{"schema_version":2,"updated":"2026-10-24T07:57:30.384Z","license":"https://creativecommons.org/licenses/by/4.0/","cite_as":"Own Your Mind, \"Decentralised AI Freedom and Returns score dataset\", https://ownyourmind.ai/integrity/","attribution":"Own Your Mind (ownyourmind.ai). Link the specific project review when citing a single project.","integrity_notice":{"summary":"Each integrity record carries its own record_type, verdict and assessment_level. A 'claim' record quotes the project's own published statement; a 'reported' value is that claim, not a verified fact, unless verdict is 'match'. A 'finding' record is our own measurement and grades no one's claim. assessment_level 'not-assessed' means unchecked, never clean. Findings are dated snapshots, not a live feed.","verdicts":{"match":"verified against independent data","inflated":"reported higher than independent data shows","understated":"reported lower than independent data shows","outdated":"was accurate when reported; on-chain reality has since moved","established":"our own independent measurement; there is no project claim to grade","unverified":"independently checkable, not yet checked","unverifiable":"checked, could not independently confirm"},"record_types":{"claim":"the project's own published statement, quoted verbatim, graded against independent data","finding":"our own measurement for a score dimension; no claimant and never a verdict on a claim"},"methodology":"https://ownyourmind.ai/resources/integrity-checks/"},"slug":"vana","markdown":"https://ownyourmind.ai/projects/vana.md","title":"Vana","token":"VANA","category":"data","freedomScore":5.3,"returnsScore":5.4,"freedomGrade":"D","returnsGrade":"D","url":"https://ownyourmind.ai/projects/vana/","integrity":{"assessment_level":"onchain-reconciled","last_assessed":"2026-09-23","emission_honesty":null,"reconciliations":[{"metric":"chain_tvl","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"DeFi capital on the Vana chain is small and has fallen through 2026.","independent":{"value":"$199,713 DeFi TVL on the Vana chain, down from $237,978 when this anchor was read on 2026-06-25 and from roughly $984,000 earlier in the year.","source":"DeFiLlama /v2/chains for [Vana] + DeFiLlama fees/vana (blockscout factory adapter)"},"assessed_date":"2026-09-23","severity":"info"},{"metric":"open_source_footprint","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"Vana's core contracts, SDK and personal-server code are public under permissive licences, but most of its repositories carry no licence file.","independent":{"value":"Re-read 2026-09-18 through the GitHub API: 74 non-fork public repositories in github.com/vana-com (101 public in total, 27 of them forks), 47 with no licence file and 44 not pushed in 180 days. The core stack is permissively licensed and active: vana-smart-contracts is Apache-2.0, personal-server is MIT and vana-sdk is ISC, all pushed on the assessment date.","source":"GitHub REST API (orgs/vana-com/repos), re-read 2026-09-18"},"assessed_date":"2026-09-23","severity":"info"},{"metric":"permission_owner_gating","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"match","claim_holds_up":true,"claim":{"quote":"Only the data owner can create or revoke grants, and consent is recorded and verifiable on chain.","source_url":"https://docs.vana.org/network/vana-l1","archive_url":null,"date":null},"reported":{"value":"Only the data owner can create or revoke grants","source":"Vana docs, Vana L1 page","self_reported":null},"independent":{"value":"Confirmed on the deployed contract. The source-verified DataPortabilityPermissions implementation (0x1473d4c66e230fd7f8c3e48a4dfc026e259c1edf, solc 0.8.24, verified on Vanascan) gates both paths on the signer: _addPermission reverts NotFileOwner(fileOwner, signer) unless the signer owns the file being shared, and _revokePermission reverts NotPermissionGrantor(permissionData.grantor, signer) unless the signer is the account that granted it. Neither path carries a role-gated or admin override. The contract is live and used: permissionsCount() returns 136,856 grants, and revocations are exercised (at least 1,000 PermissionRevoked events, where the explorer API caps the result set).","source":"Vanascan verified source for 0x1473d4c66e230fd7f8c3e48a4dfc026e259c1edf + eth_call permissionsCount() on 0xD54523048AdD05b4d734aFaE7C68324Ebb7373eF (Vana L1, chainId 1480), 2026-08-16"},"assessed_date":"2026-09-23","severity":"info"},{"metric":"consent_control_chain","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"inflated","claim_holds_up":false,"claim":{"quote":"That gives the owner of the data full control and a cryptographic guarantee: consent is enforced by the chain, not by any central party.","source_url":"https://web.archive.org/web/20260612022452/https://docs.vana.org/network/vana-l1","archive_url":null,"date":null},"reported":{"value":"Consent enforced by the chain, not by any central party","source":"Vana docs, Vana L1 page (Wayback capture of 12 June 2026)","self_reported":null},"independent":{"value":"Not supported as stated. DataPortabilityPermissions is a UUPS proxy whose _authorizeUpgrade is gated only by onlyRole(DEFAULT_ADMIN_ROLE), with no timelock, and that role is held by a single Safe v1.4.1 multisig (0x5eca5208f29e32879a711467916965b2d753baf4) with a threshold of 3 of 7. Three signatures replace the permission logic instantly, with no on-chain notice and no user exit window. This is not theoretical: the implementation behind that proxy has been replaced four times since deployment (Upgraded events at blocks 4131308 on 2025-07-24, 4426010, 4456355, 4525757 and 5363667 on 2025-10-17), and DataRegistry has been upgraded eight times, most recently at block 6519234 on 2026-01-05. Separately, both addPermission and revokePermission carry whenNotPaused, and pause() is gated on MAINTAINER_ROLE, held by a second 3-of-7 Safe (0xe6a285b08e2745ec75ed70e4fe41e61b390bbb86) that shares five of its seven signers with the admin Safe. All eight core contracts were unpaused at the time of reading.","source":"Vana L1 RPC (rpc.vana.org) EIP-1967 slots + hasRole reads on DataPortabilityPermissions 0xD54523048AdD05b4d734aFaE7C68324Ebb7373eF, DataPortabilityServers 0x1483B1F634DBA75AeaE60da7f01A679aabd5ee2c, DataPortabilityGrantees 0x8325C0A0948483EdA023A1A2Fd895e62C5131234, DataRegistry 0x8C8788f98385F6ba1adD4234e551ABba0f82Cb7C, TeePool 0x3c92fD91639b41f13338CE62f19131e7d19eaa0D, DLPRegistry 0x4D59880a924526d1dD33260552Ff4328b1E18a43, QueryEngine 0xd25Eb66EA2452cf3238A2eC6C1FD1B7F5B320490, ComputeInstructionRegistry 0x5786B12b4c6Ba2bFAF0e77Ed30Bf6d32805563A5; Safe getThreshold()/getOwners()/VERSION(); Vanascan Upgraded logs, 2026-08-16"},"assessed_date":"2026-09-23","severity":"high"},{"metric":"core_contract_control","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"inflated","claim_holds_up":false,"claim":{"quote":"Core contracts (DataPortabilityPermissions, DataPortabilityServers, DataPortabilityGrantees) are upgradeable through governance with timelocks.","source_url":"https://docs.vana.org/security/overview","archive_url":null,"date":null},"reported":{"value":"Core contracts upgradeable through governance with timelocks","source":"Vana docs, Security overview","self_reported":null},"independent":{"value":"Stage G0 across the whole core stack. All eight core contracts are UUPS proxies (EIP-1967 admin slot zero) and every one of them names the same 3-of-7 Safe (0x5eca5208f29e32879a711467916965b2d753baf4) as DEFAULT_ADMIN_ROLE, which is the sole gate on _authorizeUpgrade. There is no timelock anywhere in that path and no on-chain governance contract executes through it. A second 3-of-7 Safe (0xe6a285b08e2745ec75ed70e4fe41e61b390bbb86) holds MAINTAINER_ROLE (pause, parameter and trusted-forwarder updates) and shares five of seven signers with the first, so the two Safes are not separation of duties: the same three shared signers can act on both. Signer identities are not published.","source":"Vana L1 RPC hasRole + EIP-1967 slot reads across DataPortabilityPermissions 0xD54523048AdD05b4d734aFaE7C68324Ebb7373eF, DataPortabilityServers 0x1483B1F634DBA75AeaE60da7f01A679aabd5ee2c, DataPortabilityGrantees 0x8325C0A0948483EdA023A1A2Fd895e62C5131234, DataRegistry 0x8C8788f98385F6ba1adD4234e551ABba0f82Cb7C, TeePool 0x3c92fD91639b41f13338CE62f19131e7d19eaa0D, DLPRegistry 0x4D59880a924526d1dD33260552Ff4328b1E18a43, QueryEngine 0xd25Eb66EA2452cf3238A2eC6C1FD1B7F5B320490, ComputeInstructionRegistry 0x5786B12b4c6Ba2bFAF0e77Ed30Bf6d32805563A5, 2026-08-16"},"assessed_date":"2026-09-23","severity":"high"},{"metric":"revocation_pause_authority","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"match","claim_holds_up":true,"claim":{"quote":"Users can revoke any grant at any time.","source_url":"https://docs.vana.org/security/overview","archive_url":null,"date":null},"reported":{"value":"Users can revoke any grant at any time","source":"Vana docs, Security overview","self_reported":null},"independent":{"value":"True today, conditional in the contract. revokePermission and revokePermissionWithSignature both carry the whenNotPaused modifier in the verified deployed implementation (0x1473d4c66e230fd7f8c3e48a4dfc026e259c1edf), and pause() is gated on MAINTAINER_ROLE, held by a 3-of-7 Safe. Three signatures suspend a user's ability to withdraw consent, for as long as the pause stands. paused() returned false on all eight core contracts when read, so the immediate-effect claim holds in the live state; the authority to suspend it exists and sits off the user's side.","source":"Vanascan verified source for 0x1473d4c66e230fd7f8c3e48a4dfc026e259c1edf + paused() reads across DataPortabilityPermissions 0xD54523048AdD05b4d734aFaE7C68324Ebb7373eF, DataPortabilityServers 0x1483B1F634DBA75AeaE60da7f01A679aabd5ee2c, DataPortabilityGrantees 0x8325C0A0948483EdA023A1A2Fd895e62C5131234, DataRegistry 0x8C8788f98385F6ba1adD4234e551ABba0f82Cb7C, TeePool 0x3c92fD91639b41f13338CE62f19131e7d19eaa0D, DLPRegistry 0x4D59880a924526d1dD33260552Ff4328b1E18a43, QueryEngine 0xd25Eb66EA2452cf3238A2eC6C1FD1B7F5B320490, ComputeInstructionRegistry 0x5786B12b4c6Ba2bFAF0e77Ed30Bf6d32805563A5, 2026-08-16"},"assessed_date":"2026-09-23","severity":"medium"},{"metric":"onchain_consent_usage","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"match","claim_holds_up":true,"claim":{"quote":"Create, revoke, and verify consent onchain.","source_url":"https://docs.vana.org/network/vana-l1","archive_url":null,"date":null},"reported":{"value":"Consent created, revoked and verified on-chain","source":"Vana docs, Vana L1 page","self_reported":null},"independent":{"value":"The consent rail is in use. permissionsCount() on 0xD54523048AdD05b4d734aFaE7C68324Ebb7373eF returns 136,856 grants, and revocation is exercised: at least 1,000 PermissionRevoked events, a floor because the explorer API caps the result set. For scale, the Vana L1 itself reports 1,605,807 addresses and 72,141,399 transactions.","source":"eth_call permissionsCount() on 0xD54523048AdD05b4d734aFaE7C68324Ebb7373eF + Vanascan log and chain-stats APIs, 2026-08-16"},"assessed_date":"2026-09-23","severity":"info"},{"metric":"chain_gas_fees","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"Gas paid on the Vana L1 is small, and Vana publishes no protocol-revenue figure.","independent":{"value":"$2,348 in L1 gas fees over the trailing year, against $24,557 cumulative since launch and $145 in the trailing 30 days.","source":"DeFiLlama chain-fees module for Vana"},"assessed_date":"2026-09-23","severity":"info"},{"metric":"liquidity_depth","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"VANA trades on Binance and other large centralised venues, but Coinbase and Kraken do not list it.","independent":{"value":"Binance, Bybit, KuCoin, Gate, Bitget, MEXC, Upbit and Bithumb all quote VANA, across 26 tickers on 23 venues on CoinGecko, re-read 2026-10-20 (30 on 25 venues on 2026-09-06, when CoinEx was also listed), with Binance top at 31.0% of volume and Upbit second. Coinbase returns NotFound for VANA-USD while the same call resolves IO-USD as online, and Kraken does not list it. Turnover is a 2.66% 7-day median.","source":"CoinGecko tickers (paginated) + turnover from src/data/turnover.json, read 2026-09-06"},"assessed_date":"2026-09-23","severity":"low"},{"metric":"holder_concentration","assessment_level":"onchain-reconciled","record_type":"finding","verdict":"established","claim_holds_up":false,"finding":"Ten addresses hold 81.63% of native VANA, and nine of them carry no explorer label.","independent":{"value":"Native VANA top-10 is 81.66% of the 113,371,835 coin supply, and 81.63% survives the infrastructure exclusion because only one contract appears in the top ten, at 2.15%. The largest address holds 29.55% and the second 13.74%. 9 of the ten carry no label on the Vana explorer, so the insider share of 0% records absence of attribution rather than a measurement.","source":"Vana Blockscout rich list via scripts/refresh-holder-concentration.py, classified by coldstart.sources.holders, read 2026-09-06"},"assessed_date":"2026-09-23","severity":"high"},{"metric":"supply_cap","assessment_level":"onchain-reconciled","record_type":"claim","verdict":"match","claim_holds_up":true,"claim":{"quote":"The total supply of VANA is capped at 120 million tokens","source_url":"https://docs.vana.org/network/vana-token","archive_url":null,"date":null},"reported":{"value":"120,000,000 VANA cap","source":"Vana docs, VANA token page","self_reported":null},"independent":{"value":"The cap is not breached: native coin supply on the Vana L1 reads 113,388,527 VANA (2026-09-20) and the Ethereum ERC-20 leg 83,018, so 113.47M exists on-chain against a 120M cap.","source":"vanascan.io stats ethsupply (native coin) + Ethereum RPC totalSupply() on 0x7ff7...a2c0, read 2026-09-20; docs.vana.org/network/vana-token for the cap"},"assessed_date":"2026-09-23","severity":"low"}],"facts":[{"metric":"users","assessment_level":"onchain-reconciled","kind":"limit","flag":"unmeasurable","positive_control":false,"severity":"low","detail":"The 1.3M user figure is not fully independently verifiable; on-chain DeFi TVL on the Vana chain is ~$238K (DeFiLlama, 2026-06-25), thin relative to the claimed user base.","assessed_date":"2026-06-25"}]}}