What v2 still does not do

The pages in this section describe mechanisms that work. This one is the counterweight. It is not a roadmap and it is not softened: a reader deciding whether to trust the next revision should be deciding with these in hand, the same way Trust model asks them to decide about the current one.

What the adversarial review found

The v2 contract set was written by several agents each reviewing only its own contract, so it was given an adversarial pass over the places where the pieces meet. Four attacks were written out with numbers and made to run in the cross-contract harness. All four are closed, and none of them was patched around — each changed a mechanism, so each is described where it belongs rather than filed here: two on the waterfall and two on the claim window.

They are listed here only as an index of what to go and read, because the shape of both mechanisms is a direct result of them.

A predicate proof used to compensate victims, and a swarm of genuinely-true claims could dilute an honest one arbitrarily for the price of gas — so a trustless proof now compensates nobody. A lawful reserve withdrawal used to leave every honestly completed certificate carrying a permanently true shortfall proof anyone could file — so nothing may be filed after the settlement deadline. An ignored forged-signature claim used to buy a 72-hour freeze for gas — so an arbiter-gated claim now freezes nothing. And the arbiter used to be able to overwrite a true predicate with a false verdict — so they may now add to a predicate and never contradict it.

The review's own summary of the pattern is the useful part, and it survives all four fixes: every finding is a case where the waterfall does what it was designed to do, nobody is enriched, and the harm lands anyway. The gap in the threat model was the attacker who is content to burn somebody else's money for gas.

Two smaller items it recorded and did not rate as findings remain open. BoundExceeded has none of the guards the expiry predicate has — no check that the certificate is still verified, none that it has been superseded — and because enrolment is permanent, an agent renewed onto a fresh certificate keeps metering onto the old one until its counter passes its bound. Anyone can then file against the dead certificate and collect the flat hygiene bounty out of the forfeited-bond pool. It is bounded at one bounty per certificate, so it is a small drain for no service rendered, and the asymmetry between the two predicates looks like an oversight rather than a decision. Separately, an arbiter stating an absurdly large harm figure can wedge a window permanently, because the fee calculation is not overflow-checked — a trusted-party footgun rather than an attack, and the collateral still unwinds on the ordinary deadline.

Where the design documents and the code disagree

The design notes describe some decisions as settled that are not in the contracts. The contracts are what would be deployed, so the contracts are what these pages describe — but the gap is worth naming, because reading the design alone leaves a more reassuring picture than the code supports.

There is no allowlist of vault implementations. The certificate names its own reserve vault contract, and the operator supplies that address at publish. The design answers this with a registry allowlist of approved vault code hashes; nothing of the kind exists. In practice the attack is neutralised anyway, but by accident of wiring rather than by the allowlist: the challenge manager reads the vault address from its own initialization and never from the certificate's field, so the operator-supplied value is inert on the proof path. A future change that starts reading that field would silently reopen it.

There is no admin, no timelock and no seal. The design's answer to v1's unupgradeability is a scope-limited admin that may upgrade code and manage that allowlist, may not touch funds or settlement, acts only after a delay, and can permanently renounce. None of it is built. v2 is as unupgradeable as v1, which is a defensible position but not the one the design describes.

Two smaller ones. verify does not report whether an agent is tracked, and validity does not require it — so the most reassuring answer the protocol gives is still available to precisely the agents nobody is metering. The router can answer the question; the result type has no field for it, because adding one is a change to the certificate and therefore another redeploy. And the float cap is not on the certificate, for the same reason, so a counterparty cannot see an agent's maximum exposure where they read everything else.

One that was in this list and is now fixed, recorded because it is the reason the check exists: attest used to record an attestation without ever reading the vault, while two design documents stated that it verified the reserve. It does now, and the practical effect is that an auditor can no longer be walked onto a certificate that is already fraudulent.

Two of v1's five defects survive

The fee escrow still pays out only once. It is untouched, and the premium economy was built as a separate contract rather than an extension of it precisely because a singleton whose released flag never resets cannot serve many certificates. It remains wired into the challenge manager's initialization and is never read on the settlement path — vestigial rather than dangerous, but do not rely on it to pay an auditor.

initialize is still unauthenticated on every contract, guarded against a second call and nothing more. Between deployment and initialization any account can claim a contract by wiring it to addresses of their choosing. The two highest-value wirings after that point — naming the payment router and naming the premium vault — are one-shot and arbiter-gated, which is a real mitigation for those two calls and for nothing else.

The other three do not survive: reserve accounting is now per-certificate, publishing requires the agent's signature as well as the operator's, and every contract now extends the lifetime of the storage it writes.

The claim window's own residue

A cure is free, and that under-prices getting caught. An operator can run a persistently underfunded certificate and top it up only when challenged, using the 72 hours as free credit. A per-certificate cure counter with a fee or a forced re-attestation on repeat is the obvious next step and is not built, because pricing it without a loss history would be inventing a number.

An upheld forged-signature finding can settle against collateral that has already unwound. That is the cost of an arbiter-gated claim no longer freezing anything, and it is bounded rather than open-ended: the reserve and the allocation are locked until the certificate's own settlement deadline whatever the challenge manager does, and nothing may be filed from that deadline onwards, so the loss requires the arbiter to still be silent at a deadline the claim was necessarily filed before. It is a latency controlled by a party already trusted completely with the verdict itself.

Nobody is paid to close a window. Closing is permissionless and unrewarded; the claimants' own money is the incentive. That is sound but it is not a guarantee — a window holding only a hygiene claim has almost nothing behind it, and the certificate stays frozen until somebody spends the fee.

A trustless proof no longer compensates anybody. A predicate reads the vault, not the victims, so it can never establish who lost what — and after a sybil-dilution attack showed what happens when it is asked to try, victim compensation was narrowed to arbiter-assessed harm only. That is the correct answer and it is a real narrowing: proving harm now always requires the arbiter, which shrinks the trustless surface and puts more weight on a trusted party. A predicate proof still slashes to the treasury, still kills the certificate and still pays the challenger — and the arbiter, who is the route by which a real loss reaches the waterfall, can raise the number the contract computed but can no longer erase it.

Sybils still split the challenger fee, deliberately. That pot is a bounty for surfacing a fact rather than compensation for a loss, and its total is fixed at a percentage of proven harm however many people file — the same trade the flat hygiene bounty makes on purpose.

A genuine breach discovered after the settlement deadline is unchallengeable. Nothing can be filed once the deadline passes, whatever the proof type. That rail exists because without it every honestly completed certificate carried a permanently true shortfall proof the moment its operator lawfully reclaimed the reserve, and anyone could file it for gas and take the auditor's whole allocation. Bounding exactly this is what a deadline is for, and the alternative is collateral that can never safely unwind — but late discovery is a real class of breach and it now has no remedy.

An arbiter who overstates harm dilutes the honest claimants sharing the window, as well as enlarging the slash. The waterfall's rails still hold — nothing reaches anyone who could have bribed them — and on a predicate-backed claim the arbiter can no longer state a figure below what the contract computed. But they may still raise one arbitrarily. The figure is unbounded except by the certificate's collateral, checked against no evidence, and there is no dispute path once it is stated.

A genuine victim waits out the window. Even when theirs is the only claim ever filed.

Every number is a proposal

Not one numeric parameter in v2 is a measurement. The 72-hour claim window, the 7-day collateral lockup after expiry, the 24-hour post-expiry grace window, the fraction-of-bound floor below which a late payment is unprovable, the coverage rate, the protocol's fee share, the flat hygiene bounty, the challenger's percentage of harm — all of them are figures somebody chose, and each is its own attack surface. The grace window is free post-expiry coverage a hostile operator can plan around. The floor is a band of payments that provably breach the covenant and are unprovable anyway. The claim window is long enough to be a real cost to a victim and short enough that a claimant in a bad timezone can miss it. They need to be argued individually and they have not been.

The coverage rate is one number for every certificate regardless of the auditor, the operator or what the bound is composed of. That is deliberate — risk-based pricing needs a loss history the protocol does not have — and it means coverage is mispriced for everybody except the median risk.

Custody

Detection is out of scope. Nothing in the protocol notices a key compromise; it only bounds and stops one. The operator must be watching, and the kill switch is only as fast as they are.

The float cap is not a rate limit. It is a per-certificate constant. A thief who drains a capped float, waits for the operator to refill it, and drains it again reaches more than the cap in total. A velocity limit is the natural answer and is not designed.

A stolen key can pay a counterparty legitimately. Nothing distinguishes a thief's honest payment from the agent's, which is correct — but it means the spend counter cannot be used to date a compromise.

An operator can sweep their own agent's float at will, and clawback sweeps one named agent per call with no certificate-to-agents index. Both are covered on Custody and the agent key.

Settlement

An auditor's downside is bounded but not under their own control. The waterfall makes manufacturing a proof unprofitable; it does not make a shortfall proof costless to the auditor, and the slash goes to a treasury either way, so an attacker willing to burn their own capital can still destroy an allocation. Both ends of that have narrowed considerably — attest now refuses an unfunded certificate, the vault refuses withdrawal before the deadline, and nothing can be filed after it — which together make an attested certificate's reserve monotone for its whole life. What is left is the risk the auditor actually chose to underwrite. The candidate fixes for the residue all trade one exposure for another, and none is chosen.

A slashed auditor who claimed early loses almost nothing. Continuous claiming is deliberate and the allocation is the real consequence, but the premium forfeiture is a weak deterrent by construction rather than a strong one.

Nothing forces an operator to buy coverage. A certificate can be fully valid with no premium behind it.

A premium vault that is never wired is silently inert, and so is a router. Both are named by one-shot arbiter-gated calls; skipping the premium vault makes the forfeiture step a no-op on every challenge while the vault keeps taking money, and skipping the router turns both trustless predicates into a revert. There are public checks for both and nothing enforces that anyone runs them.

A mis-set treasury cannot be fixed. By design: making it mutable would reopen the prize the waterfall exists to remove.

The expiry predicate

It judges one payment, not a history. The router records a single post-expiry pair — the largest late payment and when it landed — so a large payment inside the grace window masks a smaller, later one that would have cleared both tests. Conservative in the safe direction, and closing it would put unbounded storage on the payment hot path.

The renewal check is coarser than the design's wording. The design says the certificate must not have been renewed before the payment; the predicate asks whether it has been renewed as of the challenge, so a renewal filed after the late payment also defeats the proof. That now resolves as a cure with the bond returned rather than costing the challenger anything, but the timing is still coarse, and it errs toward not killing a certificate.

Storage still archives eventually

Every v2 contract extends the lifetime of the entries it writes, which v1 never did — but rent is charged to whoever submits a transaction. A certificate nobody transacts against for long enough still archives, and reaching an archived entry aborts the transaction rather than returning a default. The lifetime is managed now; it is not infinite.

One integration unknown

A metered payment emits the standard transfer event plus a spend event for indexers. The x402 constraint is usually stated as exactly one transfer event, and a facilitator matching on the transfer topic is satisfied — but one requiring exactly one event in total would reject metered payments. This has not been tested against a real facilitator and must be confirmed before the router settles live traffic.