Security and trust
The proof is the product.
SealQuery separates what the TEE proves, what the contract enforces, and what the operator still controls. This page states all three.
TEE execution
Approved WASM runs inside Intel TDX on OutLayer. The dataset is readable only by that code.
Attestation
The verifier checks authenticity, worker identity, result binding, input, output, TCB status, and measurements.
On-chain settlement
Escrow, budgets, acceptance, and refunds live in the NEAR contract — not in a trusted backend.
Attestation, not a promise
A successful query produces an OutLayer task and a TDX report. The agent runsoutlayer-verifybefore calling accept_result. On the happy path the agent verifies before settlement. If the agent does not act, anyone may settle a ready query to the owner after the 200-block timeout; that timeout path is not proof-gated on-chain.
The proof bundle can be downloaded and checked offline. Verification includes the Intel signature chain, worker measurement approval, the task fields committed in report data, and the input/output hashes.
The TEE proves which code ran on which input and output. It does not prove the computation is semantically correct, and the contract does not verify TDX quotes on-chain. Verification is enforced by the off-chain agent client, not by the contract.
Threat model
Inference / reconstruction
Daily budget, minimum cohort, rounding, suppressed cohorts, and a canary row. No differential privacy yet.
Output leakage
Only the approved aggregate leaves the enclave. The canary must never appear in a result or agent log.
Unauthorized code
The contract allowlists dataset computations; the compute secret is locked to the contract predecessor.
Sybil querying
Budget is per NEAR account. Testnet accounts are cheap; production needs identity, stake, or cross-account budgets.
TEE / OutLayer compromise
TDX quote, collateral, TCB status, measurement approval, and I/O binding are verified off-chain. OutLayer governance and worker registration remain trusted.
Callback / replay
Result acceptance is bound to the query, only the requesting agent can accept, and replay/duplicate-settlement tests fail safely.
Infrastructure outage
Pause, refunds, retries, monitoring, runbooks, and an incident drill are in place. Single-process API and public RPC remain risks.
Privacy controls
- Minimum cohort 100
- Spend rounded to 1,000
- Growth rounded to 0.1%
- Cohort counts suppressed
- 20 queries per agent / dataset / day
- Canary row must never appear
Known limitations
This is a testnet prototype. OutLayer governance is centralized, no differential privacy is implemented, testnet identities are cheap, and the demo API is single-process. See the threat model for the production gaps.
Read the detailed limitationsTry it
Verify a real testnet proof.
Open the proof explorer, paste a request transaction, and inspect every check.