Testnet demo. Test banks and test money only.

Contents and search

KredoFi docs

Security

What we protect, what we don’t, and the known limits, in plain language.

#What we protect

  • Your bank data is read only by the pinned scorer, inside the enclave on mainnet. Only a band, a score, an income cap, a fingerprint and a sealed name come out.
  • Your name stays sealed unless you default.
  • Scores can't be faked. The contract accepts a score only from its own pinned OutLayer request.
  • Only you can ask for your score. On mainnet the contract requires your account's signature. On the testnet demo, every score request carries a one-time challenge signed with a full-access key of your account (a NEAR NEP-413 signed message), so nobody can re-score someone else's account.
  • Lender money. Checked math, state written before every transfer with rollback on failure, a 10% per-borrower limit, the reserve pays first, and no owner method can move lender cash, loans or the reserve.

#What we don't protect, or only partly

  • The owner can still change the code. The contract accounts still have their full-access keys, so the owner could deploy different code, and different code could move funds. Before real money this needs locked keys, a DAO or time-locked upgrades. The mainnet pool holds no funds today.
  • The sealing key was made outside the enclave. The mainnet sealing key was generated by the developer and handed to OutLayer as a secret, so the developer could open sealed names. The recovery partner is simulated and its key is also held by the developer. Production would generate the key inside the enclave.
  • The testnet demo isn't private from us. Its scorer runs on our server, so that server sees the data while scoring. It uses its own sealing key, sandbox banks and test money.
  • Trust in the enclave. We rely on Intel TDX and on OutLayer's worker registration and secrets service.
  • The chain is public. Your band, score, loans and repayments are linked to your NEAR account.
  • Fingerprints rely on identity data. Someone with accounts at several banks could become several borrowers.
  • A missed deadline releases your name. After the due date plus grace, anyone can mark the default; that is the deterrent by design.
  • Partial bank history. Plaid's sandbox sometimes reports the history as complete before it has arrived. The scorer waits for it (and the testnet scorer also checks every month is present); a partial history can lower a score, never raise it.
  • Rebuilding the scorer needs x86_64 Linux. The pinned file rebuilds byte for byte in the pinned Docker image on x86_64 (or in the repository's GitHub workflow); macOS and ARM builds give other bytes. See Verify it yourself.
  • Demo accounts live in your browser. Their key is in local storage; anything that can run script on the page could take it. They hold only test funds.

#Known limits

  • Bank data is Plaid sandbox only; real banks need Plaid production access and a licensed lending partner.
  • No mainnet loan has been made yet.
  • Regulation (lending licences, KYC, collections) is out of scope for this demo.

The full write-up is THREAT_MODEL.md in the repository.