Security is the protocol.
Five neural networks — ConsensusAI, VMGuardian, SmartForge, NetOptimizer and Sentinel — run continuously as core protocol components, not optional plugins. The chain combines post-quantum cryptography (NIST FIPS 204, ML-DSA-65), a mandatory pre-deploy WASM security gate, continuous post-deploy monitoring with on-chain NFT certificates, native session-key account abstraction, and a browser WASM module for trustless client-side verification.
It targets four structural failures of Web3 security: the cost of audits, quantum vulnerability, the absence of continuous monitoring after deploy, and the assumption that acting on-chain always requires a human holding the master key in the loop.
Audits happen once. Exploits don't.
Most Web3 infrastructure uses ECDSA or Ed25519 — broken by Shor's algorithm on a large enough quantum computer. NIST finalized post-quantum standards in 2024 (FIPS 203/204/205). NeuroChain uses ML-DSA-65 (Dilithium3) from day one.
Professional audits cost thousands of dollars and take weeks; the majority of deployed contracts ship unaudited. NeuroChain makes audit mandatory, automatic and instant — before every deploy, at near-zero cost.
A traditional audit is a point-in-time snapshot. VMGuardian re-audits every deployed contract on a continuous loop and issues on-chain certificates reflecting the current security score.
Letting software transact on your behalf usually means handing it your private key outright. NeuroChain makes scoped, revocable session keys a native primitive instead.
Five models, five layers.
Biases Malachite proposer selection by trust × stake, and drives jail/slash. Trust is recomputed on-chain from blocks proposed, votes cast and recency. The only model touching consensus — and it cannot affect the 2/3 safety quorum.
WASM bytecode security. A 10→32→16→1 MLP embedded in Rust/WASM (no ONNX/libm), trained on real CosmWasm contracts plus exploit patterns. Linear instruction-aware feature decoder. 0.3×ML + 0.7×heuristic with an out-of-distribution guard.
Contract generation from a natural-language description. Returns a WASM template matching intent with security annotations, ready for the pre-deploy gate.
P2P routing and shard load balancing — minimizes message hops and balances validator load across shards.
Transaction anomaly detection at the mempool gate. Scores every TX on value, gas, nonce gap, velocity and recipient novelty; high score → rejected before the mempool.
NeuroConsensus — Malachite (Tendermint BFT)
Consensus is Malachite (Informal Systems) — Tendermint BFT as an embedded Rust library with proven safety and liveness. It is generic over the signature scheme, so quantum-safe ML-DSA-65 plugs in directly. AI touches consensus only at safe seams: ConsensusAI biases select_proposer(height, round) by trust × stake; jail/slash sets voting power to zero. AI never changes the 2/3 commit quorum — the Byzantine safety proof is preserved.
Consensus: Malachite (informalsystems-malachitebft-*), one instance per shard
Signatures: ML-DSA-65 (Dilithium3) — plugged in as Context::SigningScheme
Proposer: weight = trust_score × stake; deterministic seed = height·1_000_003 + round
validators below a trust floor are excluded
Evidence: equivocation detector over gossip → burn + jail
Application: state module (apply_tx, Merkle state root, mempool) = the state machine4-shard architecture
Each shard runs its own Malachite instance with its own validator subset (hashed from the address). Cross-shard transfers use a 2-phase atomic commit with a relay-proof: the destination credits only after verifying the debit's Merkle proof against the source block; unconfirmed relays past a timeout are refunded.
validator_shard = hash(addr) % n_shards per-shard heights tracked independently cross-shard: locked → (relay-proof verified) → committed | timeout → refunded global root = SHA3-256(shard_0_root || … || shard_n_root), refreshed periodically
State — RocksDB, 41 column families
Accounts · Blocks · Txs (+ from/to/block/ts) · Stakes · Delegations · Rewards Nodes · Humans · Contracts · Contract-state · Events · Models · Proposals · Votes Certs · Oracle · Vault · Cross-shard (+ index) · Params · NFT · Slashes · Evidence Checkpoints · Templates · Meta — 41 CFs total Sparse Merkle Tree per-shard roots · periodic WAL checkpoint · bounded caches
Post-quantum cryptography
TX + BFT signatures: ML-DSA-65 (Dilithium3) — NIST FIPS 204, no fallback
Address derivation: words → SHA3-256 → ML-DSA-65 keypair
address = neuro:<SHA3-256(pubkey)[..15]>.human (address = f(pubkey))
Browser verify: ML-DSA-65 in WASM
Roadmap: ML-KEM (FIPS 203) · SLH-DSA (FIPS 205)Every deploy, audited by AI.
VMGuardian is a mandatory pre-deploy gate inside the Rust node — no bypass at the API level. The model is an 897-parameter MLP embedded in Rust/WASM with no ONNX or libm, trained on real mainnet contracts plus known exploit patterns. The score blends a small ML component with a heuristic rule engine, with an out-of-distribution guard that falls back to heuristic-only when the two disagree.
deploy TX → apply_tx:
1. validate WASM magic + size ceiling
2. hash(bytecode); whitelisted? → skip gate, max score
3. analyze(bytecode) → risk_score + violations[] (ML blend + linear decoder)
4. risk ≥ deploy_risk_threshold? → reject + log | else deploy
security_score = derived from (1 − risk_score)Detection rules
Dynamic call_indirect followed by a storage write — the classic drain vector behind the DAO hack and dozens of DeFi exploits.
A loop with no structural bound — gas-griefing / DoS. Detected by O(n) control-stack analysis (closed a prior O(n²) scan).
memory.grow present — the contract can allocate arbitrary memory at runtime, risking host OOM or gas griefing.
Many host-function imports — a larger attack surface if any single host function is vulnerable.
The feature extractor is a linear, instruction-aware WASM decoder — a single pass that correctly skips immediates and prefix opcode families, closing a denial-of-service vector in an earlier byte-scanning approach.
Real WASM, metered by fuel.
Contracts are real WebAssembly run by the wasmi interpreter with fuel-based gas — not simulated. Host functions give actual storage, balances, transfers, cross-contract calls, and node-verified context (caller, block height, historical stake).
get_storage / set_storage — priced per byte, anti state-bloat cap get_balance / transfer — transfer validated against contract balance emit_event / set_return — events / call return data call_contract — synchronous cross-contract call (bounded depth) get_caller() — node-verified TX signer (not a client-supplied field) get_block_height() — host-verified height (timelocks can't be spoofed) get_stake / get_stake_at — live + historical stake (snapshot voting)
Out-of-gas → trap → revert, sub-100ms Storage priced by bytes so "cheap by gas, expensive by disk" can't DoS Address suffixes: .human · .node · .app · .vault · .agent — role-typed, not cosmetic
Fees that self-stabilize.
An EIP-1559-style adaptive fee market. Each block records a base fee that moves against a fullness target. Fees split between burn (deflationary) and the block proposer. All internal arithmetic uses the smallest denomination; the server attaches a human-readable value to every monetary field so the frontend never converts units itself.
base_fee: above target → increases · below target → decreases · at target → unchanged fee = gas_used × (base_fee + priority) → base split burn/proposer, priority to proposer
Verify it in the browser.
A single compact WASM module runs the same Rust verification logic as the node — so a client result can't be faked by a server. It includes ML-DSA-65 signature verification for attestations.
Validates a TX locally before sending: balance, nonce sequence, gas estimate. Returns null on success or an error string.
Runs the analyze_v2 blend (ML + heuristic) on WASM bytecode — risk_score, model, ml_score, issues[]. The in-browser result arrives before any API round-trip.
Verifies the node’s ML-DSA-65 signature over a VMGuardian score — the trustless proof behind a server-attested badge.
SHA3-256 Merkle path verification identical to the node’s own state module. A checkpoint cross-check fetches an independent root to catch a lying node.
~115 KB · same Rust source as the node's own state module lazy load + pre-warm · IndexedDB cache (hash-keyed) · self-check against a version manifest
Your agent can act on-chain. It never sees your master key.
Most chains bolt account abstraction on as a smart-contract wallet standard. NeuroChain treats session keys, sponsored gas and agent identity as protocol primitives — the same layer that handles ordinary transfers.
A .human or .agent account grants a scoped, revocable key with its own spending limits. Every session-key operation is still signed and still verified on the consensus path — a session key is a constrained credential, not a bypass.
Addresses are role-typed: .human, .node, .app, .vault and .agent. An .agent address is an on-chain identity built for autonomous or semi-autonomous actors, not a human wallet dressed up for the occasion.
A gas-pool primitive in state lets an agent transact without holding its own balance to start — removing the classic "fund the bot before it can do anything" onboarding step.
A session key’s authority is bounded by grant, not by trust in the software holding it. Revoking a grant is a signed on-chain operation, not a support ticket.
A standalone MCP server exposes read tools (balances, explorer data, model registry) and write tools (transfer, stake, contract calls) scoped to a session key — so an LLM-driven agent can act on-chain within limits a human set in advance.
How a session-key transfer is authorized
grant: owner signs { session_pubkey, scope, spend_limit, expiry } → consensus-recorded
agent tx: signed by session key → apply_tx checks the grant is active, in-scope, under limit
revoke: owner signs a revoke op → grant inactive from the next block, no expiry neededPrivileged operations — granting, revoking, raising a limit — still require the owner's master key. The session key can only do what it was scoped to do, for as long as the grant is active. An MCP server exposes this to AI agents directly: read tools for chain state, write tools (transfer, stake, contract calls) that sign with the session key — so an LLM-driven agent transacts within limits a human set in advance, not after the fact.
NRO — an audit credit.
Symbol NRO · fixed supply · base unit uNRO (1 NRO = 1,000,000 uNRO) A share of all gas base fees is burned on every block (deflationary) · native L1 unit
NRO pays for gas, validator staking, stake-weighted governance, premium address registration and contract generation. .human addresses are free — derived from a seed phrase, no NRO required.
Stake-weighted, flash-proof.
Delegation: bounded commission; delegator earns reward × (1 − commission) Slashing: double-sign → burn + jail (voting power zero); split burn/reporter reward
Snapshot voting
Governance reads a voter's stake as of a past block — an append-only checkpoint history written on every stake/unstake/register/slash. A proposal fixes its snapshot block at creation, so staking right before a vote buys zero extra weight.
Governance DAO
The on-chain DAO template implements timelock, snapshot voting and a guardian (cancel-only). Voter identity comes from node-verified caller identity, never a payload field. Execution is atomic — a failed action reverts the whole proposal.
propose → cast_vote (weight = stake at snapshot) → queue → timelock → execute quorum = total stake at snapshot × quorum_bps · approval = for / (for + against) guardian cancels a malicious proposal; anyone cancels if the proposer's stake dropped below threshold
The signature proves ownership.
A .human address is mathematically bound to its key (address = SHA3-256(pubkey)[..15]), and the same ML-DSA-65 keypair signs — so a valid signature over a transfer proves ownership, no trust-on-first-use needed. Transfers are verified inside apply_tx on every node (consensus-level, Byzantine-safe); privileged operations use a signed, replay-guarded nonce.
apply_tx verifies the signature and pins the key for every signed transfer, on every node — a Byzantine proposer cannot push a forged transfer past followers.
VMGuardian scans every WASM contract before state. Risk at or above threshold is rejected outright. No API bypass; a governance kill-switch and per-hash whitelist exist for emergencies only.
A background loop re-audits deployed contracts; a meaningful score drift mints a certificate-update transaction through consensus. Sentinel screens every transaction at the mempool gate.
Voting weight is stake at the proposal’s snapshot block via an append-only checkpoint history — staking right before a vote buys zero extra weight.
AI model versions register through a BFT transaction with a validator-only gate and a supermajority voting quorum; weights sync over P2P and auto-activate.
A compact WASM module runs the node’s own Rust verification logic — TX checks, bytecode scan, Merkle proof and ML-DSA-65 attestation — so a client-side result can’t be faked by a dishonest server.
On-chain NFT security certificate
{ "contract_hash": "sha3-256 of WASM bytecode",
"security_score": 92, // computed by VMGuardian, not client-supplied
"violations": [], // empty on clean contracts
"certified_by": "neuro:vmguardian.node",
"level": "Bronze | Silver | Gold" }
Minted on deploy, updated by the monitoring loop on meaningful score drift
Linked from the deploy transaction in the explorerShips as a single command.
docker-compose up -d # node + gateway + web docker-compose --profile monitoring up # + Prometheus + Grafana all configuration via environment variables, no hardcoded values
Metrics: block height · peer count · mempool size · total staked
base fee · fees burned · deploy rejections by rule · model registry state
Limits: RPC and P2P rate limits per IP · gateway rate limits · saturating arithmetic everywhereWhat's shipped, what's next.
The models securing the chain are small enough to prove. That's the direction: a security audit whose result carries a cryptographic proof instead of a trusted party's signature, and a proof that travels with the asset across chains instead of staying locked to the one that produced it — verifiable AI, meeting interoperability.