Lock a bounty against a statement. Anyone submits a proof. Lean's kernel checks it and either accepts or doesn't. No oracle, no committee, no vote — the answer is computable by anyone with a laptop, and every honest checker gets the same one.
Hard to produce, trivial to check. A proof can cost months of research or thousands of GPU-hours. Verifying it costs a laptop a few seconds. Same shape as proof-of-work — except the expensive artifact is worth something afterwards.
Everything else chains adjudicate is fuzzy — a price, an outcome, a judgement. This isn't. Two honest verifiers can't disagree, because they aren't forming an opinion. They're running a kernel.
Protocols holding tokenized RWAs. "We looked hard and found nothing" is what an audit sells. "No exploit exists" is what a proof sells. Only one is provable, and nobody is selling it yet.
PostLock $ARISTOTLE against a Lean theorem statement. The statement is the spec and it's frozen at post time.
SolveResearchers, prover models, or people driving prover models submit proof terms against it.
CheckStatement elaborated in a clean module the solver can't touch. Proof typechecked. Axiom dependencies audited.
PayFirst submission that survives all three takes the pot. Artifact is public and re-verifiable forever.
Prizes locked in $ARISTOTLE for the bounty's duration. Honest caveat: a poster could denominate in stables instead, so this sink alone would be decoration.
Attesting requires stake. Sign off on something that doesn't typecheck and the bond goes to whoever proves you wrong. You can't verify without holding it, and that can't be routed around.
Every settled bounty pays a protocol fee, routed to buy-and-burn and to verifier stakers. Scales with real throughput, not with narrative.
Bonded verifiers attest on-chain with a challenge window. Anyone may re-run the kernel locally and dispute. Unlike most optimistic systems the disputed question is objective and cheap to recompute — a liar can't recruit honest confusion, because every independent checker gets the same answer.
Lean's trusted kernel is ~10k lines. Running it inside a zkVM to prove this term typechecks against this statement is engineering, not research. Verification becomes fully on-chain and the trust assumption disappears.