VIURL: Verification Without a Referee

A protocol for crowd-sourced fact-checking that no coordinated group can capture.

Version 2.0 · 2026-08-04 · VIURL LLC

About this document

Every quantity in this paper is traceable to a named file in the VIURL codebase, and the tables say which. Where a mechanism is designed but not built, it is marked [DESIGN]. Where something is not known, it says so.

Three things this paper deliberately does not contain:

• No token price, valuation, or return projection. VIURL's distribution is earned-only — no public sale, no pre-sale, no team or investor allocation — and that fact is worth more than any forecast. Publishing one would undermine it.
• No claims about unwritten code. There are no smart contracts today, so there are no audits of them to report.
• No performance benchmarks for systems that do not exist. Throughput figures are measured or absent.

This replaces the 2025 draft, which contained a broken security bound, a valuation off by three orders of magnitude, a token supply off by 100×, and a distribution model contradicting the one in code. That draft is retained for history and marked superseded.

1. The problem, scoped honestly

False information travels further and faster than corrections. Vosoughi, Roy and Aral (2018) measured this on Twitter: false cascades reached 1,500 people roughly six times faster than true ones, and the effect was driven by humans resharing, not bots.¹

That study measures diffusion. It does not prescribe a remedy, and no honest document can use it to forecast a reduction in misinformation. What it establishes is narrower and sufficient: speed of correction is not the binding constraint — credibility of correction is. A correction nobody trusts does not propagate regardless of how fast it is published.

So the question is not "how do we fact-check faster." It is:

Who decides what is true, and what stops that authority from being captured?

Every existing answer concentrates the decision somewhere. Platform moderation concentrates it in a policy team. Community moderation concentrates it in whoever accumulates tenure. Wikipedia's reliable-sources policy concentrates it in whoever edits the source list.

That last one is the instructive failure, and it is not a failure of integrity. It is a failure of incentive design: when reputation is voting weight and reputation is earned by agreeing with the outcome, the largest coordinated group compounds its power every round, and being early and correct against the crowd lowers your standing. No bad actor is required. The mechanism does it on its own.

VIURL's thesis: capture is an incentive problem, and incentive problems have mathematical solutions.

2. What VIURL is today

A working social platform with a verification layer, running in production, entirely off-chain.

Phase 0 is deliberate, not preparatory. The verification economics must be tuned while the token is worthless, because that is the only period in which a wrong parameter costs nothing to fix. Once a token has a market price, every economic parameter acquires a constituency that resists changing it.

Peer-to-peer transfer is switched off in production. Points that are transferable between users and redeemable for money constitute money transmission — it is the combination, not either half. VIURL is heading toward redeemable, so the transferable half came off first (src/config/transfers.js).

3. MERIT: the verification protocol

3.1 The four capture surfaces

MERIT replaced a scheme that scored a verifier on verdict === winningVerdict. Four properties of that design made capture inevitable; each is now closed.

3.2 Certification conditions

A verdict certifies if and only if all three hold (src/config/verification.js):

$$n \geq 5 \quad\wedge\quad \frac{w_{\text{top}}}{\sum_v w_v} \geq 0.60 \quad\wedge\quad \big(b_{\text{top}} \geq 2 \;\vee\; \text{bridged}\big)$$

where $n$ is the verification count, $w_v$ the bloc-compressed weight of verdict $v$, and $b_{\text{top}}$ the number of historically-distinct blocs supporting the winning verdict.

Failing the third condition yields status provisional. Provisional pays nothing and moves no reputation. This is the load-bearing design decision in the entire protocol: brigading is made unprofitable, not merely detectable.

3.3 Bloc compression, and why sybil returns are sublinear

Verifiers whose pairwise historical agreement is ≥ 0.90 over ≥ 5 shared subjects are merged into one bloc by union-find. A bloc of size $m$ contributes

$$w_{\text{bloc}} = \frac{1}{\sqrt{m}}\sum_{i=1}^{m} w_i$$

Proposition 1 (sublinear sybil returns). An attacker controlling $m$ accounts that vote in lockstep, each of individual weight $w$, obtains effective weight $w\sqrt{m}$, not $wm$. Reaching effective weight $W$ therefore requires $m = (W/w)^2$ accounts.

Proof. Lockstep accounts satisfy the merge predicate by construction, so they form a single cluster of size $m$. Substituting $w_i = w$ into the compression formula gives $mw/\sqrt{m} = w\sqrt{m}$. ∎

Concretely: 4 lockstep accounts carry the weight of 2 independents, 9 carry 3, 100 carry 10. The cost of buying influence grows quadratically in the influence bought.

3.4 The stronger result

Proposition 1 makes capture expensive. The diversity quorum makes it impossible.

Proposition 2 (unprofitable brigading). A coordinated group, of any size, cannot move a claim beyond provisional without the participation of at least one verifier having a history of disagreement with the group. And provisional disburses zero reward and effects zero reputation change.

Proof. All members of a lockstep group merge into one cluster, so $b_{\text{top}} = 1$ and the disjunct $b_{\text{top}} \geq 2$ fails. The alternative disjunct requires a bridging pair — two verifiers whose historical agreement is ≤ 0.50 — which by definition cannot be satisfied within a lockstep group. Hence the quorum fails and the verdict is provisional, whose handler is invoked with merit scoring disabled. ∎

Compare this with the claim in the 2025 draft, that an attacker "must control over 99% of validators." That figure came from $P = (1/n)^k$, which is not a security bound — $1/n$ is the probability of selecting one specific validator, so $(1/n)^k$ is the probability of selecting $k$ specific validators in order. The correct sampling bound is $\approx f^k$ for attacker fraction $f$, which at $k=10$ gives a 1% success probability at $f \approx 0.63$, not 0.99:

$$f = 0.01^{1/10} = 10^{-0.2} \approx 0.631$$

Proposition 2 is a stronger guarantee than the corrected bound, and unlike either, it is a property of code that runs.

3.5 Weight cap

No verifier may carry more than $\max(1/n,\ 0.15)$ of total weight, iterated to a fixpoint (applyWeightCap). The $1/n$ term is not decoration: on a 5-person panel every verifier is 20%, so the cap correctly binds nothing. The cap engages from $n \geq 7$ upward.

Capping lowers the total, which lowers the cap, so a fixed number of passes leaves a residual above the limit. Iterating to convergence was a bug fix, not a refinement.

3.6 Merit scoring

Merit is not accuracy. Two verifiers reaching the same correct verdict score very differently depending on how they reached it (MERIT_* in src/config/verification.js):

$$M = 55 + 20\,\beta + 20\,\varepsilon + 10\,\pi + 5\,q - 12\,\kappa$$

Two worked cases:

Independent, early, primary-sourced, quoted: $55 + 20 + 20 + 10 + 5 - 0 = \mathbf{110}$

Correct, but late, agreeing only with own bloc, citing press ($\pi = 0.50$): $55 + 0 + 0 + 5 + 0 - 12 = \mathbf{48}$

A 2.29× spread on identical verdicts. The prior rule scored both as 100% accurate. The tally snapshot is stored at write time precisely so $\varepsilon$ cannot be reconstructed favourably after the fact.

Wrong-but-well-evidenced still earns (MERIT_WRONG_BASE 8 + MERIT_WRONG_PRIMACY_MAX 12). Dissent must stay affordable or the system converges on silence.

3.7 Source neutrality

The prior implementation kept curated TRUSTED_DOMAINS and LOW_QUALITY_DOMAINS lists. Both are deleted. Whoever edits such a list decides what is true, which is the precise mechanism by which a sourcing policy becomes a political instrument.

Sources are scored on structural, auditable properties — evidentiary distance from the fact (src/utils/sourceQuality.js):

scripts/smoke_source_neutrality.js asserts that nine outlets spanning the political spectrum — NYT, Breitbart, CNN, RT, Fox, Guardian, InfoWars, WaPo, MSNBC — score identically at 0.50. A court record outranks all of them. The ranking is about distance from the record, which anyone can audit, not about editorial alignment, which nobody can audit neutrally.

3.8 Six verdicts

true · false · misleading · partially_true · opinion · unverifiable

The last two are not padding. Without a home for "this is a value judgement, not a factual claim," readers vote false on framings they dislike, and a fact-check system decays into a popularity contest over framing. Most disagreement is about framing.

3.9 Contest ladder

An hourly sweep expires unanswered contests and refunds the stake in full — without it, a challenge nobody answers would hold the challenger's stake indefinitely.

L3 is the inversion worth noting: escalation does not convene experts who agree. It convenes people who historically disagree, because after two contests the community has demonstrated it cannot settle the question, and a panel selected for consensus would merely relocate the capture.

3.10 Trust is topic-scoped and windowed

Global trust lets someone accurate about football vote at full strength on medicine — which is how generalist tenure came to outrank subject expertise on Wikipedia. Trust is therefore scoped per topic and computed over a rolling window of the last 100 rated calls, so seniority cannot harden into authority.

3.11 Claim atomisation

A post contains several assertions, usually of different kinds. Forcing one verdict on the bundle is what makes people fight — they are not disagreeing about facts, they are voting on different packages.

Claims carry a kind that determines both which machinery can settle them and what a verdict can honestly mean:

A claim must quote the post verbatim. Without that rule, decomposition becomes a machine for attaching propositions the author never made and then refuting them.

Atomisation is additive: a post with no claims behaves exactly as before.

4. Identity

4.1 The rule

Identity authenticates the ACTOR. Evidence authenticates the CLAIM. They never touch.

Displaying credentials before a verdict is cast reconstructs Wikipedia capture with credentialism substituted for tenure — the PhD wins the argument by being a PhD. So credentials appear only in the post-resolution audit view, and serve as eligibility for a topic panel, never as vote weight.

4.2 The ladder [DESIGN, built, switch off]

Speech is not gated; economic and epistemic privilege is. That is the actual complaint about anonymous accounts — not that they talk, but that their word counts the same and they get paid.

The gates and the earning choke point are wired (requireIdentity on 7 routes, plus emitTokens/awardEngagement), with the switch off in src/config/identityLadder.js: no vendor account exists, so nobody could reach Level 2, and enabling it today would zero every reward rather than add security.

4.3 Identity at scale — the cost argument

The objection is that at ~$1.50 per document check, a billion users is a billion dollars. Correct — which is why the plan is not to verify a billion people.

Document identity is a cost of payout, not of acquisition. Billed against the withdrawal, once per lifetime:

A $1.50 check against a $50 withdrawal is 3% — an ordinary payment fee. Cost scales with people being paid, which is revenue-linked. Gating signup is the variant that costs a billion dollars.

Coverage, not cost, is the harder constraint. Roughly 850 million to 1 billion people hold no legal identity document at all.² Document identity therefore cannot be a participation gate without structurally excluding the poorest people on earth — which is both wrong and fatal to a platform whose claim is anti-capture. This is a stronger argument for the ladder than the economics.

4.4 The layered stack

Document checks are the last layer, and the only expensive one:

Layer 1 is where MERIT already operates. Coordination detection defends verdicts; document identity defends payouts. Different jobs — conflating them is how systems end up doing neither well.

Vouching carries two hard limits or it becomes the capture vector it was meant to prevent: bounded chain depth, and a vouch is never weight.

5. Event witness

Moving from "is this claim true" to "did this happen" — and the second question is, in one respect, easier.

Three sub-questions decide an event: is the artifact unaltered, was it captured where and when it claims, and does it show what is claimed. The first two are technical questions with technical answers. No coordinated bloc can outvote a GPS timestamp or a signed capture record. Only the third is interpretive, and it is the narrow part. Event verdicts are therefore structurally harder to capture than claim verdicts.

5.1 Provenance-first

Generated video makes detection a losing arms race. So the system never attempts to prove a video false. It requires proof that one is real, and grades the remainder down.

Absence of provenance is not an accusation. An unattested clip scores 0.30 — the same tier as a social post — because that is exactly how checkable it is. The single tier below that is provenance_failed: a signature that is invalid, or valid over different bytes than were delivered. A broken claim of proof is worse than no claim, because it attempted to borrow certainty.

On the browser limit, plainly: VIURL is a PWA, and a browser cannot attest hardware. getUserMedia proves a media stream existed in a browser, not that photons struck a specific sensor. in_app_capture is therefore scored below hardware_attested, which nothing yet produces. What in-app capture does buy is real: the server opens and closes the capture session, so both timestamps are ours and cannot be backdated; there is no file picker in the path, so an existing file cannot be substituted; and a single-use nonce prevents a session identifier lifted from a log being spent by another account.

5.2 What the anchor proves

Each artifact's SHA-256 is chained onto the previous one, the same tamper-evident primitive the ledger uses. This establishes tamper-evidence and priority in time.

It does not establish that the content is true. A perfectly anchored video can be entirely fabricated.

Stating this is not modesty; a badge implying more would mislead precisely the people it was built to protect. assertAnchorHonesty() is a runtime guard run by the test suite against the strings the API actually serves, and by the i18n script against all six locales. A future label overstating what the anchor establishes fails a check rather than shipping — and the guard is deliberately a blunt substring match, because a blunt rule cannot be argued out of.

That guard also runs against this document (§11). It rejected two sentences in an early draft of this very section, which is the intended behaviour.

5.3 Multi-witness convergence

The strongest available signal is several unrelated devices, near one place, in a tight window, showing consistent content. Fabricating that requires coordinating physical devices in one location.

Independence is computed with the same machinery as the verdict diversity quorum. Two clips from one affinity bloc are one witness, however many accounts they arrive from.

And the bonus is withheld entirely unless every pair had sufficient shared history to be judged. Absence of evidence is not evidence of independence — so on a young platform this reports "not yet corroborated" rather than a fabricated confidence number.

5.4 Witness safety

GPS, timestamp and device data are exactly what a hostile government or armed group needs to identify who filmed something. The precision that makes footage provable is the precision that makes the witness findable.

• Publish coarse, verify precise. The panel sees exact coordinates; the public sees a region (~11 km grid cell).
• Coordinates are rounded to a grid, never jittered. Independent noise averages to the true point across repeated publication; a grid is idempotent. The coarsening function refuses to operate finer than ~1 km.
• The public artifact is a derived copy with metadata stripped. The signed original stays in escrow, outside the web-served tree, and is never served.
• Delayed publication is a first-class option, so a witness need not still be present when footage goes live.
• Sanitisation fails closed: if a required transform cannot be applied, no public file is produced at all.
• The uploader's identity chain is never exposed anywhere, including the audit view.

5.5 Reward shape

Reward never scales with how graphic footage is, and there is no first-uploader bonus. Both are deliberate: the prior reward table paid 3× more for "misleading" than for "true," which subsidised alarming verdicts, and the same error here would put a price on being close to violence. Corroboration and cross-modal analysis — skilled work carrying no physical risk — pay comparably to uploading, so effort points at confirming rather than at being present.

6. The token

6.1 Supply

Six decimals rather than nine for a concrete reason: 100B × 10⁹ = 10²⁰ overflows an unsigned 64-bit integer, making the supply unrepresentable in a standard Solana SPL token. 100B × 10⁶ = 10¹⁷ fits with ~184× headroom and matches USDC's convention.

The cap's credibility is the product. A cap that code can bypass is marketing. Every positive mint routes through src/utils/emissionEnforcer.js, which reserves budget atomically before paying; when a category's daily budget is exhausted it refuses with emission_budget_exhausted. Rewards throttle — the cap never breaks.

6.2 Emission

A 120-year schedule encoded as data (src/config/emissionCurve.js), then halving every decade indefinitely. The tail is geometric with ratio ½, so total emission converges to a finite limit strictly below the cap: the curve approaches the cap and never reaches it.

Daily budgets by category:

Verification is the largest single allocation. That is the statement of what the platform is for.

6.3 Distribution

Earned only. No public sale. No pre-sale. No team allocation. No investor allocation.

This is a deliberately protected fact, and it constrains VIURL's own communications: no price talk, no targets, no "returns" language. The 2025 draft proposed a 15% team allocation with vesting and published a valuation forecast — both of which would have weakened exactly the position this protects.

6.4 Sinks

Boost (100% burn) and premium (100% burn) remove supply permanently. Tips burn 1%. Supply that leaves circulation stays gone.

6.5 Ledger integrity

• Every balance traces to a ledger row; Σ(balances + staked) = Σ(transactions).
• Per-user hash chain — tamper-evident.
• Idempotency keys — a double-tap cannot double-spend.
• Atomic multi-document writes (replica set transactions).
• Nightly reconciler posts a checkpoint, or an alert, to an operations channel.

As of 2026-07-30, drift ≠ 0 is treated as an incident, not a test artifact. The ledger reconciles to exactly zero.

7. Liquidity [DESIGN]

7.1 The problem a DEX creates

The identity ladder gates the exit — verification at withdrawal. That works only while VIURL is in the exit path. A decentralised exchange removes it: earn on a verified account, transfer to any wallet, sell. The gate becomes decorative.

And the economics invert. Internal points are tedious to farm; a priced token makes every verification a money-printing opportunity.

You cannot gate cashing out. You can only gate entering circulation.

7.2 Two states, one token

Earning stays generous. Conversion is the only throttled step, so everything that ever enters circulation passed one door.

7.3 What the door checks

(a) Identity as the denominator of a rate limit. This is identity's real function — not permission to earn, but a cap. A verified unique human converts at most $X$ per period, so a ring's total extraction is bounded by the number of real humans it controls, not accounts it runs.

Proposition 3. For a ring of $m$ accounts channelling through $k$ verified identities, maximum conversion per period is $kX$, independent of $m$.

(b) Maturation — time as the anti-farming instrument. It inverts time preference: an honest verifier does not mind waiting, because their income is their work. A farm's entire model is velocity, and capital immobilised in a position it may lose is what breaks the economics.

(c) Finality, not resolution. MERIT already moved payment from submission to resolution. Liquidity belongs at finality — contest window closed, no panel sitting, no reopen live. A verdict can resolve and later be overturned; paying then is correct because the work was done, but making it irreversible then is not.

The token becomes liquid when the truth it paid for becomes final.

The epistemics and the economics run on one clock. Money cannot exit faster than the process can correct itself — not a safety feature bolted on, the same idea expressed twice.

(d) Merit still standing. Only unconverted balance can be reversed, so the maturation window is the clawback window and must outlast time-to-detection.

7.4 Conversion vouchers, not on-chain identity

Identity stays off-chain, where it can be corrected, expired and deleted. A permanent public attestation binding a wallet to a verified human is a privacy harm that cannot be undone.

To convert, VIURL signs a voucher — (wallet, amount, expiry, nonce) — and the contract verifies the signature and that the nonce is unused. The chain learns only that a wallet may receive $N$ tokens. Never who the person is, their merit, or their jurisdiction.

7.5 Labour must out-earn capital

Never require holding tokens to earn tokens. A system that pays the already-capitalised more per unit of work is regressive, and the poorest participant — the one this is for — earns least.

Flagged in the current code: the staking simulation applies a 1.05×–1.50× multiplier to every positive emission. Harmless while points are worthless; once priced, it pays up to 50% more for the same verification to someone with idle capital. To be revisited before any mint.

Rewards should be denominated in value and paid in token — a verification worth "$0.40 of VIURL," not "2 VIURL" — so a price movement does not change what an hour of honest work is worth. The cap always wins: when a daily budget binds, rewards throttle rather than the cap breaking.

8. Security model

8.1 What is proven

8.2 What is assumed

• Affinity history is informative. Bloc detection requires shared history. Where none exists, no bloc is inferred — see §9.1.
• The blind rule holds at the API boundary. Enforced in middleware rather than the client, because hiding values that still ship in the payload is theatre. Assumes no privileged read path leaks the tally.
• Off-chain collusion is not prevented, only made unprofitable. No cryptographic mechanism stops people talking to each other. Proposition 2 removes the payoff rather than the possibility.

8.3 What is not claimed

No zero-knowledge proof system is deployed. No smart contract exists, so no contract audit exists. No custom Layer-1 blockchain exists, and none is planned — the eventual on-chain step is a standard SPL token on an existing chain. No throughput benchmark is offered, because none has been measured.

9. Known limitations

The section that makes the rest of this document worth reading.

9.1 Bloc detection needs traffic

The affinity table is nearly empty on a young platform, so every verifier appears independent and the diversity quorum passes easily. The anti-brigade property is therefore weak until real usage accumulates.

This is correct by design — absence of evidence must never be read as evidence of a bloc — but it means the strongest guarantee in §8.1 is not yet load-bearing in practice. It hardens as people use the platform. No code fixes it.

9.2 Automatic face blurring does not exist

No detection model is installed. Rectangles supplied by a reviewer can be blurred; faces cannot be found automatically. Publishing an image with people in frame is therefore a stated human decision, recorded permanently.

9.3 Small panels

At $n = 5$ the weight cap binds nothing (§3.5), and five verifiers is a thin basis for certifying a contested claim. The quorum limits the damage; it does not eliminate it.

9.4 Topic classification is keyword-based

Topic-scoped trust depends on assigning a subject to a topic, currently by keyword matching. A misclassified subject draws on the wrong trust pool.

9.5 Claims have no contest ladder

Post-level verdicts can be contested, escalated to a blind panel, and reopened. Claim-level verdicts can only be re-resolved. A wrong claim verdict is corrected by further verification, not by escalation.

9.6 Identity is designed and inert

The ladder is built with the switch off, and no vendor integration exists. Every claim in §4.2 describes code that runs but is not enabled.

9.7 The token has no external value

VIURL is an internal accounting unit today: not on a chain, not transferable between users, not redeemable. §7 is a design, and its most important property is the sequencing — economics tuned while the token is worthless, then fiat payouts from a revenue pool, and only then a mint.

10. Roadmap, in dependency order

1. Now (illiquid). Tune verification economics while errors are free. Build Earned/Liquid, maturation, clawback, per-identity conversion caps.
2. Then. Pay real money from a revenue pool through a licensed processor — payment for services, ordinary tax reporting. This proves the whole pipeline with money at stake and still no token to defend.
3. Only then. Securities counsel, and a mint.

Skipping to 3 means debugging incentive design while a market prices every mistake and a constituency of holders resists every correction. A listing cannot be un-rung.

11. Verification of this document

Claims here are checked by executable tests, not asserted:

The last one is the unusual entry. Every quantity stated here is re-derived from the configuration files and compared with the figure written above; the merit spread in §3.6 is recomputed from the live coefficients rather than trusted. It also enforces the securities posture and rejects chat-transcript artefacts, because the 2025 draft claimed a supply 100× smaller than the code enforced and nobody noticed for over a year — a document with no tests drifts silently.

A public audit endpoint exposes every input to a verdict: per-verifier weight and bloc, the quorum result, weighted totals per verdict, the merit breakdown, the full verdict history, and a live recomputation of the tamper-evidence chain. A public transparency page reports supply, circulating, burned and emission against curve without login.

References

1. Vosoughi, S., Roy, D., & Aral, S. (2018). The spread of true and false news online. Science, 359(6380), 1146–1151. ↩

2. World Bank, Identification for Development (ID4D) Global Dataset. Estimates of people lacking official proof of identity. ↩

3. Coalition for Content Provenance and Authenticity (C2PA). Technical Specification. c2pa.org ↩

Additional context, cited for the reasoning rather than for any numeric claim:

• Lamport, L., Shostak, R., & Pease, M. (1982). The Byzantine Generals Problem. ACM TOPLAS, 4(3), 382–401.
• Douceur, J. (2002). The Sybil Attack. IPTPS.
• Goldwasser, S., Micali, S., & Rackoff, C. (1989). The knowledge complexity of interactive proof systems. SIAM Journal on Computing, 18(1), 186–208. (STOC version 1985.)
• Briscoe, B., Odlyzko, A., & Tilly, B. (2006). Metcalfe's Law is Wrong. IEEE Spectrum, 43(7), 34–39. — cited because VIURL makes no network-value claim, and this is why.
• NIST SP 800-57 Part 1 Rev. 5. Recommendation for Key Management. — key-strength equivalences.

VIURL LLC · Phase 0, off-chain by design · This document describes a system in development. It is not an offer to sell securities, and contains no forecast of token value.