Risk 01
Model substitution
The endpoint says Qwen3.8-27B and serves a cheaper model, or an uncensored (“abliterated”) copy of the same one. The model field in the response is whatever the seller writes there.
A graded market for AI inference on NEAR
Every AI credit, assayed.
Credster is a market for spare AI inference credits. Every seller is graded before it can trade: is it the model it claims, and is the token count honest? The grade lives on chain. An F suspends the listing.
Reading market.credster-68480.testnet
- open listings
- 6
- suspended (F)
- 3
- orders
- 18
- tokens settled
- 14,292
- slashed to buyers
- 0.0100 NEAR
§01 · The problem
Resold credits hide two risks you can’t see.
People hold AI credits they don’t use: a team plan, a NEAR AI Cloud balance, spare capacity on their own GPU. Agents need inference and would happily buy it below list price. Reselling already happens. The buyer just can’t check what it got.
Risk 02
Inflated metering
The endpoint serves the right model and reports 35% more tokens than it used. Every call costs a little more than it should, and the buyer has no count of its own to compare.
Escrow and spending limits don’t help here. The buyer pays exactly what was agreed, for something other than what was agreed.
§02 · How a grade is made
The grader buys like a customer, then checks the goods.
Before a listing can trade, the grader places a small trial order on it and probes the endpoint with seven calls, signed with the trial order’s key like any buyer’s. Three checks decide the grade.
Check 01
Token-count fingerprint
Three fixed probe texts, dense with mixed scripts, emoji and code. The prompt token count depends on the model’s tokenizer and chat template, so the three counts work as a fingerprint. Measured against NEAR AI Cloud directly, they were identical on repeat calls and differed between model families.
A mismatch means a different model. Counts that are all the reference times one factor mean inflated billing.
Probe calls · listing
Fingerprint: ñandú 東京 🧪 0x7f3a9 «quoted» naïve façade — ∑∫√ ﷽ ⟨tok⟩ 1234567890…def f(xs): return {k: v for k, v in zip(xs, xs[1:]) if k != v} # 🚀 Ωmega …In 1879, 42 nautical miles off Reykjavík, the ship ‘Þórshöfn’ logged 3.14159 knots; Κύριε, Привет, مرحبا…
reference for the claimed modelreported by the seller
Match. Claimed Qwen3.8-27B; the counts fit Qwen3.8-27B and its abliterated sibling.
Check 02
TEE signature
For models NEAR AI Cloud serves inside a TEE, the seller node relays the provider’s signature for one probe. The grader rebuilds the text that should have been signed, recovers the signer and looks it up in NEAR AI’s public attestation report for the claimed model.
A valid signature that names a different model is proof of substitution. It caught the sibling seller, whose abliterated Qwen has the same tokenizer and passed the fingerprint.
Signed text · listing
Qwen/Qwen3.8-27B:88cf74a4…ee9a9dbaf:9030ec7a…1d656b0f7
- Signature recovers to
0x835ab53d…5336aa26 - Signed text names the claimed model and our exact bytes
- NEAR AI’s attestation report for
Qwen3.8-27Blists this signer
Verified. The claimed model answered inside a TEE.
Check 03
Fresh checkable tasks
Multiplication, string reversal, sorting and counting, generated from a new random seed on every run so the answers can’t be cached. The grader also records latency and the error rate.
Seed
1830586796
- Compute 626 × 723452598
- Reverse “uoojgdsrapm”mparsdgjoou
- Sort 92, 51, 32, 59, 24, 55, 7024, 32, 51, 55, 59, 70, 92
- Count “o” in “xpzoeaoyoswmqoxuoftxtfkz”5
The honest seller’s real run: 4 of 4 correct, p50 latency 2738 ms, 0% errors.
Then
The grade goes on chain
The grader posts the tier, the checks that passed and the sha256 of the full JSON report. The contract enforces the rules: a passing tier needs the fingerprint and metering checks, an A also needs the TEE check, and an F suspends the listing.
post_grade(listing 9, tier F, checks, report_hash)
ba7605c13b54263a54ec3dfeaa5eae351d42ba10664f51ad0e9b115a201bec5e
Listing #9 · usage 1.353× the claimed model’s counts.
tx GRGADUiM…tYypn9c7
§03 · Four marks
Three of them can trade.
A listing can be bought only while its grade is passing and fresh. A new endpoint clears the grade until the grader probes it again.
-
Grade A: TEE-signed
Fingerprint and metering match, and a TEE signature proves which model answered. At least half the tasks right, at most 10% errors.
Trades
-
Grade B: No TEE for this model
Fingerprint and metering match, and the model has no TEE signatures at its provider to check. Same task and error bar as an A.
Trades
-
Grade C: Capped
Fingerprint and metering match, but the seller withheld a TEE signature its model supports, got fewer than half the tasks right, or failed more than 10% of calls.
Trades
-
Grade F: Suspended
Wrong tokenizer, scaled token counts, a TEE signature naming another model, or most calls failing. Buying is refused and the probe calls go unpaid.
Can’t trade
§04 · Measured on NEAR testnet
Six sellers. Four cheated. All four were caught.
One end-to-end run of scripts/demo.mjs on 12 Nov 2026 at 07:50 UTC, against market.credster-68480.testnet. Six sellers, each a sub-account with its own node, all reselling NEAR AI Cloud. Grading failed three of the cheats. The fourth passed, cheated a buyer later and lost part of its bond.
-
Assay certificateListing #6
honest
- Claims
- Qwen3.8-27B
- Serves
- Qwen3.8-27B
- Fingerprint
- match
- TEE signature
- verified
-
Assay certificateListing #7
swap
- Claims
- Qwen3.8-27B
- Serves
- Qwen3.6-35B-A3B
- Fingerprint
- mismatch, fits Qwen3.6-35B-A3B
- TEE signature
- names Qwen3.6-35B-A3B
-
Assay certificateListing #8
sibling
- Claims
- Qwen3.8-27B
- Serves
- Qwen3.8-27B-abliterated
- Fingerprint
- match, same tokenizer
- TEE signature
- names the abliterated model
-
Assay certificateListing #9
inflate
- Claims
- glm-5.3-flash
- Serves
- glm-5.3-flash, usage ×1.35
- Fingerprint
- scaled ×1.353
- TEE signature
- no match: answer rewritten
-
Assay certificateListing #10
deepseek
- Claims
- deepseek-v4.1-flash
- Serves
- deepseek-v4.1-flash
- Fingerprint
- match
- TEE signature
- not offered for this model
-
Assay certificateListing #11
overclaim
- Claims
- glm-5.3-flash
- Serves
- glm-5.3-flash
- Fingerprint
- match
- TEE signature
- verified
Your turn
The same six personas run on a live server. Buy from them with free test NEAR, catch the overclaim with your own receipts, or launch a cheating seller and watch the grader fail it. All in the browser, no install.
Try it liveThe three F listings were suspended. Buying from them was refused with listing graded F, and the contract paid nothing for the grader’s probe calls on them: orders 9, 10 and 11 closed with 0 spent.
One run, six sellers, all personas run by the author against one NEAR AI Cloud account on 127.0.0.1 endpoints. It shows the mechanism working end to end. It is not a benchmark of grading accuracy.
§05 · Trading
Three ways to buy. Rules set every price.
Buy at the ask
The deposit is the budget. The price is the ask at the moment of the fill, and the order keeps it.
Alice bought a 0.1 NEAR order on listing #6 at the ask, 0.08 / 0.30 NEAR per million input / output tokens. The seller’s pricing rule then raised the ask to 0.088 / 0.33. Her order kept the old price.
Let agents negotiate
The buyer escrows a deposit with an offer. Buyer and seller alternate, four moves at most. The buyer agent plans a price from the grade, 90% of the ask for an A and 80% for a B. It opens lower, counters once with its reasoning, then accepts or walks away. The seller agent keeps a private floor.
An optional LLM only writes the note. Rules set every price, so text in a counterparty’s note can’t move money.
Offer #0 · listing #6 · Bob · budget 0.08 NEARAccepted · order 16
- Buyer agent0.2376 out · 0.0634 in
Tier A listing. My plan is 0.2970 NEAR per 1M output; opening at 0.2376 for a 0.08 NEAR budget.
- Seller agent0.2838 out · 0.0757 in
Graded A (TEE-attested), p50 2738 ms. I can meet you at 0.2838 per 1M output.
- Bob accepted · negotiated order at 0.2838
Pay as you go, under a ceiling
The buyer opens a tab with a price ceiling. Each claim is priced at the seller’s ask when the claim is made, capped at the ceiling.
Bob opened a tab on listing #10 with an output ceiling of 0.15. The first claim was priced at the ask, 0.12. After the seller raised the ask to 0.30, the next claim was priced at the ceiling, 0.15.
§06 · Receipts, disputes, slashing
Claim more than you served. Lose the bond.
-
01 · Receipts
Every answer carries a signed receipt.
The seller node signs one for each answer: listing, order, sequence number, the sha256 of request and response, input and output tokens. Seller #11, graded A, served Alice 34 input and 254 output tokens across two signed receipts.
receipts2tokens in / out34 / 254
-
02 · Claim
The seller claimed three times as much.
A claim carries the token sums, the receipt count and the sha256 of the receipt texts. Seller #11 claimed 102 input and 762 output tokens.
claimed in / out102 / 762ratio3.0×
-
03 · Dispute
Alice’s client found the gap.
Her client summed its own receipts, saw a claim the receipts don’t cover and disputed it inside the challenge window.
-
04 · Resolution
The grader checked the receipts behind the claim.
- Signatures valid
- Receipts belong to this order
- Receipt hash matches the claim
- Receipts sum to 34 / 254, the claim says 102 / 762
-
05 · Slash
Claim rejected. 0.01 NEAR of the bond went to Alice.
The slash is twice the claim, at least 0.01 NEAR and capped at the bond. The seller’s bond fell from 0.200 to 0.190 NEAR.
- Challenge window
- 60 s
- Claims paid after the window
- 7 · 0.001313732 NEAR
- Orders closed, deposits refunded
- 10 · 0.5787 NEAR
§07 · Under the hood
One contract holds the money and the rules.
The seller’s upstream key stays on the seller’s node; buyers never see it. Every listing, grade, order, claim, dispute and refund is a contract call with a NEP-297-style event log.
Contract escrow and rules
Bonds, deposits, offers, the grade gates, claims with a challenge window, disputes, slashing and refunds. Rust, near-sdk 5.30, 24 unit tests.
Sub-accounts as identities
Every seller, buyer and the grader is a sub-account of one parent, so each action traces to one agent.
Per-order ed25519 keys
The buyer registers a fresh key on each order and signs gateway requests with it. A leaked key can spend only that order’s remaining budget, at that order’s price.
NEAR AI Cloud
The upstream for the demo sellers, the reference for fingerprints, and the source of the TEE signatures and attestation reports the grader checks.
§08 · Verify it yourself
Don’t trust this page. Check it.
Every grade on chain carries the sha256 of its full report. This page can read all of them from NEAR testnet RPC, download each report, hash it in your browser and compare. No key, no backend.
Reports on
market.credster-68480.testnet
- Press the button: the page fetches every listing from the contract, then every report it points to.
Or from a clone, in a few minutes
# 19 tests: fingerprints, tiers, receipts, signatures, price math
cd node && npm install && npm test# 24 tests of the market rules
cd contract && cargo test# re-check every on-chain report hash, no key needed
cd node && TS_CONTRACT=market.credster-68480.testnet \
node src/cli.js verify-reports§09 · Known limits
What it doesn’t do yet.
The grader is one trusted account.
Its reports are public and hash-bound, and anyone can rerun a grade with
grade --no-post, but the contract trusts the grader’s account. A grader in a TEE, or several graders with a quorum, is not built.A fingerprint names a tokenizer family, not a model.
Siblings that share a tokenizer give identical counts:
glm-5.3andglm-5.3-flash, or Qwen3.8-27B and its abliterated copy. The TEE check separates them where it exists. Without it, four tasks usually won’t.A careful cheater can fake the counts.
A seller that serves another model and rewrites
usageto the claimed tokenizer’s counts passes the fingerprint. For TEE models the signature still catches it; for others it does not.A seller can withhold TEE signatures.
For a model that has them at the provider, the grade is then capped at C rather than failed.
The hardware quotes weren’t checked here.
The grader trusts the signing address that NEAR AI’s public attestation report lists for a model. It does not verify the Intel TDX and NVIDIA quotes itself.
Probes can be recognised.
The grader uses its own account. A seller that answers the grader honestly and cheats everyone else is caught only by buyers’ metering disputes, not over substitution.
Testnet NEAR, no streaming.
Native testnet NEAR only: no stablecoin, no NEAR Intents yet. The seller node refuses
stream: true.Provider terms.
Many AI providers forbid reselling API access, and each seller answers for its own provider’s terms. Self-hosted open models are the clean case.
