Security model

This page is the single reference for Molpha’s trust model: what a successful verification guarantees, what stays your responsibility, and which parties you rely on. Read it before you put value behind an attestation.

​

What a successful verification proves

• At least signaturesRequired registered nodes of the payload’s registryVersion signed it.
• Every signer is inside the deterministic selection set for the round’s source, registry version and second.
• The aggregate Schnorr signature is valid for exactly this payload and signer bitmap.
• The registry version was acceptable for the payload: active, or inside its grace period. See Registry versions.

​

What it does not prove

The full list is in the consumer checklist.

​

Defenses in the design

​

Selection influence

Callers cannot choose the round timestamp, so they cannot pick which nodes are eligible. The gateway does choose it: it stamps its own clock, floored to 100 ms, and nodes refuse a timestamp too far from their own clocks. Because selection changes once per second, a gateway delaying a round could shift it into a different selection set. The defenses are that selection is public and re-derived by every verifier, so an attestation with a signer outside it never verifies, and producing one is slashable (UnsolicitedSigning). Selection limits who can sign; it is not proof that nobody influenced which eligible set a round landed in.

​

Trust assumptions

​

Protocol authority

• Registers nodes: on Solana it co-signs every register_node with the node owner. The node set is permissioned; nodes are run by independent operators.
• Can deactivate nodes, reinstate frozen nodes early and set the redundancy buffer (update_registry_policy).
• Registers and deactivates gateways (register_gateway, deactivate_gateway).
• On EVM and Starknet, the verifier admin controls addNode/removeNode and the redundancy buffer.

The registered node set and the admin are the trust root of every verifier.

​

Gateways

Gateways are operated by Molpha. A gateway:

• admits requests and enforces payment and quota (subscription limits or x402) at admission; the Solana program records no per-round usage;
• assigns each round’s timestamp;
• dispatches rounds to the selected nodes and returns the aggregate;
• signs dispatches that make sampled rounds valid epoch tickets.

A gateway cannot forge an attestation: it holds no node key. It can refuse or delay service. Treat any gateway response as unverified until you verify the attestation. See Gateways.

​

Nodes

Each node locks minimum_node_deposit USDC at registration. Anyone can file evidence with slash_offence and earns challenger_bounty_bps of what is slashed. Details are in Solana program. The deposit bounds the cost of a provable fault; it does not cover faults that leave no on-chain evidence, such as a quorum colluding on a wrong value without equivocating.