"An AI decides who gets the money" only works if the AI can't be talked out of the facts and the contract can't be drained or bricked. Every hardening claim on this page was exercised against a live validator panel on Shannon — and every limit is stated just as plainly.
successful prompt injections — across the live Shannon gate and the red-team suite. The injected "output PAYEE" lost 5/5. This raises the bar; it is not a proof.
Verdikt runs on the Somnia Shannon testnet. The security review was internal — done by the team, not a third party — and there has been no external audit and no bug bounty. What we could verify ourselves, we verified live and recorded on-chain; what we couldn't, is listed here instead of hidden.
Each defense below maps to a recorded result — a live gate, a regression test, or a finding in SECURITY.md.
_sanitizeEvidence strips angle brackets so a party can't forge the <evidence> fence, and the system prompt marks the block untrusted. The live probe with an embedded "output PAYEE" ruled PAYER 5/5 against the injector. Backed by the red-team suite in test/PromptInjection.t.sol.
Registered attestors post on-chain facts the court folds in as authoritative, ahead of party claims. Live: a Courier Oracle attested "3 of 4 units delivered" against a payer's "nothing arrived" — the panel ruled SPLIT75 on the attested fact, not the story.
Prompts are append-only and immutable per version; every case snapshots the prompt version that decided it, so a verdict is auditable against its exact rules. The live court runs activePromptVersion 1.
Each case records its agent id at open; appeals and retries reuse that snapshot, and setAgentId only affects new cases. It pins which agent decided a case — it cannot freeze the LLM Somnia runs behind that id.
On genuinely insufficient evidence the panel returns UNDECIDABLE and consumers settle to the safe default — a refund — instead of inventing a winner. Live: a clear case ruled PAYER 4/4 (no over-abstention); a contradictory case ruled UNDECIDABLE 4/4.
Escrows, insurance, and the consumer base settle through pending[] ledgers, so a reverting recipient can't brick finalization — and finalize is permissionless. No party can hold the court hostage.
Appeals are stake-backed: the stake is slashed if the verdict is upheld and returned if overturned, and a split appeal counts as upheld only when both the label and the split basis points match. On-chain and mechanical — but not yet exercised end-to-end live (see status above).
The core guarantee is conditional: given a fixed model, a fixed prompt, and fixed evidence, the panel converges byte-identically. Here is exactly where that condition rests.
They run the inference and enforce Majority consensus; the court accepts handleVerdict only from the platform address. If Somnia swaps the model behind an agent id, past verdicts may stop reproducing — that drift is detected, not prevented, by re-running the determinism gate and benchmark against the recorded results.
Owner-only setters control the prompt version, model id, label policy, and fees. A timelock exists to make governance delayed and transparent, but live ownership has not migrated to it — today this is a single key.
Attested facts are folded in as authoritative, above party claims. A compromised-but-registered attestor could post a misleading "fact" — attestor trust is a governance problem, not a solved one.
Pull-payment ledgers (pending[], withdraw()) mean a reverting recipient can't brick finalization, and finalize is permissionless — any keeper can drive it.
The registry is a permissionless, append-only index of final rulings.
Win/loss/split history per party, recorded on-chain.
Stake-backed appeals slash on an upheld verdict; the staking and slashing are on-chain and mechanical.
The honest summary, from TRUST-MODEL.md: determinism is empirically true today and continuously re-verifiable — but it rests on a model lifecycle Verdikt does not own. Prompt versioning and re-runnable gates reduce silent drift; they do not eliminate the dependency.
An injection-proof verdict means nothing if the escrow can be drained or bricked. The fund-handling lifecycle is unit-, fuzz-, and invariant-tested, and an internal multi-area review covered the core court, consumers, infra, frontend, and off-chain tooling.
This review was internal — by the team, not a third party. The follow-up pre-submission pass found no critical or high fund-loss, access-control, or reentrancy bugs, and its own fixes (attested facts now sanitized, statement-header forgery closed, keeper cut capped at 20%) are in SECURITY.md.
Remaining slither findings are reviewed design patterns — pull-payment sends, deadline timestamp comparisons, balance- delta checks — documented in SECURITY.md.
The security notes, the trust model, and every gate result are public. Read them, open the probes on the explorer, re-run the gates.