Threat model
What the contract actually rejects.
Forge Layer holds stakes. The Intelligent Contract is the production source of truth. This page is the audit we ran against it — not a template.
Trust boundaries
Contract validators re-execute writes. Wallets sign submit, challenge, resolve, and owner methods. The server never signs. The frontend does not render cited HTML.
Host policy
Image and URL refs must be https. Hex IPs, leading-zero / octal forms, IPv6 literals, metadata hosts, and rebinding helpers (nip.io, sslip.io) are rejected at submit and again at inspect.
Consensus
Cited text is fenced as UNTRUSTED data. Verdicts are clamped JSON. Unreachable or unparseable output settles inconclusive — the docket never sticks in CHALLENGED.
Funds
State is written before payouts. Challenge stake must equal the submitter. Unchallenged expiry refunds in full. Owner can pause, set the fee, withdraw, or transfer ownership.
Studio deploy
Paste contract/ForgeLayer.py into studio.genlayer.com/contracts with the operator wallet. Run every Read method, then set PUBLIC_CONTRACT_ADDRESS.