Automata DCAP Attestation

Web3-based Intel DCAP (Data Center Attestation Primitives) Quote Verification for EVM and Solana.

Features

• Onchain Verification - Full quote verification executed directly onchain (EVM)
• zkVM Support - SNARK proof verification via RISC Zero, SP1, and Pico
• Multi-Platform - EVM smart contracts and Solana programs
• Comprehensive Tooling - Rust libraries and CLI for quote verification, collateral management, and proof generation

Table of Contents

• Deployment Info
• Getting Started

• Architecture

• Security Audits
• License

Deployment Info

Each release contains deployment information including zkVM Program Identifiers and contract addresses.

| Version | Release Notes | |---------|---------------| | Current (v1.1) | View | | v1.0 | View |

Getting Started

Rust Workspace

The Rust workspace provides libraries for DCAP quote verification and a unified CLI tool.

Key Libraries:

• dcap-rs - Pure Rust implementation of Intel's DCAP QVL
• automata-dcap-zkvm - zkVM proof generation (RISC Zero, SP1, Pico)
• automata-dcap-verifier - High-level verification APIs

# Clone the repository git clone https://github.com/automata-network/automata-dcap-attestation.git --recurse-submodules

Build and run CLI
cd rust-crates
cargo build --release

See the Rust workspace documentation for detailed usage.

EVM Integration

Install via Foundry or npm:

# Foundry
forge install automata-network/automata-dcap-attestation
npm
npm install @automata-network/automata-dcap-attestation

See the EVM integration guide for contract integration and deployment.

Solana Integration

[!NOTE]

The Solana programs are currently in development and available for localnet testing only.

See the Solana DCAP framework documentation for architecture details and testing instructions.

Architecture

EVM Contracts

| Contract | Description | |----------|-------------| | PCCS Router | Central contract to read collaterals from automata-on-chain-pccs | | Automata DCAP Attestation | Entrypoint for quote verification; routes to version-specific verifiers | | Quote Verifiers | Version-specific verification logic (V3, V4, V5) |

Verification Methods

| | Onchain | RiscZero Groth16 | SP1 Groth16 | SP1 Plonk | |---|----------|------------------|-------------|-----------| | Proving Time | Instant | <1 min | <30s | <2 min | | Gas Cost | ~4-5M gas | 522k gas | 493k gas | 569k gas | | Execution | Fully onchain | Boundless prover | SP1 Prover Network | SP1 Prover Network |

Onchain gas: ~4M with RIP-7212 precompile, ~5M without

Security Audits

| Date | Auditor | Scope | Report | |------|---------|-------|--------| | Feb 2025 | Trail of Bits | Automata Onchain PCCS & Automata DCAP Attestation EVM (v1.0) | View | | Oct 2025 | OpenZeppelin | Jovay TEE Verifier (uses Automata DCAP Attestation) | View |

• The OpenZeppelin audit identified a PCCS Router timestamp validity issue, which has been fixed in v1.1.

[!CAUTION]

The Solana programs are not audited for production use.

License

MIT - See LICENSE for details.