Security and trust
This page is an honest account of what you have to trust when you use Kiln, what's enforced by code, and what's not finished.
Status: unaudited. The Kiln program and provider node have not had an external security audit. Until they have, treat the network as experimental and keep amounts small.
What the program guarantees
These rules are enforced by the Solana program, so neither Kiln nor providers can break them:
- Escrow can only pay out by the rules. Tokens leave escrow only through
settle(verified time, to the listing owner and treasury) orclose_lease(refund of the rest to the renter). - Providers can't be paid for more than you deposited, or for time not covered by heartbeats at most 180 s apart.
- Only the listing's heartbeat key can send heartbeats for its leases.
- Only the renter or listing owner can close a lease, and closing always refunds the remainder to the renter.
- The fee is capped at 20% by the program; it is set to 2.5%.
- Lease price is fixed at opening. Later price changes don't affect open leases.
What you trust the provider with
Your workload runs on hardware the provider controls. Like any cloud, a malicious provider could:
- read data and files inside your container, and see its network traffic
- run something other than your workload while their node still sends heartbeats (see limits of proof)
- stop the machine at any time; you then stop paying
What to do: don't put long-lived secrets in rented containers, use short-lived tokens, encrypt anything sensitive, save results frequently, and fund leases in small increments when trying a new provider.
What providers trust renters with
Renters run arbitrary Docker images on your GPU. The node:
- never uses
--privileged - sets
no-new-privilegesand dropsNET_RAW,SYS_PTRACEandMKNOD - limits processes (
--pids-limit 4096), and optionally memory and CPU - validates image names, ports and environment variables to block flag injection
- runs one workload per listing and deletes it when the lease ends
Containers still have outbound network access and the GPU. Isolate the machine from your home or office network and keep the host patched.
How the website talks to providers
Provider gateways usually serve plain HTTP on an IP address, which browsers can't call from an HTTPS site. The Kiln website relays these calls server-side. The relay:
- holds no credentials: every call carries your wallet-signed session or token, which the provider checks against Solana
- forwards only the six known gateway paths
- refuses provider addresses that resolve to private or internal networks
- limits request size and time
Session messages expire after five minutes, and tokens are bound to one lease and expire when it ends.
Keys
| Key | Lives on | Can do | If it leaks |
|---|---|---|---|
| Renter wallet | Your wallet app | Everything for your leases | Move your funds to a new wallet |
| Provider owner wallet | Provider's wallet app, not the GPU machine | Change listing, receive payouts | Move funds, re-register |
| Heartbeat key | The GPU machine | Send heartbeats, trigger settlement to the owner | Rotate it from Your listings |
| Program upgrade authority | Kiln team (multisig planned before mainnet) | Upgrade the program | Covered in the launch checklist |
| Protocol admin | Kiln team | Change fee (≤ 20%) and treasury address |
Reporting a vulnerability
Please report security issues privately rather than in public channels. Contact details are on the Transparency page. Give us reasonable time to fix before disclosing.