Proof of rental

Kiln's core promise is that you only pay for time the network can prove. This page explains exactly what's proven, how, and what isn't proven yet.

Heartbeats

A heartbeat is a Solana transaction sent by the provider's node, signed by the listing's heartbeat key, that says: this lease's workload is running, and the GPUs are at this utilisation.

The node sends one every 60 seconds for each lease whose container is running. Before you launch anything, after you press Stop, or if the container crashes, no heartbeats are sent.

Each heartbeat updates the lease on-chain:

Field Updated to
verified_secs Previous value + the counted gap (see below)
last_heartbeat_ts The transaction's timestamp
heartbeats +1
last_utilization_bps GPU utilisation, 0–10,000 basis points

It also emits a HeartbeatEvent, which the live network table reads.

How verified time is counted

The program counts the time between two consecutive heartbeats:

gap = now − last_heartbeat

if this is the first heartbeat        → count 0   (it starts the clock)
if gap > 180 seconds                  → count 0   (the machine went quiet)
otherwise                             → count min(now, lease_end) − last_heartbeat

So:

  • A machine heartbeating every 60 s earns 60 s of verified time per heartbeat.
  • A 10-minute outage earns nothing for those 10 minutes, even when the machine comes back.
  • Time after the lease's end is never counted, however many heartbeats arrive.
  • Verified time can never be paid beyond what you deposited.

The 180-second grace window absorbs normal network delays (a heartbeat landing a little late) without paying for real outages.

What a heartbeat proves

Proven, cryptographically:

  • The provider's registered heartbeat key signed it, so no one else can fake heartbeats for a listing.
  • It was recorded on Solana at a specific time, and those timestamps decide what is paid.
  • It refers to a specific lease of that provider.

Proven operationally:

  • The provider's node only heartbeats leases whose container is in the running state on its Docker host.
  • The renter can see the container responding (Jupyter loads, SSH connects, the API answers), and can stop paying at any time by stopping it or closing the lease.

What it doesn't prove yet

Be clear-eyed about the limits. The utilisation number, and the claim that the container is running, come from the provider's own node. A dishonest provider who modified kiln-provider could keep heartbeating while not actually running your workload.

What limits the damage today:

  • You see it immediately. If your Jupyter or SSH session doesn't work, close the lease. You pay only for verified time up to that moment, usually a few minutes.
  • Reputation is public. Every listing's total proven hours and every lease's history are on-chain.
  • Leases are short and prepaid in small chunks. You can fund an hour, check, then top up.

Roadmap: stronger proofs

Stage Idea Effect
Renter attestations A small agent inside the renter's container co-signs heartbeats with a per-lease key only the renter's workload holds The provider can't heartbeat without the renter's workload actually running
Challenges The renter or anyone can request a GPU-bound computation with a verifiable answer at random times Faked or underpowered GPUs get caught
Slashing Providers stake $KILN; proven cheating forfeits the stake Cheating becomes expensive

These are designed but not built yet. See the roadmap.

Previous← Providing a GPUNextPayments and escrow →