One-liner: Blockchains can prove that what was logged was not changed. They cannot prove that nothing was left out. Ghostless makes omission provable, bonded, and economically irrational, even against a fully malicious operator who controls the decision engine, database, signing keys, and chain client.
-4f46e5){kind=icon}
-green){kind=icon}
-success){kind=icon}
This codebase is directly integrated with and tested against the official MST Blockchain infrastructure:
- MST Testnet RPC:
https://testnetrpc.mstblockchain.com(Chain ID:91562037/ Hex:0x5752035) - MSTScan Explorer:
https://mstscan.com - Official Faucet:
https://faucet.masterstroke.academy - MST Python SDK:
mst-sdk-python(mst_blockchain_sdk) - MST TypeScript / Node SDK:
@mstblockchain/mst-sdk&@mstblockchain/mst-vibe-kit - BridgeKey:
https://bridgekey.io
| Contract | MST Testnet Address | Explorer Link |
|---|---|---|
| GhostlessLedger | 0x7B0b975D1C044225be49f178F34332029b28620c |
View on MSTScan |
| ReceiptGatedEscrow | 0x41927a6b2B940389F1263bC1E30584f9A066f7F4 |
View on MSTScan |
| PerTxAnchor (Baseline B0) | 0xa42618de5862e582e55Cdd212cA11F890a5249f2 |
View on MSTScan |
| BatchRootAnchor (Baseline B1) | 0x7d38Ccc9fFE711353007e488D47991E378aF8c13 |
View on MSTScan |
-
Pre-Reservation Before Decisions:
openWindow(n)commits contiguous sequence numbers on-chain before content exists. History length is monotonic and gapless ($I_1$ ). - Actuator Gate ("No Receipt → No Effect"): Downstream actuators refuse execution without an unspent, valid EIP-712 signed receipt matching the exact subject, action hash, actuator ID, and replay nonce.
-
Bonded Pull-Based Demand Deadline: A subject can challenge any receipt on-chain (
demandInclusion). If the operator does not supply the Merkle proof within$R$ blocks, the operator's bond is slashed and permanently frozen. -
On-Chain Policy Fraud Engine: Introduces
provePolicyFraud(...)so that committed leaves violating policy invariants (e.g. invalid outcome codes or rule contradictions) can be proven and slashed on-chain. -
Positional Merkle Trees with Domain Separation: Domain bytes
0x00(leaf) and0x01(node) with fixed depth$\log_2(N)$ prevent second-preimage attacks. - Honest Impossibility Boundary: Ungated off-chain actions that leave zero traces to any receipt-demanding party are mathematically unobservable. Ghostless shrinks the boundary by binding real-world effects strictly to receipts.
- Baseline B0 (Per-Tx Anchor):
68,028 gasper decision - Ghostless (size 64):
3,801.8 gas(17.9x cheaper) - Ghostless (size 128):
1,366.6 gas(49.8x cheaper) - Ghostless (size 256):
683.3 gas(99.6x cheaper)
Attack | Description | B0 | B1 | Ghostless Protocol
----------------------------------------------------------------------------------------------------
A1 | Mutate logged decision post-sealing | DETECTED | DETECTED | DETECTED & SLASHED (NoResponse)
A2 | Omit receipted decision / void | NOT DETECTED | NOT DETECTED | DETECTED & SLASHED (NoResponse)
A2' | Ghost decision (unreceipted action) | NOT DETECTED | NOT DETECTED | PREVENTED (Actuator Gate: 403)
A3 | Equivocate (conflicting receipts) | NOT DETECTED | NOT DETECTED | DETECTED & SLASHED (proveEquivocation)
A4 | Backdate / reorder decisions | PARTIAL | NOT DETECTED | BOUNDED ([openedAt, sealDeadline])
A5 | Withhold window (never seal) | N/A | NOT DETECTED | DETECTED & SLASHED (slashUnsealed)
A6 | Falsify policy fields | NOT DETECTED | NOT DETECTED | DETECTED & SLASHED (provePolicyFraud)
./venv/bin/python scripts/preflight.pyCI=true ./node_modules/.bin/hardhat testCI=true ./node_modules/.bin/hardhat test test/cross_conformance.test.js
PYTHONPATH=. ./venv/bin/pytest test/test_cross_conformance.pyPYTHONPATH=. ./venv/bin/python bench/gas_bench.pyPYTHONPATH=. ./venv/bin/python redteam/run_all.pyPYTHONPATH=. ./venv/bin/uvicorn operator.main:app --host 0.0.0.0 --port 8000Open http://localhost:8000 in your browser to view the live interactive dashboard!
├── contracts/
│ ├── GhostlessLedger.sol # Main protocol contract (bonding, windows, slashing)
│ ├── baselines/
│ │ ├── PerTxAnchor.sol # Baseline B0 (one tx per decision)
│ │ └── BatchRootAnchor.sol # Baseline B1 (naive Merkle batching)
│ └── utils/
│ └── ReentrancyGuard.sol # Zero-dependency reentrancy guard
├── operator/
│ ├── main.py # FastAPI service + Web Dashboard
│ ├── merkle.py # Positional Merkle tree & proof generator
│ ├── receipts.py # EIP-712 typing and signing
│ ├── window_manager.py # Atomic SQLite allocation, pipelining, sealing
│ └── db.py # SQLite database manager
├── actuator/
│ └── gate.py # "No Receipt -> No Effect" Actuator Gate
├── watcher/
│ └── watcher.py # Verifier service (chain invariants, receipt vault)
├── subjects/
│ └── simulator.py # S10 Monte Carlo vigilance population study
├── redteam/
│ ├── malicious_operator.py # Adversarial operator implementation
│ └── run_all.py # Full automated red-team test harness
├── bench/
│ └── gas_bench.py # Live MST testnet gas benchmark suite
├── dashboard/
│ └── index.html # Standalone & FastAPI-served interactive UI
├── docs/
│ ├── ARCHITECTURE.md # In-depth architectural design
│ ├── THREAT_MODEL.md # Formal threat model & assumptions
│ ├── RESULTS.md # Comprehensive measured testnet results
│ └── FLAW_RECTIFICATIONS.md # Response to brutal review critiques
├── preflight.json # Measured MST testnet network parameters
├── gas_report.json # Real gas costs on MST Testnet
└── results.json # Measured red-team scoreboard & transaction logs