How the Peer Probe System Prevents Cheating

← Back to Blog

Introduction

Proof-of-Energy mining requires an honest answer to a hard question: is this miner actually burning the energy they claim? Traditional Proof-of-Work avoids the question entirely — energy expenditure is implicit in the hash rate, and the protocol never asks how the work was done. Wattcoin faces a different problem: contributions are proportional to declared hardware TDP, so the network must independently verify that each miner is running the hardware they say they are, that it is actually computing, and that it is computing at the expected speed.

The peer probe system is the mechanism that answers these questions. Every miner on the network periodically receives a computational challenge — a probe — from multiple peer coordinators. The probe must be solved locally and the result submitted within a strict time window. The outcome determines the miner's trust score, which scales their mining contribution from 20 % to 100 % of their hardware's rated power.

This post is a technical walkthrough of how the probe system works, what attacks it prevents, and where its limits are.

Probe Types

A probe is a deterministic computational workload matched to the miner's declared hardware capability. There are currently four types:

• CPU probe — an integer hash-chain loop with a known iteration count. Both the coordinator and the worker independently compute the same function; the coordinator compares the resulting proof hash against its own computation. A mismatch is conclusive evidence of tampering.
• Memory probe — a pointer-chase across a large array with a fixed number of random walks. Memory latency is measured directly. The coordinator re-computes the walk in software and verifies the final proof hash.
• GPU probe — a DirectX compute shader that renders a deterministic pattern using an integer XOR-shift algorithm. The coordinator pre-computes the expected pixel hash in pure JavaScript before issuing the probe; the worker's GLSL output must match exactly.
• ASIC probe — queries the cgminer-compatible API on localhost for the real-time hashrate and compares it against the published specification of the declared model.

Hardware Attestation — You Cannot Lie About What You Have

Before any probe is issued, every miner must pass a hardware verification step during benchmark. The renderer sends its hardware strings (CPU model, GPU model, device type, declared TDP) to the main process, which independently verifies them:

• The CPU model is read from os.cpus()[0].model — the operating system kernel, not the renderer, decides what CPU is installed. Any mismatch triggers a −20 trust penalty and caps declared power to the real CPU's TDP via Brave lookup.
• The GPU model is verified through two independent channels: the OS-level resolveOsHardwareIdentity() function and, on Windows, the native gpu-miner.exe binary that reports the DXGI adapter name. TDP is looked up from a local hardware table.
• Device type (desktop vs. laptop) is cross-checked. A renderer claiming "desktop" while the OS reports "laptop" triggers a clamp to the laptop CPU's TDP (or 35 W fallback).
• Virtual machines are blocked entirely — CPUID, SMBIOS, and GPU identity can all be spoofed in a VM, making OS-level attestation unreliable.

After identity verification, a calibration factor (range 0.2× to 1.2×) is computed by comparing the miner's actual benchmark speed against a reference table for the declared hardware. The final contribution ceiling is declaredUnitPowerW × calibrationFactor, and the trust factor (0.2 to 1.0) is applied at contribution time.

Proof Hash Chain — Sequential Computation Required

Probes are chained together cryptographically. Each probe's seed is derived from the proof hash of the previous probe in the chain. This means a miner cannot pre-compute probes or skip ahead — the seed for the next probe is unknown until the current probe's result is produced. If the chain is broken (e.g., the probe times out and the worker resets to null), the next seed is a fresh random value with no link to prior work.

Timing Ratio Checks

For CPU and memory probes, the coordinator computes an expected wall-clock time based on the worker's declared hardware spec and its own benchmark history:

expectedMs = iterations / effectiveCpuOpsPerSec × 1000
ratio = probeWallClockMs / expectedMs

The probe is flagged if the ratio is below 1/3.0 (suspiciously fast — likely outsourcing to stronger hardware) or above 3.0 (suspiciously slow — likely throttled or different hardware than declared). The effectiveCpuOpsPerSec uses the maximum of the declared ops/sec and the worker's own historical mean, preventing a miner from claiming artificially low speed to hide outsourcing.

Trust Score — How Probes Drive Mining Power

Every probe result updates the miner's trust score, which scales their contribution linearly:

trustFactor = 0.2 + (trustScore / 100) × 0.8
maxDeltaWh = (calibratedUnitPowerW × trustFactor × 0.5) / 3600

At trust score 0, the miner contributes at only 20 % of their calibrated power. At trust score 100, they contribute at 100 %. The score moves as follows:

• +1 for 25 consecutive verified probes with no issues
• −1 per failed probe (mismatch or timing violation)
• −3 per proof/pixel hash mismatch (strong evidence of cheating)
• −1 additional if the last 50 probes have a failure rate above 30 %
• −20 for a hardware identity mismatch (detected at benchmark time)

Multi-Coordinator Cross-Attestation

A single malicious coordinator could issue easy probes or accept fake results. To prevent this, every miner connects to multiple coordinators simultaneously, and each independently issues probes. At settlement time, the protocol checks that at least 3 verifier attestations exist for the claimed chain index — requiring a majority of coordinators to collude before the protection is bypassed.

Connections are maintained via persistent WebSocket channels. If a coordinator goes offline, only that slot is replaced leaves the other two connections intact. This design makes the probe stream resilient — a miner receives probes from multiple coordinators at random intervals averaging one every ~10 seconds.

Network Outlier Detection

Even if a miner passes individual probes, an anomalously high power-to-CPU ratio compared to the rest of the network is flagged. Each miner's stats are recorded in a network-wide histogram. If a miner's ratio deviates more than 3 standard deviations from the mean of all other miners, a flag is raised at benchmark time. This catches cases where a miner declares a reasonable CPU model but inflates the TDP beyond what the benchmark-implied power would suggest.

What Attacks Are Prevented

Result forgery

The coordinator independently re-computes CPU and memory proofs and pre-computes GPU pixel hashes. A faked result is detected immediately.

Hardware misrepresentation

OS-level CPU model (kernel), DXGI GPU model (native binary), device type cross-check, and Brave TDP lookup together make it infeasible to claim a different chip than what is physically installed. A VM cannot mine at all.

Pre-computation

The chained seed derivation means the next probe's challenge is not known until the current probe is solved. No probe can be computed ahead of time.

Single-coordinator collusion

With 3 independent coordinators probing each miner and a minimum of 3 verifier attestations required at settlement, a single malicious coordinator cannot inflate a miner's attestation count.

Sybil

Multiple worker identities on the same hardware do not increase total mining power — contribution is bound to the physical machine's verified TDP, not the number of identities.

Summary

The peer probe system is a multi-layered attestation framework that makes it prohibitively expensive to cheat at Proof-of-Energy mining. Computational proof verification, OS-level hardware identity checks, timing ratio analysis, multi-coordinator cross-attestation, network outlier detection, and sliding-window trust scoring each address a different attack vector. No single layer is perfect, but together they raise the cost of cheating well beyond any possible reward.