{"schema_version":2,"updated":"2026-10-22T15:25:37.441Z","license":"https://creativecommons.org/licenses/by/4.0/","cite_as":"Own Your Mind, \"Decentralised AI Freedom and Returns score dataset\", https://ownyourmind.ai/integrity/","attribution":"Own Your Mind (ownyourmind.ai). Link the specific project review when citing a single project.","integrity_notice":{"summary":"Each integrity record carries its own record_type, verdict and assessment_level. A 'claim' record quotes the project's own published statement; a 'reported' value is that claim, not a verified fact, unless verdict is 'match'. A 'finding' record is our own measurement and grades no one's claim. assessment_level 'not-assessed' means unchecked, never clean. Findings are dated snapshots, not a live feed.","verdicts":{"match":"verified against independent data","inflated":"reported higher than independent data shows","understated":"reported lower than independent data shows","outdated":"was accurate when reported; on-chain reality has since moved","established":"our own independent measurement; there is no project claim to grade","unverified":"independently checkable, not yet checked","unverifiable":"checked, could not independently confirm"},"record_types":{"claim":"the project's own published statement, quoted verbatim, graded against independent data","finding":"our own measurement for a score dimension; no claimant and never a verdict on a claim"},"methodology":"https://ownyourmind.ai/resources/integrity-checks/"},"slug":"nunet","markdown":"https://ownyourmind.ai/projects/nunet.md","title":"NuNet","token":"NTX","category":"compute","freedomScore":4.6,"returnsScore":2.4,"freedomGrade":"D","returnsGrade":"F","url":"https://ownyourmind.ai/projects/nunet/","integrity":{"assessment_level":"onchain-reconciled","last_assessed":"2026-09-25","emission_honesty":null,"reconciliations":[{"metric":"total_supply","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"NTX is issued on Cardano, Ethereum and BSC with no single canonical total; the Cardano leg is read directly from the chain.","independent":{"value":"429,366,478 NTX on the Cardano native-asset leg, read 2026-09-20. This is one of three legs; the cross-chain total is carried on the supply_cap_enforcement row.","source":"Cardano native asset (policy edfd7a1d...79, name NTX) total_supply via keyless Koios asset_info (wired data_sources anchor: cardano_native_supply)"},"assessed_date":"2026-09-24","severity":"info"},{"metric":"supply_cap_enforcement","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"outdated","claim_holds_up":false,"claim":{"quote":"NTX-ETH and NTX-ADA are convertible on a 1:1 basis keeping the total token supply constant at all times at 1 billion NTX","source_url":"https://docs.nunet.io/getting-ntx/multichain-token","archive_url":null,"date":"2023-08-15"},"reported":{"value":"Total supply held constant at 1 billion NTX across chains","source":"NuNet docs, Multi-Chain Token (last updated 15 August 2023)","self_reported":null},"independent":{"value":"The cap did not hold. On 2026-09-19 at 20:50:11 UTC (Ethereum block 26014055) the deployer EOA 0x863f13e5b505f1eb17803b94ec9d3daf80092165 called mint(0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe, 408,532,878.133452), taking the Ethereum leg from 591,467,122 to exactly 1,000,000,000 NTX in one transaction. The three legs now read 966,647,334 (Ethereum, after burns) + 429,366,478 (Cardano) + 12,000,000 (BSC) = 1,408,013,812 NTX against a published maximum of 1,000,000,000, so 40.8% more NTX exists than the cap allows. The minted tokens were forwarded to the MetaMask Swaps spender 0x74de5d4FCbf63E00296fd95d33236B9794016631 in 10M chunks plus one 130M chunk between 23:00 and 02:16 UTC. The same recipient address had received 8,721,530.40 FET from Fetch.ai's TokenConversionManagerV3 29 minutes before the NTX mint, which is what links the two as one attacker.","source":"eth_call totalSupply() at historical blocks via eth.drpc.org (archive) bracketing the jump; the mint log itself from eth.blockscout.com getLogs (Transfer topic, zero-address from) at block 26014055 with decoded mint(address,uint256) input; leg totals re-read 2026-09-20 from ethereum-rpc.publicnode.com, bsc-dataseed.binance.org and Koios asset_info; confirmed independently by Blockscout's own indexed total_supply for the token (966,647,334.455161)"},"assessed_date":"2026-09-24","severity":"high"},{"metric":"token_admin_surface","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"The Ethereum NTX contract is paused, freezing every transfer on that leg; admin and pause control have sat with a 2-of-3 Safe since 29 September 2026.","independent":{"value":"The pause is no longer hypothetical: paused() returns true. After the unauthorised mint the roles were rotated through the compromised admin itself. Block 26017576: DEFAULT_ADMIN_ROLE granted to a new EOA 0x78a60de4fbf1f1c2daf8c94b5e40f877032cef00. Block 26017604 (08:43:47 UTC): DEFAULT_ADMIN_ROLE revoked from the original deployer EOA 0x863f13e5b505f1eb17803b94ec9d3daf80092165. Block 26017632: PAUSER_ROLE granted to the new EOA. Block 26017641 (08:51:11 UTC): pause() called, freezing every NTX transfer on Ethereum for every holder, with no owner carve-out. That is 12 hours and 1 minute after the mint. The freeze is leg-local: the Cardano native asset and the BSC leg were not paused. The BSC leg is not out of the compromised key's reach, though: its upgrade authority still sits with that key (see bsc_upgrade_authority). Control then passed to a multisig. Block 26074970 (28 September 2026): the new EOA granted DEFAULT_ADMIN_ROLE to 0x2f17d7cc940124f539952641360b92f003c96079, a Safe v1.5.0 with a 2-of-3 threshold over three EOA signers. Blocks 26082789 and 26082798 (29 September): the EOA revoked its own admin and moved PAUSER_ROLE to the Safe. Re-read 2026-10-07: the Safe is the only DEFAULT_ADMIN_ROLE member and holds PAUSER_ROLE, the EOA holds neither, MINTER_ROLE's only member is the contract 0x6c0d706c75b559549938c0b1de863cf7f042d1cf, and paused() still returns true.","source":"eth.blockscout.com getLogs for RoleGranted / RoleRevoked / Paused on 0xf0d3...7935 (full history, 6 grants, 1 revocation, 1 pause, no unpause), plus eth_call paused() = true via eth.drpc.org, read 2026-09-20"},"assessed_date":"2026-09-24","severity":"high"},{"metric":"bsc_upgrade_authority","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"The compromised deployer key still controls upgrades of the BSC NTX token, so the BSC leg was not insulated from the September 2026 compromise.","independent":{"value":"The BSC NTX token 0x5c4bcc4dbaeabc7659f6435bce4e659314ebad87 is an EIP-1967 proxy. Its admin slot holds ProxyAdmin 0xf0d33beda4d734c72684b5f9abbebf715d0a7935, whose owner() is 0x863f13e5b505f1eb17803b94ec9d3daf80092165, the deployer EOA that minted 408.5M NTX on Ethereum on 2026-09-19. The ProxyAdmin exposes upgrade and upgradeAndCall, so that key can replace the token's implementation, currently 0xd760b2a63ccb0d7049b75abd86e0e1fd204f1d3b, which has no mint function of its own. The token's own owner() moved by 3 October 2026 from the EOA 0x78a60de4fbf1f1c2daf8c94b5e40f877032cef00 (the address that took admin of the Ethereum leg after the mint) to 0x8714330e007ccc950ca2e651035b4893d0806ed4, a Safe v1.5.0 with a 2-of-3 threshold and the same three signers as the Ethereum admin Safe. The ProxyAdmin's owner was unchanged on a 2026-10-07 re-read. BSC totalSupply() reads 12,000,000 NTX.","source":"eth_getStorageAt on the EIP-1967 admin and implementation slots, eth_call owner() on the ProxyAdmin and the proxy, getProxyAdmin(proxy), eth_getCode on both owners (empty, so EOAs) and a selector scan of the ProxyAdmin bytecode, all via bsc-rpc.publicnode.com, read 2026-09-25"},"assessed_date":"2026-09-25","severity":"high"},{"metric":"open_source_footprint","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"match","claim_holds_up":true,"claim":{"quote":"The open-source codebase is published on GitLab under Apache 2.0 license.","source_url":"https://nunet.io/","archive_url":null,"date":null},"reported":{"value":"Open-source codebase on GitLab under Apache 2.0","source":"NuNet homepage (nunet.io)","self_reported":null},"independent":{"value":"NuNet's primary code home is the GitLab group gitlab.com/nunet (group id 6160918, 30+ projects), with a GitHub mirror at github.com/nunet (11 public repos). The flagship Device Management Service (github.com/nunet/device-management-service) is Apache-2.0, not archived, and actively maintained (pushed 2026-07-20). The core platform is public under a permissive licence.","source":"GitLab API (groups/nunet) + GitHub API (nunet org + device-management-service), 2026-08-12"},"assessed_date":"2026-09-24","severity":"info"},{"metric":"liquidity_depth","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"NTX trades thinly on MEXC and a handful of DEX pools, with no tier-1 exchange listing.","independent":{"value":"5 tickers on 4 venues on CoinGecko, re-read 2026-10-13 (4 on 2026-10-07, 5 on 2026-09-29, 9 on 2026-09-24): MEXC carries 84.4% of 24h volume and Minswap on Cardano 15.4%, with WingRiders back in the set and PancakeSwap V2 alongside, both at negligible volume. Combined 24h volume is a few thousand dollars. The Ethereum Uniswap pools still do not appear, and no tier-1 CEX quotes NTX. Turnover is a 0.13% 7-day median.","source":"CoinGecko tickers (paginated) + turnover from src/data/turnover.json, read 2026-09-06"},"assessed_date":"2026-09-24","severity":"low"},{"metric":"holder_concentration","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"Across the Cardano and Ethereum legs, ten holders hold about 38% of NTX, or about 18% once exchange and infrastructure positions are excluded.","independent":{"value":"Holders merged across the Cardano and Ethereum legs, rated against all three leg supplies (1,408,013,812 NTX: 966,647,334 Ethereum, 429,366,478 Cardano, 12,000,000 BSC). Ten holders hold 38.09%, falling to 18.20% once exchange and neutral-infrastructure positions come out. The single largest is a Cardano stake key at 7.30% (103.3M NTX), unattributed. The infra share is 22.89% and is dominated by two Ethereum venues, Uniswap V4's PoolManager at 6.76% and a Uniswap V2 pair at 2.58%, which is where the attacker's newly minted NTX was sold on 19 and 20 September. Only one top-ten position is attributable to an insider: the SingularityNET Treasury Safe at 2.13%. Cardano holds 7,172 holders by stake key. Four of the top ten carry no label anywhere either chain publishes.","source":"Koios asset_addresses for the whole Cardano holder set (paged by payment_address ASC and aggregated by stake key) plus Koios asset_info for that leg's supply; eth.blockscout.com token holders and labels for the Ethereum leg; bsc-dataseed totalSupply for the unread BSC leg, all via scripts/refresh-holder-concentration.py, read 2026-09-20"},"assessed_date":"2026-09-24","severity":"medium"}],"facts":[]}}