L I S A

In Today’s Broken Market
Proofs aren’t timestamped by default. Newton’s pretransaction policy enforcement generates ZK proofs inside the TEE environment to certify that an agent’s proposed trade cleared all user defined constraints at evaluation time, but a proof that certifies constraint compliance at evaluation time only guarantees the policy check ran correctly against the market conditions and permission state that existed when the proof was generated, not when it actually settles onchain. If there’s no enforced expiry window baked into the proof structure itself, or no block height binding that makes the proof invalid after a defined settlement deadline, a valid proof generated during calm conditions carries its passing verdict into a completely different market environment at execution time without the policy circuit re-evaluating anything. That’s not a ZK flaw, that’s a proof freshness flaw, and it’s the kind of thing that only shows up when conditions shift fast between generation and settlement.
Here’s the exact sequence that breaks things. An agent submits a trade intent during a low volatility window, the TEE evaluates it against the user’s slippage constraint, generates a clean passing proof, and the proof enters the submission queue. Before that proof settles, market conditions shift hard, the asset moves outside the user’s acceptable range, and what was a constraint-passing trade at proof generation time is now a trade that violates the user’s intent at the moment of actual execution. But the policy enforcement circuit already signed off, the proof is valid, and nothing in the onchain verification layer distinguishes between a proof that settled promptly and one that sat in a congested queue through three blocks of adverse price movement before landing. The user’s constraint existed to prevent exactly this outcome and the system honored it technically while missing it entirely in practice.
My honest take, and I’ve seen this failure pattern in systems that had cleaner proof pipelines than most. Binding a ZK proof to a specific block range or attaching a market condition checkpoint to the proof structure are both solvable engineering problems, but they add complexity to proof generation and they tighten the submission window in ways that hurt throughput, so early implementations tend to skip them and document the gap later when someone finds it live. I want Newton to publish explicit documentation on whether policy enforcement proofs carry any block height expiry binding, what the defined behavior is when a proof’s settlement is delayed past a meaningful price movement threshold, and whether the TEE re-evaluates constraint compliance at settlement time or treats a generated proof as a permanent authorization for that specific trade. Until that’s written down somewhere outside a whitepaper footnote, every policy constraint in Newton’s system has a time dimension that the enforcement guarantee quietly ignores.
$NEWT
@NewtonProtocol $NEWT #Newt

TEE security isn’t abstract, it’s physical. Newton’s pretransaction policy enforcement relies on trusted execution environments to isolate the computation where agent constraints get evaluated before any ZK proof gets generated, meaning the entire policy enforcement guarantee rests on the enclave boundary holding intact. That enclave boundary is a hardware guarantee, not a cryptographic one, and Intel SGX, the most widely deployed TEE hardware in production environments, has a documented vulnerability history including Foreshadow, Plundervolt, and SGAxe, each of which demonstrated that privileged or physical access to the underlying chipset can extract secrets from inside an enclave that was supposed to be sealed. The ZK proof confirms the computation happened correctly inside the TEE, but it doesn’t confirm the TEE itself wasn’t compromised before the computation ran. That’s the gap nobody’s drawing on the architecture diagram.
Here’s the production deployment problem. If Newton’s mainnet beta runs TEE nodes on cloud infrastructure, which is the most operationally practical choice at this stage, those enclaves are running on shared physical hardware managed by cloud providers whose other tenants are unknown quantities. SGX side channel attacks have been demonstrated in shared cloud environments before, not just in controlled lab conditions, and the patches that followed those disclosures came with meaningful performance tradeoffs that affected proof generation throughput in TEE dependent pipelines. A Newton policy enforcement node running on unpatched or partially patched SGX hardware isn’t just vulnerable, it’s producing policy approvals with a compromised trust boundary while every ZK proof attached to those approvals looks perfectly valid onchain. And nobody’s monitoring dashboard flags that distinction.
My honest take, and I’ve watched hardware assumptions quietly sink protocols that had clean cryptography. The TEE plus ZK pairing is architecturally thoughtful when both layers are intact, the separation of concerns makes sense and the proof generation adds a verification layer that pure TEE systems don’t have. But the ZK layer only certifies that the TEE computation ran correctly against its inputs, it doesn’t audit the hardware state the TEE ran on, and that creates a silent trust assumption at the physical infrastructure layer that no amount of onchain proof verification can catch after the fact. I want Newton to publish which TEE hardware vendors they’re certifying for mainnet beta nodes, what their enclave attestation verification process looks like, and how they handle a newly disclosed SGX vulnerability mid operation without forcing a full halt. Until that’s documented somewhere readable, the policy enforcement guarantee has a hardware shaped asterisk sitting right next to it.
$NEWT
@NewtonProtocol $NEWT #Newt

I keep coming back to the Newton Model Registry because the premise is shakier than it looks. The pitch is that AI developers publish trading strategies as deployable agents, users browse and license them, and the chain verifies execution against onchain policy constraints. Fine mechanically. The Keystore handles permissioning and the policy engine enforces boundaries so a rogue strategy can’t drain a wallet outside its mandate. That part I trust. What I don’t trust is the assumption that the developers who actually generate alpha will publish anything meaningful into a registry where competitors can reverse engineer their logic from observed onchain behavior.
Think about how strategies leak. Every trade an agent executes gets settled onchain with provable policy compliance, that’s the whole point of the system. But onchain settlement means onchain visibility, and visibility means anyone with enough patience can reconstruct entry logic, sizing rules, even rough risk parameters just by watching the wallet over a few hundred trades. A real quant doesn’t hand over edge for a few license fees when the edge decays the moment it’s copied. And the strategies that do get published are probably the ones that were already commoditized before they hit the registry.
My cynical read here. The registry will fill up fast with mediocre strategies and call it adoption, while the developers actually capable of sustained alpha stay private or build closed infrastructure elsewhere. That’s not a Newton specific flaw, it’s just how open marketplaces for proprietary edge always shake out. I want to be wrong about this one. But until I see a top tier strategy published and still profitable six months later, I’m treating the registry as a feature for show.
$NEWT
@NewtonProtocol $NEWT #Newt