Bound
Contracts

Registry

The certificate store — publish, attest, verify.

CBM2UAVZFUI2QGZIS35VB6P3W5FYC3HW3KV3E2AF6KFQDUMFIZPPAJWV

The Registry is the certificate itself: it stores what is claimed, moves the status through its lifecycle, and answers the one read every counterparty makes.

Functions

FunctionAuthPurpose
initialize(challenge_manager, auditor_staking)onceWire dependencies
publish(operator, agent, bound, reserve_amount, expires_at, reserve_vault, auditor_staking) -> cert_idoperatorCreate a Pending certificate
attest(auditor, cert_id)auditorVerify registered → Verified; calls AuditorStaking.lock(auditor, expires_at)
verify(agent) -> VerifyResultview{valid, status, bound, reserve, auditor_stake, auditor, expires_at}
get_cert_reserve(cert_id) -> i128viewThe claimed reserve — read by the ChallengeManager
get_cert_auditor(cert_id) -> AddressviewWho vouched — read by the ChallengeManager
invalidate(cert_id)ChallengeManager onlyMark Invalid

Status

PendingVerifiedInvalid.

  • Pending — published by the operator, nobody has vouched. verify().valid is false.
  • Verified — an auditor attested, and their stake is locked to this certificate.
  • Invalid — a challenge succeeded. Terminal.

verify().valid is true only when status == Verified && now <= expires_at. An expired certificate is not invalid; it is simply no longer a claim about the present.

The one call that matters

attest is where the security model is created, not publish. Publishing is a claim. Attesting locks an independent party's money behind that claim, in the same transaction, via the Registry's call into AuditorStaking.lock. The lock extends an existing lock and never shortens one, so an auditor vouching for several certificates stays bound until the last of them expires.

Claimed, not actual

get_cert_reserve returns what the certificate says is locked. The vault's get_balance returns what is locked. Keeping those two numbers in separate contracts is what makes fraud provable by arithmetic — see ChallengeManager.

On this page