An AI fund you can
not only trust,
but also verify.
Helm runs the strategy inside a Nautilus enclave, publishes every decision’s reasoning to Walrus, and refuses to move LP capital on chain unless the running code is exactly what depositors audited. A tampered build is refused before a single dollar moves.
On-chain AI funds today are
black boxes.
There are three things you cannot verify, and so there are three reasons you do not deposit. The trust problem, not the returns problem, is what keeps serious capital out of on-chain AI.
- 01
Is the strategy yours?
No way to verify the code running your money is the one they advertised. A rugged or front-running variant could be swapped in after you deposited. You would not see it.
- 02
Are the reasons real?
The rationale shown in the UI could be fabricated after the trade. The model never had to produce it. You take their word for what the model was thinking.
- 03
Will it stay in its lane?
A compromised or buggy agent can exceed its risk mandate and drain the pool. You trust the operator to catch it. Most do not catch it.
Every existing solution asks you to trust an off-chain operator. Helm replaces that ask with three on-chain checks, run before any capital moves.
Three checks.
Before any capital moves.
Each problem above gets answered by a Sui primitive that does the work on chain. None of them require trusting an operator. All three run inside one transaction. Any failure aborts the whole thing.
- 01 · Code integrityNautilus
The contract checks the running code, not the operator.
Every decision carries a fresh PCR fingerprint of the exact code that produced it. The Move contract compares it to the allowlist registered at deployment. A rebuilt or modified binary yields different fingerprints. The contract refuses it.
- 02 · Decision provenanceWalrus
You read the rationale, not a summary of it.
The enclave writes the model’s reasoning to user-owned, verifiable storage. The content hash is committed on chain, bound to the attested producer. Your client re-hashes the blob and compares. The fund cannot show you a reason it did not produce.
- 03 · ContainmentObject capabilities
The mandate is enforced atomically. No off-script.
The risk mandate (per-position cap, deployed cap, drawdown halt, market whitelist) is an owned capability object. Any violation aborts the whole PTB. There is no "whoops, the agent went off-script." The agent cannot go off-script.
One transaction.
Five things must pass.
The whole cycle, from a model output to a position on Predict, lands in a single Sui PTB. Any of the five checks fails, the whole thing unwinds. There is no partial trade.
- 01Enclave
A deterministic strategy runs inside a Nautilus TEE.
An optional LLM signal is consulted as untrusted input. The deterministic engine inside the enclave decides whether and how to act. The engine is what gets attested.
- 02Sign
The enclave signs the decision with a key only it holds.
BCS-encoded payload: decision · Walrus blob ID · content hash · nonce. Signed ed25519. The signing key is registered on chain alongside the PCR fingerprint.
- 03Submit
A relayer carries the signed payload to chain.
The relayer cannot tamper. The contract refuses anything not enclave-signed. The relayer’s only job is to pay the gas and route the funded coin into Predict in the same PTB.
- 04Verify
The Move contract runs the four-check pipeline.
Attestation PCRs match the allowlist · the payload signature matches the registered enclave key · the nonce has not been used · the decision is admissible under the policy mandate.
- 05Move
Capital flows through DeepBook Predict, atomically.
Pull from the vault reserves · deposit to the PredictManager · mint the position. Same transaction. Any failure aborts every prior step. No partial state.
Tamper with the build.
Watch the chain refuse it.
The dashboard ships with an adversarial control that submits a fabricated attestation document to the contract. The PTB aborts with EAttestationNotApproved. On chain. In thirty seconds. No funds at stake.
We prove process integrity.
Not that the AI is right.
Nautilus proves the audited code ran and produced this signed output. It does not prove the strategy is profitable. We pitch precisely so you can trust the precision.
What Helm proves
- The audited code ran inside a genuine enclave.
- The decision shown to you carries that enclave’s signature.
- The reasoning blob hash is committed on chain and recomputable.
- The mandate is enforced atomically. No capital moves on a breach.
What we do not claim
- That the strategy is profitable.
- That the LLM signal is correct.
- That a perfect trade is even achievable on these markets.
- That you should deposit anything you would not lose.