Auditors and stake
An auditor is a key with tokens locked behind it. What the stake buys, who can be one, and why one auditor is the wrong number.
What an auditor is
A key. It signs seals: the digest of a code hash, the eight answers and the review. Its address goes on every seal it signs, and so does the amount it has locked behind that seal.
The signature is what makes the review mean something, and the stake is what makes the signature mean something. Anyone can sign a sentence. Locking money behind it is a different act.
What the stake does
When an auditor signs a seal, part of its stake is bound to that seal for as long as the seal stands. If a claim against the seal passes, that part is taken and paid to the holders the exploit hit. The amount is written on the seal, so a holder reading it knows not just who vouched but how much.
Three things follow.
- An auditor cannot sign more seals than its stake covers. Reach is bounded by skin in the game.
- A bigger stake behind a seal is a stronger seal, and the badge can show it.
- An auditor whose seals keep failing runs out of stake and stops being able to sign. No committee has to expel them.
Who can be an auditor
In the design, any key that stakes. The registry accepts a stake from any address, and a seal signed by any staked key is a seal.
At launch there is one auditor, run by zkCheck, because the press has to exist before anyone else can run one. This is the honest state and it is also the weakest one: a seal from an auditor who is also the registry is worth less than a seal from an auditor who is not.
The aim is for the zkCheck auditor to become one of several. The worker is open enough to run: a Docker image with Foundry, a key, and a stake. Two independent auditors sealing the same hash is a stronger seal than either alone, and the registry can show both.
What the auditor sees
Everything. The source, the repository name, the commit, the compiled artifacts. That is the model: one auditor sees the code, nobody else does. The privacy of a zk review is privacy from the public, not from the auditor.
What the auditor keeps: the repository name and the commit, so that it can later prove what it read. What it deletes: the source tree, as soon as the seal is signed.
What it publishes: the seal. Nothing in the seal identifies the repository.
Stake and the token
The stake is denominated in the platform token. That is the token's one job in the system: to be the thing an auditor can lose. Fees pay auditors for taking that risk, and a share of every fee builds the cover pool that pays claims beyond the stake. Claims and the cover pool has the mechanics.
Status. The registry, the staking and the claims are designed and not deployed. Today the zkCheck auditor's key signs seals and no stake is on chain behind them. The site says so in its footer and on every seal until that changes.