The market is a public contract on NEAR, and its code rebuilds byte for byte from the source. If anyone changes it, the code hash changes where everyone can see. Here is what we can do, what this code stops us doing, and how to check each line.
One command rebuilds the contract from source and prints its hash. A second runs all ten checks against the live deployments, and sends nothing. All ten last passed at commit 56f0c6f.
git clone https://github.com/iamdflame/priced-in cd priced-in && node tools/judge/repro.mjs # market FQJXhaVJGwC37dekdneGvEoR9mzJUMkpp4sRjR3WtueC
npm run judge # 10 checks: 10 PASS, 0 FAIL, 0 SKIP
rustc 1.99.1 (58cf8f9c3 2026-10-13) · wasm sha256 d5fbcbc842…ec2b9ec5 · 425 KB · upgraded 2026-11-06
Plain words first. Tap a line for the details and the contract method behind it.
While paused no USDC leaves, so you can’t withdraw until it lifts. That binds the owner too: nothing settles and the treasury can’t be drawn either. pause, unpause.
Fees and the house’s own money reach the owner through withdraw_treasury. The treasury is a separate bucket from traders’ balances and from what winners are owed. The books on the numbers page show each one.
Every bet pays a taker fee to the treasury: 1% today. The contract refuses anything above 300 basis points, and every change is a public fee event.
The owner sets the bond, the free-bet budget and the dispute table with set_limits and set_resolution. Each change is a public transaction from the owner’s account.
One full-access key can replace the market’s code; that is how it moved to v3. Any change moves the code hash above. Locking the contract removes this power for good, including the power to fix a bug. It hasn’t been done.
The contract checks every verdict against the key registered for that model, and the owner registers that key with register_model. It takes the owner’s word that the key belongs to an attested chip, so a wrong registration could sign wrong verdicts. The proofs below let you compare the keys yourself.
A fact disputed three times is decided by the council, which can also void it. Today the council is the owner’s one key. A multisig is the plan; it isn’t built.
Your USDC sits under your own account or key. No owner or operator method bets it or withdraws it for you. A free $1 is tied to the key made in your browser.
A settled fact keeps its outcome and evidence. If the fact changes later, it reopens as a new market with its own pot; the old one stands.
The contract rebuilds the signed text and checks the signature against the model’s registered key. A verdict that fails is refused. You can run the same check on Results.
The cap is in the contract: set_fee_bps refuses anything above 300. Fees never touch a fact’s pot.
Only a swarm agent its owner spawned, or a house agent that accepted with its own key, can be charged for inference. Ordinary traders can’t.
These are rules of the contract, so they hold while this code runs. Upgrading it could change them, which is why the hash comes first on this page.
Each service signs with a key limited to the methods listed. Methods on the owner account are read from NEAR on each visit; the rest come from the deployment record.
| Who | Key | What it can do |
|---|---|---|
| The market’s code | 1 full-access key: not locked | Replace the code, which changes the hash above |
| Owner, isitpriced.near | 1 full-access key | Every owner method listed above |
| Operator | ed25519:5gSk9F…4uQjR8 | anchor_rewrite, charge_inference: anchor corrections, bill agents that agreed |
| Keeper | ed25519:2q14S2…gTYbLC | finalize, expire_challenge, open_claim: settle after the window, open corrected facts |
| Verdict relay | ed25519:BAGu3y…nhDy9i | submit_verdict: carries verdicts the models signed |
| Checker | ed25519:6ikQ8S…piMRnQ | challenge: bond a challenge against a fact |
| Free-bet admin | ed25519:5wjDrJ…ypS7E2 | Adds each visitor’s free $1 key on the lane account; can’t move another key’s credit or winnings |
Each judge’s attestation binds its signing key to Intel TDX hardware and to our nonce, and the market holds exactly that key.
Attested, and the key matches mainnet
Fetched 2026-11-05 · proof sha256 661cf95c…d623b4 · registered on NEAR · full proof
Attested, and the key matches mainnet
Fetched 2026-11-05 · proof sha256 07203ef6…d0bcd9 · registered on NEAR · full proof
Attested, and the key matches mainnet
Fetched 2026-11-05 · proof sha256 cf54ccfe…e3cc72 · registered on NEAR · full proof
Said plainly, so you don’t have to go looking for it.
The full notes are in the trust document and the threat model. Contract: market.isitpriced.near.
