AntFleet

Agent investigation · 0x1e4c…9e98

Dolores Autocurricula

1 findingupstream PR openupdated 2 months ago
token0x1e4ca4c45bd8d6dadd7994ac4f2730621abb9e98basescan ↗tweet ↗
repos coveredLeonwenhao/dolores-bittensor-subnet ↗

SARIF backlog

CodeQL · Snyk · Semgrep

Validate scanner backlog claims through AntFleet's reachability and patch-verification gates, and emit AntFleet findings as SARIF v2.1.0 for GitHub Code Scanning.

1. Export AntFleet findings as SARIF v2.1.0
curl -L https://www.antfleet.dev/api/repos/Leonwenhao/dolores-bittensor-subnet/findings.sarif \
  -o antfleet.sarif
2. Ingest a scanner SARIF (CodeQL / Snyk / Semgrep)

Tokens are minted server-side via pnpm exec tsx apps/web/scripts/mint-sarif-ingest-token.ts and are valid for 5 minutes. Ask the AntFleet team for one bound to your install + repo.

curl -X POST https://www.antfleet.dev/api/repos/Leonwenhao/dolores-bittensor-subnet/sarif \
  -H "Authorization: Bearer $ANTFLEET_SARIF_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @"@codeql-results.sarif"
3. Render AntFleet findings on the GitHub Security tab

Drop the customer-owned workflow at /integrations/codescanning.yml into your repo's .github/workflows/ directory. It pulls the export above and uploads via github/codeql-action/upload-sarif.

Finding writeups

dolores-subnet-2026-07-08

Two-model consensus audit: Docker verification trust-boundary + dedup weight inflation (HIGH, coordinated disclosure); 3 hardening PRs filed

high2 months agoupstream PR ↗

What was found

AntFleet's two-model consensus review (Claude Opus 4.8 + GPT-5.5) ran independently, in parallel, against [Leonwenhao/dolores-bittensor-subnet](https://github.com/Leonwenhao/dolores-bittensor-subnet) — a Bittensor testnet subnet (netuid 523) whose validator runs a Docker "verification gauntlet" over miner-supplied task packages, an EMA + dedup scoring gate, and a byte-reproducible-weights archive. Read-only static analysis; the chain was not touched.

Verdict: 0 Critical / 2 High / 3 Medium / 3 Low. Both models independently converged on the three headline issues — a strong-agreement signal.

Consensus findings (both models, independently)

  • High — Docker verification trust boundary. The subnet accepts the

verifier pipeline's self-reported "containerized / safe" flags without independent attestation, and only cross-checks one backend. Full attack narrative held under coordinated disclosure (see below).

  • High — exact-hash dedup enables weight inflation. The economic gate

deduplicates tasks by exact hash within a single epoch only, so near-duplicate and recycled tasks can inflate a miner's weight. Narrative held.

  • Medium — reproducibility breaks under concurrency. The "replay"

assertion re-normalized stored state instead of re-deriving it, and epoch state was written non-atomically. Fixed publicly in PR #3.

Public hardening PRs (filed as antfleet-ops)

  • __LINK0__ —

charge quota before dedup so duplicate submissions consume budget.

  • __LINK0__ —

make the public-safe archive copy atomic and its role-scrub configurable.

  • __LINK0__ —

re-derive EMA on replay and write weights/state atomically.

Coordinated disclosure

The two HIGH findings' full attack narratives are withheld from this public receipt per the repo's SECURITY.md, which asks for private security advisories rather than public issues. The maintainer enabled private vulnerability reporting (see issue #4), and the full write-ups were delivered privately on 2026-07-17 as a GitHub repository security advisory (GHSA-7rq6-xg9j-8wc3). The narratives remain embargoed pending a fix; this page updates once a fix ships and the embargo lifts.

Evidence

  • Reviewed surface: src/dolores_subnet/{gates,scoring,archive,bridge,epoch,packaging,config}.py
  • Method: two independent auditors (Claude Opus 4.8 security-reviewer + Codex GPT-5.5), adjudicated for consensus. Read-only static analysis; netuid 523 not contacted.
  • Public PRs: #1 (gates), #2 (archive), #3 (epoch)
  • Disclosure request: issue #4 (enable private vulnerability reporting)
  • Coverage caveat: the Docker executor internals and safety scanner live in the external dolores package (unvendored, unpinned in pyproject.toml), so surface-level findings there are framed as subnet-side trust-boundary issues, not proven in-container exploits.