AI-verified SLA settlement for GPU and CPU compute leases. Providers register machines as RWA assets. Buyers escrow BOT. An AI agent monitors heartbeat proofs each epoch and settles automatically - compliant epochs release payment, breaches refund the buyer. Every decision is anchored to a verifiable on-chain proof hash and explained in plain language by the AI.
Built for BOT Chain Builder Challenge #2 - AI × RWA track.
vCompute Integration - See how ProofLease plugs into BOT Chain's Verifiable Computation Layer.
| Live App | Testnet (Bohr) | Mainnet | |
|---|---|---|---|
| Frontend | proof-lease.vercel.app | - | - |
| AssetRegistry | - | 0xE147...Ce6f | 0xE147...Ce6f |
| LeaseEscrow | - | 0x8f4a...DC4 | 0x8f4a...DC4 |
| ProofRouter | - | 0xe3A6...364 | 0xe3A6...364 |
| Reputation | - | 0x3872...BAa | 0x3872...BAa |
Contract addresses are identical on testnet and mainnet - same deployer wallet and nonce sequence produces deterministic EVM addresses.
| Action | TX |
|---|---|
| Machine registered | 0x229951...f420 |
| Lease created (0.005 BOT escrowed) | 0x472984...8b5b |
| Proof submitted to ProofRouter (epoch 0) | 0x981b4c...b77e |
| Epoch 0 settled - compliant | 0x314a3a...34f9 |
| Proof submitted to ProofRouter (epoch 1) | 0x49ea21...e04d |
| Epoch 1 settled - breach | 0xb8f019...d73a |
| Provider withdrawal | 0x3d7c68...0f23 |
Machine ID: 4 | Lease ID: 5 | Deployer: 0x72CD...3945
Testnet (Bohr) - same lifecycle, run prior to mainnet
| Action | TX |
|---|---|
| Machine registered | 0xf89c...fcd |
| Lease created (0.005 BOT escrowed) | 0x5a75...07 |
| Proof submitted to ProofRouter | 0x2e38...f3 |
| Epoch 0 settled - compliant | 0x5f92...12 |
| Epoch 1 settled - breach | 0x8b7d...72 |
| Provider withdrawal | 0xc9e7...a6 |
The AI agent handles four jobs:
- Risk scoring - evaluates provider heartbeat freshness, platform age, and reputation score using Groq (openai/gpt-oss-20b) with a local deterministic fallback. Risk scoring is intentionally deterministic: non-deterministic AI deciding whether escrow releases is a security liability, not a feature.
- Quote generation - prices capacity against centralised market rates and returns a plain-language rationale for the price.
- Epoch settlement - reads the provider's last on-chain heartbeat, submits a proof to ProofRouter, then calls
settleEpoch()on LeaseEscrow. Compliant epochs pay the provider; breaches refund the buyer in full. - Settlement rationale - after each epoch settles, Groq generates a one-sentence plain-language explanation of the decision (e.g. "Heartbeat was 420s stale against a 300s threshold - breach, full refund issued to buyer"). This is stored in the proof record and shown in the activity feed alongside the on-chain proof hash.
The agent is policy-bounded. It can only call settleEpoch(). It cannot move funds, modify contracts, or override dispute resolution. All fund movements go through the pull-payment withdrawal pattern.
contracts/
src/
interfaces/IProofLease.sol - shared structs and events
AssetRegistry.sol - machine registration and bonding
LeaseEscrow.sol - escrow, epoch settlement, disputes
ProofRouter.sol - heartbeat proof storage
Reputation.sol - non-transferable provider score
test/
ProofLease.t.sol - 15 Foundry tests, all passing
script/
Deploy.s.sol - single-command deployment
deployments/
bohr-testnet.json - testnet contract addresses
bot-mainnet.json - mainnet contract addresses
agent/
server.js - HTTP server (tick loop + /health + /proofs API)
index.js - standalone demo runner
riskScorer.js - Groq + local fallback risk scoring
quoteEngine.js - Groq + local fallback quote generation
settlementBot.js - ProofRouter submission and epoch settlement
proofStore.js - file-locked proof persistence with keccak verification
data/proofs.json - proof records from live runs
test/test.js - 9 Node.js tests covering all modules
render.yaml - Render.com deployment config
.env.example - environment variable reference
The agent server runs a tick loop every 30 seconds:
- Finds the next active lease with unsettled epochs
- Reads the provider's last heartbeat timestamp from AssetRegistry on-chain
- Scores risk via Groq AI (fallback to local logic if unavailable)
- Marks the epoch compliant (heartbeat within 300s) or breach (stale)
- Submits proof to ProofRouter then calls
settleEpoch()on LeaseEscrow - Calls Groq to generate a plain-language
settlementRationaleexplaining the decision - Persists the full record - proof hash, tx hashes, risk score, AI rationale - to
proofs.json
The agent exposes:
GET /health- agent status, uptime, tick count, last errorGET /proofs- all settlement records sorted newest first, includingsettlementRationaleGET /proofs/:leaseId/:epoch- single epoch record
The agent runs in two modes via SETTLEMENT_MODE:
- simulated (default) - full pipeline with no chain writes
- live - submits to ProofRouter and calls
settleEpoch()on-chain
frontend/
app/
page.tsx - landing page with contract table and how it works
marketplace/page.tsx - machine listings, risk scores, lease creation modal, My Leases
provider/page.tsx - provider dashboard, machine registration, withdraw, heartbeat guide
activity/page.tsx - live agent feed merged with on-chain EpochSettled events
verify/page.tsx - proof hash verifier with live ProofRouter.getProof() reads
The activity page fetches from the agent API and independently reads EpochSettled events from LeaseEscrow via wagmi. Both sources are merged by lease ID and epoch - each card shows the full picture: the AI's settlementRationale in plain English, the risk score that informed it, the proof hash anchored on-chain, and explorer links to both transactions.
The verify page reads ProofRouter.getProof(leaseId, epoch) live from the chain and lets anyone recompute the keccak256 hash from the raw proof string to confirm the agent's decision was based on real data.
BOT Chain's roadmap includes vCompute (Verifiable Computation Layer) and Compute Node Activation, which onboards physical GPU and CPU hardware as DePIN nodes. ProofLease is the user-facing marketplace for that infrastructure: hardware operators earn by contributing capacity, buyers get SLA-guaranteed compute, and BOT token is the settlement currency for the entire loop.
BOT Chain's 0.75-second blocks and near-zero fees make epoch-by-epoch proof settlement economically viable. On Ethereum mainnet the gas cost per epoch would exceed the payment itself.
ProofLease is being built as the SLA settlement and marketplace layer for BOT Chain's vCompute - the Verifiable Computation Layer that onboards physical GPU and CPU hardware as DePIN nodes. Every contract, oracle, and reputation mechanism in ProofLease is designed to extend naturally into vCompute's attestation and proof-of-work infrastructure when it ships.
The frontend includes a dedicated vCompute section in the navbar (/vcompute) that documents the full integration plan for users and operators.
ProofLease is already live on BOT Chain Mainnet. Hardware operators register machines as on-chain RWA assets, buyers escrow BOT, and the AI agent settles each epoch by reading heartbeat proofs from AssetRegistry. This is the foundation layer that vCompute will extend.
- All four contracts deployed and settling real epochs on mainnet
- AI oracle reads liveness proofs every 30s and calls
settleEpoch()autonomously - Every decision stored as a
keccak256proof hash inProofRouter, independently verifiable - Full lifecycle proven on-chain: register → escrow → settle compliant → settle breach → withdraw
The current heartbeat mechanism confirms machine liveness but not workload delivery. When vCompute ships its cryptographic proof-of-work layer, ProofRouter.submitProof() is designed to receive those proofs. The AI oracle will validate compute receipts - not just heartbeats - as part of each settlement decision.
ProofRouter.submitProof()accepts arbitrary proof payloads; no contract changes needed- AI oracle settlement prompt will be extended to reason about execution receipt validity
- Breach logic tightens: heartbeat staleness or missing compute receipt → buyer refund
- Buyers gain SLA guarantees backed by real compute delivery proofs, not just uptime signals
Hardware class and region are currently self-reported by providers. vCompute's trusted hardware attestation layer (TPM or TEE-based remote attestation) will populate the hardwareHash field in AssetRegistry, so the AI oracle can verify that a machine genuinely has the advertised GPU class.
hardwareHashpopulated by vCompute attestation service, not self-reported by the provider- AI risk scorer weights verified hardware identity in its score calculation
- Providers with attested hardware earn lower risk scores → eligible for premium lease tiers
Reputationcontract scores will reflect full attestation compliance history over time
When BOT Chain's Compute Node Activation onboards physical GPU and CPU hardware as DePIN nodes, ProofLease becomes the public marketplace for that capacity: node operators list via the provider flow, buyers lease with BOT token, and the AI oracle enforces the SLA end-to-end. ProofLease is the monetisation layer for vCompute's supply side.
- vCompute node operators register directly through ProofLease's existing provider UI
- Marketplace displays attested hardware specs fetched from the vCompute registry
- BOT token is the settlement currency for all compute capacity in the ecosystem
- Reputation scores aggregate across the full DePIN node lifecycle
| Contract | Current role | vCompute integration hook |
|---|---|---|
AssetRegistry |
Machine registration + heartbeat | vCompute attestation service writes hardware proofs into hardwareHash at registration |
ProofRouter |
Heartbeat proof storage | Receives execution receipts from vCompute node layer alongside existing proofs |
LeaseEscrow |
Payment settlement | settleEpoch() reads from ProofRouter; vCompute proofs gate compliant vs. breach |
Reputation |
Provider scoring | Score reflects full DePIN compliance: liveness + compute delivery + attestation history |
ProofRouter accepts arbitrary proof data - the submitProof(leaseId, epoch, proofString) interface is deliberately generic. The current proofString encodes heartbeat telemetry, but vCompute execution receipts can be serialised into the same field without a contract upgrade.
AI oracle prompt is structured, not hardcoded - the settlement agent constructs a prompt from on-chain state and passes it to the LLM. Adding vCompute proof validation is a prompt extension, not an architecture change.
hardwareHash is reserved in AssetRegistry - the field exists in the machine struct today, set by the provider. The transition to vCompute-written attestation hashes requires only an access-control update to the setter, not a schema change.
Deterministic local fallback - risk scoring has a local deterministic fallback that mirrors the Groq prompt logic. This means vCompute proof validation rules can be implemented in the fallback first, tested fully offline, then reflected in the LLM prompt - the same pattern used for the existing heartbeat logic.
Pull payment pattern - pendingWithdrawals mapping prevents reentrancy. Funds are queued, never pushed.
Epoch-ordered settlement - require(epoch == lease.epochsSettled) enforces strict sequence. No skipping, no replaying.
Replay protection - EpochStatus.Pending check fires before the epoch-order check, so a replay attempt on a settled epoch returns "Already settled" rather than a misleading "Wrong epoch".
Agent oracle separation - only the agentOracle address can call settleEpoch(). The agent wallet has no other permissions. Owner retains dispute resolution via resolveDispute().
Deterministic risk scoring - scoring rules are implemented identically in the agent (local fallback) and surfaced to Groq in the prompt. This ensures the AI's output is verifiable and bounded - a non-deterministic model freely deciding escrow release would be a security anti-pattern.
2% platform fee - deducted from provider payment on compliant epochs only. Breach epochs refund the full epoch amount to the buyer.
Permissionless heartbeat and proof submission - touchHeartbeat in AssetRegistry is currently permissionless; any address can update any machine's timestamp. In a production deployment this would be restricted to the machine's registered provider. Similarly, ProofRouter.submitProof would be gated to the agent oracle address. These are intentional prototype simplifications; the settlement logic that actually controls fund movement is correctly access-controlled via onlyAgent on LeaseEscrow.settleEpoch().
Heartbeat ≠ proof of work - the SLA oracle verifies machine liveness via on-chain heartbeats, not actual compute delivery. A provider could send heartbeats without serving the buyer's workload. Full cryptographic proof of compute is the planned integration point with BOT Chain's vCompute layer; ProofLease is purpose-built to plug into that verification layer when it ships.
Hardware verification not yet enforced - registered hardware class and region are self-reported by the provider and not cryptographically verified on-chain. Trusted hardware attestation (e.g. TPM or TEE-based remote attestation) will be integrated alongside the vCompute layer, allowing the AI oracle to factor verified hardware identity into settlement decisions rather than relying on the provider-supplied hardwareHash.
SLA window is fixed, not epoch-relative - the heartbeat staleness threshold is a flat 300s regardless of epoch duration. A lease with 60s epochs uses the same 300s SLA window, making the threshold effectively meaningless for short epochs. The correct behaviour is to scale the window with epochDuration (i.e. effectiveWindow = min(HEARTBEAT_MAX, epochDuration)), planned for v2.
forge test -vvv
Ran 15 tests for test/ProofLease.t.sol:ProofLeaseTest
[PASS] test_HappyPath
[PASS] test_BreachHoldsPaymentRefundsBuyer
[PASS] test_ReplayProtection
[PASS] test_OnlyAgentCanSettle
[PASS] test_DisputeFlow
[PASS] test_WithdrawalPullPattern
[PASS] test_FundAccounting
[PASS] test_LeaseAutoCompletesAfterAllEpochs
[PASS] test_PlatformFeeIsExactly2Pct
[PASS] test_CannotLeaseInactiveMachine
[PASS] test_CannotLeaseWithZeroValue
[PASS] test_StrangerCannotRaiseDispute
[PASS] test_ResolveDispute
[PASS] test_ProofRouterStoresHash
[PASS] test_ReputationUpdatesAfterLease
15 passed; 0 failed
curl -L https://foundry.paradigm.xyz | bash && foundryup
git clone https://github.com/psanskaar/proof-lease
cd proof-lease/contracts
forge install OpenZeppelin/openzeppelin-contracts
forge test -vvv
forge script script/Deploy.s.sol \
--rpc-url https://rpc.bohr.life \
--broadcast -vvvvcd agent
cp .env.example .env
# Add GROQ_API_KEY and PRIVATE_KEY
npm install
npm start # simulated modeTo deploy the agent as a live service, connect the repo to Render.com - the render.yaml in the agent folder configures everything. Add GROQ_API_KEY and PRIVATE_KEY as environment secrets in the Render dashboard.
cd frontend
cp .env.local.example .env.local
# Set NEXT_PUBLIC_AGENT_URL to your Render agent URL
npm install
npm run devDeploy to Vercel by importing the GitHub repo and setting root directory to frontend.
| Testnet | Mainnet | |
|---|---|---|
| Chain ID | 968 | 677 |
| RPC | https://rpc.bohr.life | https://rpc.botchain.ai |
| Explorer | https://scan.bohr.life | https://scan.botchain.ai |
| Faucet | https://faucet.botchain.ai/basic | - |
- Contracts - Solidity 0.8.24, Foundry, OpenZeppelin
- AI Agent - Node.js, ethers.js v6, Groq (openai/gpt-oss-20b) with local fallback, deployed on Render
- Frontend - Next.js 14, wagmi v2, viem, RainbowKit, Tailwind CSS, deployed on Vercel
See deployments/bohr-testnet.json for the testnet deployment record. See deployments/bot-mainnet.json for the mainnet deployment record.