quantum-compute-mempool: claim_reward pays frozen ranking, not current OrderSolutions; runtime VM is NoOpVm

Title: quantum-compute-mempool: claim_reward pays frozen ranking, not current OrderSolutions; runtime VM is NoOpVm

Summary

Submitted spins are re-scored with energy_of_solution_indexed at submit time, so a solver cannot invent an energy number on first submit.

Two gaps:

1. Bait-and-switch. OrderSolutions is replaced on every submit_solution. Ranking (OrderFrontRunner / OrderTopSolvers) is monotonically improved and is not recomputed from storage at claim. A solver can submit a strong solution, wait until rivals cannot beat the deadline, then overwrite OrderSolutions with garbage. claim_reward still pays the old energy.

2. NoOp VM. Job specs may carry validation_program / transform_program. Production runtime wires type VM = NoOpVm: transform is identity, validate_result always Ok(()). Those hashes are never executed. MinerType is self-asserted; register_solver has no deposit.

Impact

A registered solver can collect a proposer's full reward for a score that no longer matches the stored artefact. Overlay (2) is an acknowledged v0 shim. Overlay (1) is a logic bug even with NoOpVm.

Toy: pot 100, SingleBest. Attacker submits energy -1000, becomes front-runner. Near expiry, resubmits junk. Leaderboard still says -1000. claim_reward pays 100. Stored solutions no longer match the paid energy.

Suggested fix

• On resubmit, either forbid overwrite or re-rank from the new energy (including demotion).
• At claim_reward, re-score OrderSolutions and pay that, or freeze the winning payload in a separate map at first ranking.
• Wire a real QuantumVm that runs the referenced programs, or drop the program fields until then.
• Treat MinerType as untrusted for Bid mode.

Files

• quip-validator/pallets/quantum-compute-mempool/src/lib.rs (OrderSolutions overwrite, claim_reward)
• quip-validator/pallets/quantum-compute-mempool/src/xqvm.rs (NoOpVm)
• quip-validator/runtime/src/configs/mod.rs (type VM = NoOpVm)

Start in quip-validator/pallets/quantum-compute-mempool/src/lib.rs by tracing OrderSolutions updates through submit_solution and claim_reward. Then inspect xqvm.rs and runtime/src/configs/mod.rs to confirm how NoOpVm is wired. Done means the paid reward matches the winning stored artefact and the validation-program behavior is explicitly addressed.