The premium economy

Under v1 an auditor's compensation is an audit fee: a fixed amount, paid once, released on attestation. That prices an act of checking. It does not price the thing the auditor is actually selling, which is holding capital at risk for a period of time against a stated maximum loss.

The premium economy prices that instead. An operator buys coverage for a certificate; the money accrues to that certificate's auditor over the coverage period as yield on the capital they allocated to it; a share goes to the protocol treasury; and an auditor who is slashed for that certificate forfeits what they have not yet taken.

The price, in words

The premium is the bound, multiplied by an annual rate, multiplied by the fraction of a year the coverage runs for. Cover twice the worst case, or cover it for twice as long, and you pay twice as much. That is the whole model. A year is a flat 365 days.

The rate and the protocol's fee share are plain parameters fixed when the contract is initialized. There is no actuarial model, no risk tiering and no external underwriter — all three are explicitly out of scope, because risk-based pricing needs a loss history the protocol does not have, and inventing one in code would be a lie dressed as a model. There is also no admin, so re-pricing means a fresh deployment.

Every division truncates toward zero, in one deliberate direction: the operator is charged no more than the exact price and the auditor accrues no more than the exact figure, so the vault can never owe out more than it holds. Each error is at most one stroop. One honest consequence of that: linearity is not exact at arbitrary magnitudes — two truncated halves lose slightly more than one truncated whole.

The duration is the certificate's own life, from issue to expiry, not the time left when the operator gets around to paying. Both are immutable fields, and using the second would make the price a function of when the operator chose to buy, so an operator would wait until the instant before expiry and buy a year of coverage for a day's price. Anchoring to the issue date removes the choice: the price is fixed at publish and no transaction timing can move it.

Accrual and claiming

The premium accrues to the certificate's auditor straight-line over the coverage period — the pot times the fraction of the period elapsed, capped at the pot and frozen once the coverage closes. It is yield on staked capital, so a certificate must be attested before its coverage can be bought: there has to be an allocation for the yield to be yield on.

The protocol's share is transferred to the treasury at payment time, not held and released later. Holding it would create a second pot with its own release rules and its own way to get stuck, which is exactly what the fee escrow demonstrates. Nothing about the fee is contingent, so nothing needs deciding later, and there is no path by which the auditor can reach it.

The auditor may claim at any time, including mid-coverage. Straight-line accrual makes that the natural reading — at every instant the accrued figure is precisely payment for coverage already delivered — and making the auditor wait until expiry would be an interest-free loan from the auditor to the protocol for no security gain.

Forfeiture

When an auditor is slashed for a certificate, they forfeit the yield on it they have not already claimed. The pot splits two ways: the accrued-but-unclaimed part goes toward the window's victims, capped by the arbiter-assessed harm the operator's own reserve did not already cover; the excess over that cap, plus the entire unaccrued remainder, goes to the treasury. Since a predicate-computed proof compensates no victim, a window holding only predicate claims forfeits the whole pot to the treasury.

Paying a victim from the premium does not break the rule that victims are compensated only from the operator's own money, because the premium is the operator's money — every stroop in that pot was paid in by this certificate's operator and has not yet been handed to anyone else. It is the same left-pocket-to-right move that makes a self-dealing operator's compensation a wash. And it cannot reach the auditor's stake: the vault has no reference to the staking contract and moves only tokens it already holds.

In hygiene mode, where the proof is true but nobody is evidenced as harmed, nothing is forfeited to a victim. Accrual is frozen at the kill: the auditor keeps — and can still claim — the share they earned up to that instant, and the unaccrued remainder goes to the treasury. It is deliberately not refunded to the operator, because both hygiene predicates are manufacturable by the operator for the price of gas and a refund would make manufacturing one free.

Already-claimed yield is not clawed back, and no clawback is attempted. The money has left the contract. Writing a clawback that cannot work would be a lie in the code.

Two things this deliberately is not

It is not a second bond. A diligent auditor who claims often forfeits almost nothing on a slash. That is accepted rather than fixed: the auditor's skin in the game is their allocation, which stays fully slashable however fast they claim. Treating unclaimed premium as collateral would overstate the protocol's teeth.

It is not compulsory. Paying a premium is not a precondition of publishing, attesting or verifying, so a certificate can be fully valid with no coverage behind it, and the forfeiture step settles as a no-op for it. Making coverage compulsory is a change to the certificate itself and therefore another redeploy.

One deployment hazard worth stating, because it fails silently rather than loudly: the challenge manager learns the premium vault's address through a one-shot, arbiter-gated call. If that call is never made, the forfeiture step is skipped on every challenge while the vault goes on accepting operators' money it will never forfeit — and every contract test still passes. There is a public check for it, and nothing enforces that anyone runs it.