Non-upgradeable USDG bonding and metered GPU lease contracts for Prism Network.
The contracts are unaudited, pre-production software. No deployment in this repository is represented as production-ready, source-verified or safe for funded public use.
| Contract | Responsibility |
|---|---|
NodeRegistryV1 |
Device-bound node registration, supplier bond custody, rates, lifecycle status and bounded slashing |
LeaseEscrowV1 |
Escrow funding, access timing, metered settlement, disputes, refunds and fee distribution |
AdminTimelockV1 |
Minimum 48-hour delay for routine administrative calls |
LeaseEscrowV1 launches paused and enforces:
- Maximum escrow of 50 USDG per lease.
- Maximum duration of six hours.
- Maximum 250 concurrent leases.
- One active lease per node.
- Ten-minute provisioning timeout.
- Five-minute settlement dispute window.
- Ten-percent protocol fee and ninety-percent supplier payment.
Every lease reaches a terminal state without an administrator. An access window that outlives its duration can be closed by anyone. A settlement the attestor never signs refunds the renter in full after 24 hours. A dispute the resolver never answers settles on the contested proposal after three days.
NodeRegistryV1 requires a flat bond of 1 USDG per node, independent of the
advertised rate.
Routine configuration is reachable only through AdminTimelockV1: the gateway,
the attestor, the treasury, the dispute resolver, the emergency address, the
authorized escrow contracts and resuming the market. Each call is published in
full when it is scheduled, waits 48 hours, and then has a 14-day window in
which the administrator may execute it. After that window it expires and has to
be scheduled again.
Two levers stay immediate, and neither can move money. A halt stops new leases, lapses after seven days and cannot touch a lease that is already funded. A bond freeze stops one node selling and holds its bond in place for the notice period that a slash requires, which is what makes slashing enforceable. Slashing itself remains a delayed action and fails if the freeze has lapsed.
The addresses behind every role can be replaced through the timelock, including the timelock's own administrator and the set of escrow contracts the registry recognizes, so a compromised key can be removed and a replacement escrow can be phased in without retiring the registry. Losing the administrator Safe outright leaves no recovery path.
Foundry 1.5.1 and Solidity 0.8.30 are required.
./scripts/validate.shThe validation gate runs formatting, compilation, unit tests, fuzz tests, invariants, Slither when Docker is available, and repository hygiene checks.
The deployment script pins the canonical Robinhood Chain USDG address and refuses deployment if bytecode or six-decimal metadata is absent. It requires the operator to name the intended chain, requires six separate role addresses, and reads the finished topology back before it will broadcast.
Read docs/DEPLOYMENT.md before running a deployment and
docs/v2-migration.md for the operator runbook: key
custody, verification, the timelock procedure, migration and rollback.
Deployment addresses and bytecode hashes belong in a signed release manifest;
they must not be inferred from local broadcast output.
The receipt and settlement model proves that these contracts emitted an event and accepted an attestor-signed proposal. It does not independently prove honest GPU execution, trustworthy suppliers or correct offchain metering.
Report vulnerabilities according to SECURITY.md.
Code and documentation are licensed under the Apache License 2.0. The Prism Network name and visual identity are governed separately.