The settlement waterfall

v1's settlement had a straightforward problem: manufacturing a true proof paid extremely well. The proofs all establish something the operator controls — the reserve balance, the agent that spends, the expiry — so the security question was never "can the arithmetic be forged" but "does manufacturing a true proof pay?" It did. A colluding operator under-funded its own certificate, challenged it, named itself as victim, and took the auditor's whole bond.

v2 replaces that with one rule applied identically to every proof type. It runs once per claim window, over every claim the window admitted.

The order, and what each step is for

Two quantities govern everything. Total harm is the sum of what the window's claims proved — see the claim window for why some claims sum and some do not. Payable is total harm capped by the collateral actually standing behind this one certificate: its own reserve plus its own allocation of the auditor's stake.

A trustless proof compensates nobody

The reserve draw is the operator's own money, and that is what made self-dealing pointless in the first place: a colluding operator naming its own address as victim moves money from its left pocket to its right. But an adversarial review found that being pointless was not the same as being harmless, and this step has since been narrowed considerably.

Nothing de-duplicates a challenger or a victim address, and an admitted claim gets its bond back — so an attacker who files extra claims that are genuinely true paid nothing for them and took a share of the victim pool for each. With three extra claims an honest victim owed a hundred dollars was paid twenty-five. The number of claims is the attacker's free parameter, so the first-resolver race had not been removed so much as converted from "whoever settles first takes everything" into "whoever files the most claims takes proportionally everything" — cheaper to run, and needing no speed at all.

The fix is not a filing fee or a cap on claims. Those price the attack; they do not remove it, because addresses are free. The fix is to stop asking a predicate a question it cannot answer.

Go back to the founding principle. A predicate-computed proof establishes that the covenant was broken, not that any particular person was harmed — which is exactly why BoundExceeded and ExpiredCertificate settle in hygiene mode and pay no victim at all. InsufficientReserve was treated differently only by inheritance from v1. So it no longer is: a predicate proof pays no victim compensation. It slashes to the treasury and pays the challenger bounty like every other trustless proof, and compensation flows only from arbiter-assessed harm, the one mechanism that can name and size a victim. The victim pot is divided by assessed harm, so a swarm of predicate claims cannot shave an assessed victim's share either.

The reserve draw itself is unchanged in size, and still leaves the vault first. Only its recipient changed: what does not go to an assessed victim goes to the treasury. That detail carries real weight — without it the operator would simply have kept the money they failed to commit, and being caught short would cost them nothing.

The consequence for naming is unchanged and now trivially safe: a named victim is a filter, not a proof, and on the predicate path naming one buys nothing at all.

The cost, stated plainly. The protocol's only trustless proof no longer compensates anyone directly. Proving harm now always requires the arbiter. That is a real narrowing of the trustless surface and it puts more weight on a trusted party — see what v2 still does not do, where the arbiter's power is an open finding.

Slashed stake goes only to the treasury

Nobody who can trigger a proof can receive the auditor's money. That single sentence is the reason the prize is gone. In v1 the slash went to an address the challenger chose, which made the auditor's stake the payout, and made the most attractive target whoever had posted the most collateral rather than whoever had committed the worst fraud.

The treasury is named once at initialize, with no admin and no upgrade path. Making it mutable would reopen the prize, and that immutability is also why a mis-set treasury cannot be fixed.

The slash is capped twice — by the harm proven and by this certificate's allocation — so a manufactured small breach cannot cost an auditor a large bond, and one bad certificate cannot destroy an auditor's whole book. Aggregating a window does not widen either cap: it is one slash against one allocation, sized by the harm of the whole window rather than of one claim.

Nothing may be filed after the settlement deadline

The reserve and the auditor's allocation both unlock at the certificate's settlement deadline — expiry plus a week — and the operator reclaiming their reserve at exactly that moment is the call the protocol invites. But the shortfall predicate is two reads and a subtraction: the claimed reserve is immutable, the balance is now zero, and it asked nothing about whether the withdrawal was the sanctioned one. From that instant every honestly completed certificate carried a permanently true proof, with harm equal to the whole claimed reserve.

Releasing the allocation is a separate call the auditor has to make themselves, with no ordering requirement between the two. So anyone at all — the operator, a competitor, a bored address — could file in the gap, re-freeze the certificate through the very claim the auditor needed to escape, and take the entire allocation to the treasury for the price of gas, with their bond returned in full because the claim was true.

The waterfall could not stop it, and that is the instructive part: it is built to stop attacks that pay, and this one does not pay. Every rail held and the auditor was wiped out anyway. The gap in the threat model was the attacker who is content to burn somebody else's money for gas.

Filing now panics once the settlement deadline has been reached, for every proof type — not just this one, because the deadline's meaning is not proof-type-specific. A window opened before the deadline is unaffected: the freeze it wrote becomes the live deadline, so joining claims still pass and it settles normally.

The cost: a genuine breach discovered after the deadline is unchallengeable. That is accepted, because bounding exactly this is what the deadline is for — the alternative is collateral that can never safely unwind.

Together with the funding check now performed at attestation, this means an attested certificate's reserve is monotone until its deadline: it can be topped up and cannot be withdrawn, so there is no window in which a third party can manufacture a shortfall proof at all.

The challenger fee is a share of harm, not of the stake

v1 paid the challenger a fifth of the auditor's live stake. That made hunting auditors profitable rather than hunting fraud — the payout scaled with how much collateral the auditor had posted and not at all with how much was actually wrong. v2 pays a percentage of proven harm, out of the reserve, never out of the stake.

Allocation, not one global stake

Underneath all of this, the auditor's stake is no longer a single pot that a slash consumes whole. The auditor holds custodied capital; each attestation allocates a named slice of it to one certificate; free stake is the difference. The auditor names the amount when they attest, because the auditor is the party pricing the risk — the contract only enforces that it is at least the minimum stake and at most their free stake. Registration is judged on free stake, which closes the v1 arrangement where one stake could back an unlimited number of certificates at full advertised collateral each.

Rounding

Every pro-rata share truncates, so the shares can sum to a stroop or two under the pool. The remainder goes to the treasury rather than to a claimant. Handing it to the largest or the first claim would make a payout depend on a tie-break, and a tie-break is ordering value — the exact thing the window exists to destroy.

Hygiene mode

When the harm is zero — computed or stated — the proof is real but nobody can evidence a loss. The certificate is invalidated, the allocation retires in full, the reserve is not touched, and the challenger receives a flat bounty out of forfeited bonds. An empty bond pool pays nothing. This is where both router-proven predicates land, and the spend counter explains why that is the only safe answer.

The arbiter states a quantity as well as a verdict

FakeSignature still cannot be settled by arithmetic. On that path the arbiter now supplies a harm figure alongside the verdict, and it feeds the same waterfall — so an arbiter-gated proof slashes exactly like an arithmetic one. A negative figure is rejected, and a verdict of "not proven" must carry a harm of zero, so a contradictory call fails loudly instead of being quietly ignored.

They may add to a predicate, and never contradict it

The arbiter's reach used to be wider than the documentation claimed. Nothing checked which proof type they were ruling on, so they could take a reserve-shortfall claim the vault itself had proved true, write it down as not proven, and — because a rejected claim is a valid key to closing the window early — end the matter on the spot. The certificate kept reading Verified, the auditor was not slashed, and the honest challenger forfeited their bond for having been demonstrably right. Censorship rather than theft, since the arbiter gained nothing directly, but it meant the only trustless proof was trustless up to an arbiter veto.

What closed it is a ratchet, not a ban. On any claim carrying an on-chain predicate the arbiter may add to what the contract proved and may never contradict it: the verdict must match what the predicate recorded at filing, and the harm may not fall below the number it computed. Raising the number stays open, because a computed shortfall is a floor on what was lost and not a ceiling. Forged signature, which has no predicate to contradict, is untouched.

Both halves of that rule are load-bearing. Constraining only the boolean would have left the veto intact in units — keeping the verdict at "proven" and writing a harm of one stroop over a thousand-dollar shortfall drops the claim out of the predicate group and shrinks the slash to nothing. A quantitative veto is the same veto.

And a ban would have cost something real, which is why it was not the fix. Victim compensation is gated on a claim having been arbitrated, and arbitrating is the only thing that sets that flag. Refusing the arbiter access to predicate-backed proof types would therefore have left the victim of a reserve shortfall with no correctly-labelled route to compensation at all — they would have had to file a forged-signature claim to describe facts that are not a forged signature. It would also have removed the documented route by which a real loss behind a hygiene-mode counter reaches the waterfall, which is the whole reason those proofs settle the way they do.

So the accurate description of the arbiter is this: they are the route by which a real loss behind a proof reaches the waterfall, and they can raise a number, but they cannot erase or invent one.

Otherwise this grants no new trust in kind: on the arbiter path the arbiter already decides whether fraud occurred at all. It does extend the trust to an amount as well as a boolean, and the amount is unbounded except by the certificate's collateral, unappealable, and checked against no evidence. What keeps it safe is the waterfall rather than the predicate — an arbiter who overstates harm still cannot direct money to anyone who could have bribed them, because victims are paid from the operator's own reserve and the slash goes only to a treasury.

What the waterfall does not close

It makes manufacturing a proof unprofitable. It does not make InsufficientReserve costless to the auditor.

An operator who publishes an under-funded certificate, walks an auditor into attesting it and then challenges it destroys their auditor's allocation. The colluders extract nothing — the slash lands in a treasury they do not control — but the auditor is out their whole allocation regardless.

Both ends of that have since been narrowed. attest now reads the vault and refuses an attestation the reserve does not cover, so an auditor cannot be walked onto a certificate that is already fraudulent; and because the vault refuses withdrawal until the settlement deadline, the operator cannot pull the reserve out afterwards either. What is left is the band the auditor is genuinely underwriting, and an auditor's downside on any certificate is bounded by their allocation.

Worth correcting, since two of the protocol's own design documents said otherwise: an attested certificate's reserve cannot be withdrawn mid-term. The vault lock always prevented it.