Trust model and limits

Trusted roles

You can check that the code on chain is the code in the repository: see Check the wasm yourself. The configuration has no setters; get_config returns the values fixed at init.

What a certificate means

• It proves committed capital, not good behaviour. Victims upheld by the arbiter are paid up to coverage = reserve + allocation, shared pro rata by every arbitrated victim of the certificate.
• Spend is not loss. spent is gross routed flow. bound is a meter, and spent can pass it by refilling the float.
• Credit across services can be oversubscribed. Each service limits its own credit by min(bound, coverage), but two services that each extend that much share one coverage pool.
• Only the current certificate can pay. verify(agent) returns the agent's last accepted certificate. An older one reads Superseded and cannot spend, but stays challengeable until its own settlement deadline; read it with get_cert or list_certs.
• An expired certificate is not a deal. From expires_at on, the view reads Expired with deal=false, while pay still works until the settlement deadline and is metered as post-expiry spend.

Not protected

• Harm the arbiter cannot assess off chain.
• The float drained to allowlisted recipients by a hijacked agent. It is capped by float_cap and stopped by halt (see Key confinement).
• Storage deposits, which are not refundable in this version.
• Value: mock USDC has an open mint. It is play money.

Known limitations

• Slot squatting depends on the arbiter. Freeing a squatted claim slot depends on the arbiter rejecting the junk claim in time. An arbiter that does not act leaves the slots full until the window closes, and after the deadline that still locks a late victim out. With an idle arbiter, 16 undecided claims cost the attacker only 16 half-bonds (80 USDC with the demo config).
• Refile race. A rejection frees its slot, but the attacker can refile into it in the same block, ahead of the victim. Each cycle costs one forfeited bond, yet a determined attacker can keep a late victim out until the window closes, at the latest deadline + claim_window_secs. A real fix (a bond that grows with the number of claims, or a slot held for claims after a rejection) is out of scope for the hackathon build.
• Hygiene bounty. It goes to whoever files the true predicate, which can be the operator's own sybil. It is paid from the operator's own reserve, so it is cost-neutral to the operator, and it no longer ends any liability.
• One settlement record. A certificate settled more than once keeps only the latest Settlement that moved funds in its view; the settle events carry every one. In hygiene mode auditor_returned reports the allocation that stays locked, although nothing is returned at that point.
• Conservation is not property-tested. It is proven for the pure waterfall, by one contract-level test across several windows and releases, and by hand review of the other paths, not by a property test over random call sequences.
• New view values. Halted, Superseded and deal. A client that acts only on Verified already treats them as do not deal; a client that looks for specific bad statuses has to learn the two new ones.
• Demo timers. 90 s claim window and 300 s post-expiry, so the demo runs in minutes.
• Gas allowance. When the agent key's allowance runs out, the agent cannot pay; the operator issues a new agent account and certificate.

Source: DESIGN.md, sections 7, 8 and 10.