height (timelocks can't be spoofed)
get_stake / get_stake_at      — live + historical stake (snapshot voting)
Out-of-gas → trap → revert, sub-100ms
Storage priced by bytes so "cheap by gas, expensive by disk" can't DoS
Address suffixes: .human · .node · .app · .vault · .agent — role-typed, not cosmetic
§ 06 · Fee Market

Fees that self-stabilize.

An EIP-1559-style adaptive fee market. Each block records a base fee that moves against a fullness target. Fees split between burn (deflationary) and the block proposer. All internal arithmetic uses the smallest denomination; the server attaches a human-readable value to every monetary field so the frontend never converts units itself.

base_fee: above target → increases · below target → decreases · at target → unchanged
fee = gas_used × (base_fee + priority) → base split burn/proposer, priority to proposer
§ 07 · Trustless Client

Verify it in the browser.

A single compact WASM module runs the same Rust verification logic as the node — so a client result can't be faked by a server. It includes ML-DSA-65 signature verification for attestations.

nc_validate_tx(balance, nonce, gas, tx)

Validates a TX locally before sending: balance, nonce sequence, gas estimate. Returns null on success or an error string.

Dashboard send flow
nc_vmguardian_analyze(bytecode)

Runs the analyze_v2 blend (ML + heuristic) on WASM bytecode — risk_score, model, ml_score, issues[]. The in-browser result arrives before any API round-trip.

Deploy panel
nc_verify_attestation(score, hash, ts, sig, pk)

Verifies the node’s ML-DSA-65 signature over a VMGuardian score — the trustless proof behind a server-attested badge.

Deploy attestation
nc_merkle_verify(leaf, proof[], root)

SHA3-256 Merkle path verification identical to the node’s own state module. A checkpoint cross-check fetches an independent root to catch a lying node.

TX detail proof panel
~115 KB · same Rust source as the node's own state module
lazy load + pre-warm · IndexedDB cache (hash-keyed) · self-check against a version manifest
§ 08 · Native Account Abstraction & AI Agents

Your agent can act on-chain. It never sees your master key.

Most chains bolt account abstraction on as a smart-contract wallet standard. NeuroChain treats session keys, sponsored gas and agent identity as protocol primitives — the same layer that handles ordinary transfers.

Session keys as a protocol primitive

A .human or .agent account grants a scoped, revocable key with its own spending limits. Every session-key operation is still signed and still verified on the consensus path — a session key is a constrained credential, not a bypass.

.agent — a first-class paid address

Addresses are role-typed: .human, .node, .app, .vault and .agent. An .agent address is an on-chain identity built for autonomous or semi-autonomous actors, not a human wallet dressed up for the occasion.

Sponsored gas

A gas-pool primitive in state lets an agent transact without holding its own balance to start — removing the classic "fund the bot before it can do anything" onboarding step.

The master key never leaves cold storage

A session key’s authority is bounded by grant, not by trust in the software holding it. Revoking a grant is a signed on-chain operation, not a support ticket.

MCP: an AI agent as a client

A standalone MCP server exposes read tools (balances, explorer data, model registry) and write tools (transfer, stake, contract calls) scoped to a session key — so an LLM-driven agent can act on-chain within limits a human set in advance.

How a session-key transfer is authorized

grant: owner signs { session_pubkey, scope, spend_limit, expiry } → consensus-recorded
agent tx: signed by session key → apply_tx checks the grant is active, in-scope, under limit
revoke: owner signs a revoke op → grant inactive from the next block, no expiry needed

Privileged operations — granting, revoking, raising a limit — still require the owner's master key. The session key can only do what it was scoped to do, for as long as the grant is active. An MCP server exposes this to AI agents directly: read tools for chain state, write tools (transfer, stake, contract calls) that sign with the session key — so an LLM-driven agent transacts within limits a human set in advance, not after the fact.

§ 09 · Tokenomics

NRO — an audit credit.

Symbol NRO · fixed supply · base unit uNRO (1 NRO = 1,000,000 uNRO)
A share of all gas base fees is burned on every block (deflationary) · native L1 unit
Validators (block rewards)
60%
Ecosystem & grants
25%
Team (4yr vesting)
10%
Initial liquidity
5%

NRO pays for gas, validator staking, stake-weighted governance, premium address registration and contract generation. .human addresses are free — derived from a seed phrase, no NRO required.

§ 10 · Staking & Governance

Stake-weighted, flash-proof.

Delegation: bounded commission; delegator earns reward × (1 − commission)
Slashing: double-sign → burn + jail (voting power zero); split burn/reporter reward

Snapshot voting

Governance reads a voter's stake as of a past block — an append-only checkpoint history written on every stake/unstake/register/slash. A proposal fixes its snapshot block at creation, so staking right before a vote buys zero extra weight.

Governance DAO

The on-chain DAO template implements timelock, snapshot voting and a guardian (cancel-only). Voter identity comes from node-verified caller identity, never a payload field. Execution is atomic — a failed action reverts the whole proposal.

propose → cast_vote (weight = stake at snapshot) → queue → timelock → execute
quorum = total stake at snapshot × quorum_bps · approval = for / (for + against)
guardian cancels a malicious proposal; anyone cancels if the proposer's stake dropped below threshold
§ 11 · Identity & Security

The signature proves ownership.

A .human address is mathematically bound to its key (address = SHA3-256(pubkey)[..15]), and the same ML-DSA-65 keypair signs — so a valid signature over a transfer proves ownership, no trust-on-first-use needed. Transfers are verified inside apply_tx on every node (consensus-level, Byzantine-safe); privileged operations use a signed, replay-guarded nonce.

Consensus-level TX verification

apply_tx verifies the signature and pins the key for every signed transfer, on every node — a Byzantine proposer cannot push a forged transfer past followers.

Mandatory pre-deploy gate

VMGuardian scans every WASM contract before state. Risk at or above threshold is rejected outright. No API bypass; a governance kill-switch and per-hash whitelist exist for emergencies only.

Continuous monitoring

A background loop re-audits deployed contracts; a meaningful score drift mints a certificate-update transaction through consensus. Sentinel screens every transaction at the mempool gate.

Snapshot governance

Voting weight is stake at the proposal’s snapshot block via an append-only checkpoint history — staking right before a vote buys zero extra weight.

Model registry via consensus

AI model versions register through a BFT transaction with a validator-only gate and a supermajority voting quorum; weights sync over P2P and auto-activate.

Trustless browser verification

A compact WASM module runs the node’s own Rust verification logic — TX checks, bytecode scan, Merkle proof and ML-DSA-65 attestation — so a client-side result can’t be faked by a dishonest server.

On-chain NFT security certificate

{ "contract_hash": "sha3-256 of WASM bytecode",
  "security_score": 92,               // computed by VMGuardian, not client-supplied
  "violations": [],                   // empty on clean contracts
  "certified_by": "neuro:vmguardian.node",
  "level": "Bronze | Silver | Gold" }
Minted on deploy, updated by the monitoring loop on meaningful score drift
Linked from the deploy transaction in the explorer
§ 12 · Production Infra

Ships as a single command.

docker-compose up -d                     # node + gateway + web
docker-compose --profile monitoring up   # + Prometheus + Grafana
all configuration via environment variables, no hardcoded values
Metrics: block height · peer count · mempool size · total staked
         base fee · fees burned · deploy rejections by rule · model registry state
Limits:  RPC and P2P rate limits per IP · gateway rate limits · saturating arithmetic everywhere
§ 13 · Where This Goes

What's shipped, what's next.

Phase 1Foundation✓ shipped
RocksDB state + Merkle state rootP2P gossip + shard routingMempool fee priority + TTL evictionStaking + delegation + APY rewardsGovernance + multi-sig vaultOn-chain model registry + oracle log
Phase 2Gas, PQC & hardening✓ shipped
EIP-1559 adaptive base feeuNRO denominationFee burn + proposer splitML-DSA-65 signatures, no fallbackWeak-subjectivity checkpointsRPC + P2P + gateway rate limits
Phase 3WASM VM + VMGuardian✓ shipped
wasmi fuel-metered executionConstructor on deployCross-contract callsPre-deploy risk gateEmbedded MLP, real training dataLinear feature decoderSigned ML-DSA-65 attestation
Phase 4Sharding + Malachite✓ shipped
Migrated consensus to MalachiteConsensusAI proposer selectionEquivocation slashing over gossipIndependent per-shard BFTCross-shard 2PC + relay proofGlobal state rootDocker + Grafana + alerts
Phase 5Identity, governance & AI agents✓ shipped
Address = f(pubkey) derivationConsensus-level TX verificationReplay-guarded privileged opsStake checkpoints + snapshot votingGovernance DAO template.agent address + session keysSponsored gas + MCP server
Phase 6Mainnet preparation⬡ in progress
Operational hardening at scaleReal-data model retrainingFormal third-party crypto auditInstallable mobile wallet
Phase 7Verifiable AI × interoperability○ planned
zkVM proof of AI-audit inferenceIBC v2 external channelsPost-quantum light clientPortable, trustless security attestations

The models securing the chain are small enough to prove. That's the direction: a security audit whose result carries a cryptographic proof instead of a trusted party's signature, and a proof that travels with the asset across chains instead of staying locked to the one that produced it — verifiable AI, meeting interoperability.

Follow the build. Judge it yourself.

The network, explorer and full docs are in active development.

Join the Telegram →