Economics

What the protocol's parameters do to the people who have to act on them, measured against the code that enforces them.

This file is generated. cargo run -p truth-sim --release -- --markdown > docs/ECONOMICS.md rebuilds it from crates/truth-sim, which reads every number out of truth-core. Edit the scenarios, not this file. The build plan asks (section 8) for each simulation to produce a pass or fail against a stated invariant and a parameter recommendation; that is what the tables below are.

13 scenarios, 29 invariants, 0 open.

At a glance

Parameters these turn on

Scenarios

Whale buys stake before a vote

Holds — no single identity can buy a panel or overturn the assembly

• 10% of all stake, one identity: 0.000% of first panels, 0.000% of grand panels
• 30% of all stake, one identity: 0.000% of first panels, 0.000% of grand panels
• 50% of all stake, one identity: 0.000% of first panels, 0.000% of grand panels
• assembly override: 2x the honest revealed weight
• why: sqrt(stake) for selection, and a per-identity cap of 5% on both the draw and the assembly tally

Hold. StakeParams::cap_bps at 500. It is the binding constraint in both places: the sqrt alone flattens a whale's odds but does not bound them, and the assembly tally has no sqrt at all.

Sybil splits stake across wallets

Holds — splitting stake buys no supermajority the ladder does not take back

• 30% of all stake, 6 identities: 0.000% of first panels, 0.000% of grand panels
• 30% of all stake, 20 identities: 0.200% of first panels, 0.000% of grand panels (never once in the grand panel draws)
• what the sqrt does not do: a 9-way split weighs 3.0x one identity of the same stake: sqrt weighting is not sybil resistance

Hold. the per-identity cap and the panel ladder together. The compounding across rounds is doing the work the sqrt is often credited with; shortening the ladder would cost more than the numbers above suggest.

Regional cartel controls a tag pool

Holds — the seats reserved for a tag cannot, on their own, carry a round

• panel 7: reserved tag seats: 4, against the 5 that carry a round at any turnout (quorum is 5)
• panel 11: reserved tag seats: 7, against the 8 that carry a round at any turnout (quorum is 8)
• owns the tag pool: carries a 5-seat round: 0.000%
• owns the tag pool: carries a 7-seat round: 2.700%
• owns 9 of 12: carries a 5-seat round: 0.000%
• owns 9 of 12: carries a 7-seat round: 0.525%
• owns the tag pool: carries the 15-seat grand panel: 3.800%
• largest reservation that never decides alone: 5700 bps (57.00%)

Hold. CourtParams::tag_matched_bps at 5500 bps (55.00%), against the 5800 bps (58.00%) where the reservation would start carrying rounds on its own. The margin is one seat at seven, so this is not a number to round up: at 5800 bps (58.00%) the reserved seats alone reach the threshold and a cartel holding the tag pool wins without contesting a single seat. Regional questions still get a regional majority of every panel — they just stop getting a regional verdict.

Holds — escaping a captured tag pool costs the honest side no more than an order of magnitude over the request's own bonds

• request: long-tail regional question, T0
• proposer + disputer bonds: 60.00 USDC
• appeal to the 15-seat grand panel: 120.00 USDC
• appeal to the assembly: 600.00 USDC
• assembly bond / request bonds: 10x
• what sets it: the 5000.00 USDC floor, capped at 10x this request's bonds; 4x bonds would be 240.00 USDC
• the same floor on a T4 request: 720000.00 USDC

Hold. CourtParams::assembly_min_bond_cap_x at 10. The flat 5000.00 USDC floor is the right shape — the assembly is the most expensive thing the protocol runs and the bond is what stops it being called for sport — but on its own it was 83x a long-tail request's entire bond stack. Since the assembly is the only rung a tag cartel cannot reach, that made the capture final in exactly the markets it is cheapest to capture. Capping the floor against the request keeps the deterrent where the money is and the escape open where it is not.

Council economics

Holds — a council member is never out of pocket for a minority view nothing overturned

• what a member has at stake: 500.00 USDC of bond and nothing else — a council is a venue's team and is paid by the venue, so there is no settlement share here and no reward for the slash to be held proportionate to
• dissenting from a ruling that stands: 0.00 USDC — the request's final answer is the council's own ruling, so a dissenter has not been shown to be wrong by anything
• dissenting from one the assembly overturns: 50.00 USDC (1000 bps (10.00%) of bond) — here something did test it, and they were right to dissent only if they dissented the other way
• not voting at all: 150.00 USDC (3000 bps (30.00%) of bond), whatever the answer turns out to be — absence is the one thing about a member that needs no referent to judge

Hold. council_slash_bps as a rule distinct from a juror's. A juror is measured against an outcome other people reached; a council member on an unappealed ruling is measured against their own body's. Charging 1000 bps (10.00%) for that reading would price disagreement rather than error, and on a three-member council the cheapest strategy for everyone would be to guess the majority and vote it — turning a body built to put named reasoning on the record into a coordination game. Absence still costs 3000 bps (30.00%) because it is a failure to do the job whatever the answer, and dissent from a ruling the assembly actually overturned still costs 1000 bps (10.00%) because something tested it.

Holds — appealing a captured council costs no more, relative to the question, on a small market than a large one

• what a colluding majority risks: 100.00 USDC — 2 of the 3 members at 500.00 USDC of bond each, and only if the assembly overturns them. A council nobody appeals risks nothing, which is the trade the policy exists to make rather than a hole in it
• appealing on the T0 question: 600.00 USDC against 5000.00 USDC of open interest — 12.000%
• appealing on the T2 question: 5200.00 USDC against 50000.00 USDC of open interest — 10.400%
• what the flat floor alone would have cost: 5000.00 USDC either way, which on the small question is 100.000% of everything at stake
• what none of this reaches: a non-appealable council. Its ruling is final, so there is no escape to price, and the protection is the public record and the venue's own reputation rather than anything the protocol enforces

Hold. assembly_min_bond_cap_x at 10x, which does the same job here as it does for a cornered tag pool. A council is captured by capturing the venue that appoints it, and no bond a member posts changes that: 100.00 USDC at risk against a 50000.00 USDC market is a rounding error, and against a final council it is nothing at all. What the protocol can hold is the escape, and the cap is what keeps it proportionate — 12.000% of the question on the small one against 10.400% on the large, where the flat 5000.00 USDC floor alone would have made the small one unappealable. Read this as the boundary of the policy, not as its defence: a venue that wants its council checked sets appealable, and one that does not is asking to be trusted.

Reputation over time

Holds — a reliable verifier on a long-tail tag reaches, and holds, the gates the long-tail mechanisms sit behind

• what the tag's disputes supply: 63 panel seats a quarter — 180 requests, 500 bps (5.00%) disputed, 7 seats each — which is 1.00 draws for each of the 63 verifiers holding the tag, sharing evenly
• what that alone reaches: reputation 0 however long they keep at it: the attestation gate at 20 is never, inside 40 quarters, the reduced-stake gate at 50 is never, inside 40 quarters. Decay compounds on the whole balance and accrual is one point a seat, so the two balance at about nine times the draws per quarter — and below one draw a quarter integer decay takes the point straight back, pinning a verifier at zero
• what answering adds: 6 a quarter through credit_proposer, which a verifier can work towards instead of waiting to be drawn — 7.00 events a quarter all told
• reaching the gates that way: 4 quarters to attest, 19 quarters for the reduced stake, settling at reputation 54
• where the chain applies this: on read, at every gate, 1000 bps (10.00%) a quarter since the stored number was last settled — the account decay has to catch is one nobody is writing to. Per tag, so working one region does not keep a verifier's standing in another alive
• what being wrong costs: 2 points for an overturned answer against 1 for one that stands, and 3 for a reveal never sent — so volume without accuracy moves a verifier backwards

Hold. credit_proposer as the second source, with aligned_gain at 1 against decay_bps_per_quarter at 1000 bps (10.00%). The two numbers only work together, and the reason is the shape of decay rather than its size: it compounds on the whole balance while accrual is a flat point per event, so a verifier settles at about nine times their events per quarter and no amount of patience moves that ceiling. On the tag's disputes alone that ceiling is 0, under both gates — the attestation shortcut and the reduced-stake path were gated behind a reputation the long tail does not produce, which is the opposite of what plan 3.9 built them for. Answering is what a quiet tag does produce, and paying it lifts the ceiling to 54. Cutting the decay instead would have worked too and would have been worse: it rewards sitting still, and the discount is supposed to price a current record.

Lazy jurors never reveal

Holds — at a 90% reveal rate every tier panel reaches quorum at least 95% of the time

• panel 7: misses quorum at 90% reveal: 2.569% (needs 5 of 7)
• panel 11: misses quorum at 90% reveal: 1.853% (needs 8 of 11)
• panel 7: reveal rate for a 95% quorum: 87.124%
• panel 11: reveal rate for a 95% quorum: 86.492%
• absence alone pushes T0 to the assembly: 0.151%
• slash: abstain / wrong / absent: 0 bps (0.00%) / 1000 bps (10.00%) / 3000 bps (30.00%)
• turnout each size actually demands: 7: 71%, 11: 73%

Hold. the panel sizes the tier table now draws. Every one of them clears a 95% quorum at a 90.000% reveal rate, the worst at 2.569%. The sizes matter more than they look: a nine-seat panel needs seven ballots, a harder turnout than either seven or eleven seats ask for, so a tier moved to nine to save two juror fees would quietly buy back the liveness problem. The slash ladder needs no change either — absence is already punished harder (3000 bps (30.00%)) than being wrong (1000 bps (10.00%)), and abstaining is free, so a juror who does not know is better off saying so than vanishing.

Holds — jurors who stay home cannot lower the number of votes it takes to decide a round

• panel 7: votes that decide: 5 of 7, at any turnout from the 5 quorum upward (over ballots cast it would be 4 at quorum)
• panel 11: votes that decide: 8 of 11, at any turnout from the 8 quorum upward (over ballots cast it would be 6 at quorum)
• what it would have cost an attacker: nothing: a bloc needed only the rest of the panel to be absent, which is the one juror behaviour the protocol already expects to see
• what the fix costs when turnout is good: nothing: a panel whose revealed ballots agree still decides at the quorum, so the liveness measured above is unchanged

Hold. decide() taking the supermajority over the seats rather than over the ballots cast. It reads like a rounding detail and it is the difference between four jurors and five carrying a seven-seat round. Any change that reintroduces a turnout-dependent denominator — including 'just use revealed, we have a quorum anyway' — hands that vote back.

Griefing proposer on long-tail markets

Holds — a griefer cannot hold a request open, or force it to expire, at no protocol cost

• request: long-tail regional question, T0
• tier window: 2.0 h
• proposer bond per cycle: 30.00 USDC
• TooEarly answers the griefer gets: 3 — max_too_early is 3, and propose() refuses the next one
• delay bought: 12.0 h, against the 14.0 days a request may stay open
• collateral the protocol kept: 0.00 USDC
• capital tied up: 7.5 USDC-days, about 0.0021 USDC at 10%/yr
• how it ends: the request is still live and answerable: running the clock out is no longer something a proposer can do alone
• what it costs to answer instead: the griefer's next answer names an outcome, and a wrong one loses the bond: 18.00 USDC to the first honest disputer

Hold. RiskParams::max_too_early at 3. TooEarly has to stay free — a question that genuinely is not knowable yet should cost nothing to say so — and free is exactly what makes it a griefing tool, so the bound is the only thing standing between the two. At 3 the delay a proposer can impose alone is 12.0 h; unbounded it was 14.0 days, which is the whole life of the request and a refund at par on a market they were going to lose. The count was already tracked and emitted before this; it just was not read.

Holds — no tier asks a juror to be right more often than the slash cap allows

• T0 (7 seats): fee 0.71 USDC against 2.14 USDC at risk: worth serving from 75.000% accuracy
• T1 (7 seats): fee 2.85 USDC against 8.57 USDC at risk: worth serving from 75.000% accuracy
• T2 (7 seats): fee 14.28 USDC against 10.00 USDC at risk: worth serving from 41.170% accuracy
• T3 (11 seats): fee 45.45 USDC against 20.00 USDC at risk: worth serving from 30.550% accuracy
• T4 (11 seats): fee 181.81 USDC against 20.00 USDC at risk: worth serving from 9.900% accuracy
• the cap: 3x the round's reward
• accuracy that implies: 75.000%
• without the cap: T0: 93.330%, T1: 77.770%, T2: 41.170%, T3: 30.550%, T4: 9.900%
• T0 commit + reveal a juror sits through: 36.0 h
• why not raise the fee instead: a T0 bond of 250.00 USDC would pay its own panel what the uncapped slash risked — over seven times the 25.00 USDC the plan fixes as the long tail's cost floor. The fee cannot be raised to meet the slash on this tier, so the slash comes down to meet the fee
• what a juror is actually paid today: 0.71 USDC at the T0 bond floor, now that settle() sets the deciding round's share aside and the court draws it down. Before the payout path existed this was 0: Party::Jurors went to the treasury

Hold. CourtParams::misaligned_slash_cap_x at 3. It is the only thing tying the two halves of a juror's payoff together: the fee is a share of the request and the slash a share of their stake, and nothing else stops those drifting apart by tier. Raising it puts the long tail back where it was, at 93.330% accuracy before serving pays. Note what it does not fix — a T0 juror still earns 0.71 USDC for 36.0 h of commit and reveal, which is a question about whether the long tail can staff a court at all, not about whether the odds are fair once they do. The plan's own answer to that is the low-coverage tag subsidy in 3.9 (create_tag_subsidy), whose juror bonus is priced under the long-tail question below.

Ambiguous question

Holds — a juror who cannot answer is at least as well off saying so as guessing

• request: ambiguous question, T2
• panel and threshold: 7 seats, 5 agreeing to decide
• paid for joining the winning side: 26.00 USDC
• lost for joining the losing side: 10.00 USDC
• paid when the round rules Unresolvable: 65.00 USDC
• expected value of a coin-flip guess: +8.00 USDC
• expected value of abstaining: +65.00 USDC
• the mechanism, when jurors do abstain: 5 of 7 → Decided(Unresolvable); one fewer → NoSupermajority
• Unresolvable forfeit, and the panel's share of it: 162.50 USDC at 4000 bps (40.00%)
• the share that makes it hold at any bond size: 2461 bps by this fixture's arithmetic; v0 sets 4000 bps (40.00%) from the ratio, which covers every bond rather than this one
• who actually receives it today: the panel that ruled. settle() sets Party::Jurors aside for the deciding round the court names, and its jurors draw it through pay_juror_share. Only a ruling no panel made — a council's, the assembly's, or a ladder that ran out or timed out — goes to the treasury

Hold. SettlementParams::unresolvable_jurors_bps at 4000 bps (40.00%). It is the only juror payment not funded by a slash, and it exists because an Unresolvable ruling slashes nobody: without it the panel that correctly reports a question has no answer is the one panel that works for free, and guessing is worth +8.00 USDC against nothing. The value is derived from jurors_bps and unresolvable_penalty_bps rather than picked, so changing either wants it re-derived — truth-core's abstaining_pays_at_least_as_well_as_guessing is what catches that.

Holds — no round resolves a question on less than the supermajority it takes to resolve any other

• panel, split 3/3/3 of 9: NoSupermajority
• assembly, split 34/33/33 with no standing answer: Unresolvable on 3400 bps (34.00%) of the weight
• assembly, same split with a standing answer: Index(1) — the supermajority test runs, and nothing clears it
• assembly, 70/30 with no standing answer: Index(1) — two thirds still names an answer
• how a request gets there: two panel rounds that escalate on NoSupermajority, which is the escalation an ambiguous question is most likely to produce

Hold. the supermajority test on the prev = None branch of decide_assembly. That branch is reached exactly when both panels failed to find two thirds — the strongest evidence the ladder ever collects that a question has no answer — so a plurality of 3400 bps (34.00%) must not be allowed to name one. Overturning a standing answer and creating one from nothing now take the same two thirds, and a split assembly says Unresolvable, which is what the whole ladder had been arguing.

Attestation economics

Holds — proposing an answer pays at least as well as co-signing it, on every tier

• what each side is paid: the proposer 7500 bps (75.00%) of the reward whatever co-signs, each seat 666 bps (6.66%) — the 2000 bps (20.00%) pool split 3 ways — whether or not the others fill
• by tier, at the accuracy each needs: T0 (25.0000 USDC reward, 30.0000 USDC bond, 3.0000 USDC seat stake): proposing from 61.530%, co-signing from 64.280%, disputing from 41.810%, T1 (100.0000 USDC reward, 140.0000 USDC bond, 14.0000 USDC seat stake): proposing from 65.110%, co-signing from 67.740%, disputing from 43.880%, T2 (250.0000 USDC reward, 650.0000 USDC bond, 65.0000 USDC seat stake): proposing from 77.610%, co-signing from 79.590%, disputing from 50.880%, T3 (1250.0000 USDC reward, 3750.0000 USDC bond, 375.0000 USDC seat stake): proposing from 80.000%, co-signing from 81.810%, disputing from 46.600% and T4 (5000.0000 USDC reward, 20000.0000 USDC bond, 2000.0000 USDC seat stake): proposing from 84.210%, co-signing from 85.710%, disputing from 48.850%
• where the two bets are equal: a seat stake of 888 bps (8.88%) of the bond. The stake is 1000 bps (10.00%), so co-signing is the slightly worse bet everywhere and answering first is what pays

Hold. attester_stake_bps at 1000 bps (10.00%) against a seat of 666 bps (6.66%) of the reward. The seat's bet and the proposer's are the same bet, so what matters is the ratio: stake over bond has to stay at or above seat over quote, 888 bps (8.88%) today. Raise attester_reward_bps or cut max_attestations and the line moves up with it. Before seats, the first attester took the whole pool and needed to be right less often than the proposer on every tier, which paid the second mover to wait.

Holds — co-signing is hardest to justify on the questions whose window is worth most

• what the shortcut sells: up to 3 seats, each cutting 2500 bps (25.00%) off what is left of the window and none sold once the window is at its floor of 2500 bps (25.00%) of itself, 0.5 h at the least
• a seat is worth taking from: T0 64.280%, T1 67.740%, T2 79.590%, T3 81.810% and T4 85.710%
• why the bar moves at all: the stake is 1000 bps (10.00%) of a bond that starts at a tier floor, and the pay is a seat of a reward that is pure open interest. The floor is what makes the big question dearer to wave through
• what being wrong costs: 65.0000 USDC on the T2 fixture — the whole stake, slashed and split exactly as the proposer's bond is. A question the court finds unanswerable costs 16.2500 USDC instead, the same 2500 bps (25.00%) forfeit the proposer takes

Hold. attester_stake_bps as a share of the bond, not of the reward. The bond carries a per-tier floor and the reward does not, so the stake outgrows the seat's pay as questions get bigger. It rests on the reward assumption (50 bps (0.50%) of open interest), so re-run it against real escrow sizes before leaning on it.

Holds — no seat pays a co-signer to back an answer they think is a coin flip, the tag subsidy included

• a seat is worth taking from: T0 64.280%, T1 67.740%, T2 79.590%, T3 81.810% and T4 85.710%
• the closest it comes: 64.280% on T0, 14.280% clear of a coin flip
• with the tag subsidised: on the T0 fixture a 2.0000 USDC attester bonus, 0.6667 USDC a seat, takes the seat to 2.3333 USDC against 3.0000 USDC at risk, worth it from 56.250%. Past 2.2000 USDC on this question the chain stops each seat's pay at 8000 bps (80.00%) of its stake, so even a 100.0000 USDC bonus leaves the seat worth taking only from 55.550%

Hold. a seat's pay below its stake on every tier, and the cap on each seat's share of the tag subsidy that keeps it there. Before seats the lone attester took the whole 2000 bps (20.00%) pool and the long-tail seat paid from 37.500%. The subsidy is the one input that could undo this, because it is flat while the stake shrinks with the question; a bonus above 2.2000 USDC on this question is now partly returned to the fund rather than paid.

Holds — every seat a request offers pays the same, however many fill

• request: long-tail regional question, T0
• what a seat pays, with 1, 2 and 3 filled: 1.6667 USDC, 1.6667 USDC and 1.6667 USDC
• what it risks: 3.0000 USDC — worth taking from 64.280%

Hold. max_attestations at 3 with the seat fixed at 666 bps (6.66%) of the reward. Before seats the pool was split between whoever turned up, so the first attester was quoted 5.0000 USDC and paid 1.6667 USDC once the others arrived: a figure that fell after signing.

Holds — a proposer whose answer stands is paid exactly the reward they were quoted

• the quote: the reward less the 500 bps (5.00%) treasury fee and the whole 2000 bps (20.00%) attesters' pool: 18.7500 USDC of a 25.0000 USDC reward on T0
• checked against: every tier and both fixtures, with 0 to 3 seats filled, undisputed and upheld on dispute

Hold. an empty seat's share going to the insurance fund rather than back to the proposer. It makes the quote the proposer signs against the figure they are paid, which is what the answer form shows; the alternative pays more when nobody co-signs and so makes the shown figure a floor the proposer has to reason about.

Long-tail question nobody is paid to answer

Holds — the smallest question worth answering is smaller than the tier's own bond

• request: long-tail regional question, T0
• what answering one costs: 5.00 USDC of attention at 20.00 USDC/hour, plus 0.0200 USDC of fees
• smallest escrow worth answering, alone: 6.69 USDC
• in a batch of 8: 6.67 USDC — the fee share falls to 0.0025 USDC, and the research does not
• with the tag subsidised: 0.00 USDC at a 5.00 USDC proposer bonus
• against the tier's own bond: 25.00 USDC (the plan's stated T0 cost floor)
• this fixture, priced through: 25.00 USDC escrow → 18.75 USDC net; +13.73 USDC alone, +13.74 USDC batched, +18.74 USDC batched and subsidised
• bond the proposer fronts meanwhile: 30.00 USDC, returned unless they are overturned

Hold. the tag subsidy as the thing that sets this floor, with propose_batch behind it. Batching is the smaller half here and worth being honest about: it takes the per-answer fee from 0.0200 USDC to 0.0025 USDC, which against 5.00 USDC of research barely moves the floor at all (6.69 USDC to 6.67 USDC). What moves it is the subsidy — 6.67 USDC down to 0.00 USDC, below the tier's own 25.00 USDC bond. Batching earns its place on the other side of the ledger, in what a bot's whole run costs rather than in whether one question clears; and it is the mechanism that stops the floor rising again if fees ever do.

Holds — a juror drawn onto a long-tail panel is better off serving than ignoring the draw

• T0 panel: 7 seats, 5 of them share the pot
• fee from the bond alone: 1.00 USDC
• what serving costs them: 4.00 USDC of attention across commit and reveal, plus 0.04 USDC of fees
• serving, unsubsidised: -3.04 USDC
• serving, with the tag subsidised: +0.96 USDC at a 20.00 USDC juror bonus split 5 ways
• and the slash they still face: 3.00 USDC, so serving pays from 37.500% accuracy
• what the pot is worth to the panel before they vote: the subsidy is paid into the request's vault when the question is opened, not at settlement, so a panel can see the money is there

Hold. TagSubsidy::juror_bonus as the thing that staffs a long-tail court. The bond cannot do it: a fifth of 25.00 USDC split 5 ways is 1.00 USDC, against 4.04 USDC of cost, so an unsubsidised T0 panel is -3.04 USDC out of pocket for turning up and no slash ratio changes that. This is the gap the economics report carried as open until the subsidy existed — the answer was never to make the bond bigger, which the plan's cost floor forbids, but to pay for coverage separately.

Holds — a verifier with a proven regional record is not kept off its panels by capital

• stake to serve any panel: 100.00 USDC
• stake to serve T0 and T1 with a proven tag record: 50.00 USDC at 50 tag reputation
• the same record on a high tier: 100.00 USDC — the discount stops where the money starts
• why this cannot be gamed: reputation is per tag, non-transferable, earned 1 point at a time by voting with outcomes, and decays 10% a quarter. Buying the discount means being right about one region 50 times
• what it does not discount: the lock. An expired lock is ineligible at any reputation, so the discount buys a cheaper seat, never an unaccountable one

Hold. StakeParams::proven_stake_bps at 5000 bps (50.00%) and proven_reputation at 50. The people who should be judging a region's questions are the ones who have judged them correctly before, and requiring them to lock the same 100.00 USDC as a stranger prices out exactly the wrong people. Pricing the discount against reputation rather than against money is what makes it safe: the one thing an attacker cannot buy is a record.

Staffing a panel out of the bond alone

Holds — the losing side's bond pays a juror more than turning up costs them

• what one round costs a person: 4.0400 USDC
• what one round costs an agent: 0.1400 USDC
• T0: bond 25.00 USDC, 5 of 7 seats share it: fee 1.0000 USDC · person -3.0400 USDC · agent +0.8600 USDC
• T1: bond 100.00 USDC, 5 of 7 seats share it: fee 4.0000 USDC · person -0.0400 USDC · agent +3.8600 USDC
• T2: bond 500.00 USDC, 5 of 7 seats share it: fee 20.0000 USDC · person +15.9600 USDC · agent +19.8600 USDC
• T3: bond 2500.00 USDC, 8 of 11 seats share it: fee 62.5000 USDC · person +58.4600 USDC · agent +62.3600 USDC
• T4: bond 10000.00 USDC, 8 of 11 seats share it: fee 250.0000 USDC · person +245.9600 USDC · agent +249.8600 USDC
• lowest tier a person clears unsubsidised: T2
• lowest tier an agent clears unsubsidised: T0

Hold. the agent bench as the thing that staffs Round 1 on the cheap tiers. The same 25.00 USDC bond that leaves a person -3.0400 USDC out of pocket on T0 leaves an agent +0.8600 USDC, and nothing about the bond changed — only who is reading the evidence. This is the whole economic case for the bench, and it rests on 0.1000 USDC of inference being the right order of magnitude: at 0.9600 USDC an agent round the T0 margin is gone. Re-run this against a real bench's invoice before turning agent_panels on for a venue.

Holds — the cheapest tier is staffed without moving its bond off the plan's cost floor

• T0 bond today: 25.00 USDC
• what one round costs a person: 4.0400 USDC
• bond that would pay them for it: 101.25 USDC
• multiple of the tier's own bond: 4.0x
• what a proposer would have to front: 202.50 USDC
• what the two built mechanisms do instead: subsidy: 20.00 USDC a panel takes the juror above zero · bench: 0.1400 USDC clears the bond unmoved

Hold. TierParams::base_bond at 25.00 USDC on T0, against the standing temptation to raise it. This is the counterfactual priced: paying a human panel out of the bond needs 101.25 USDC — 4x the tier's own bond, 202.50 USDC fronted by a proposer — on exactly the questions the tier exists to keep cheap, so raising it prices out the long tail to pay for judging the long tail. The two mechanisms that close the gap instead both leave the bond where it is: TagSubsidy::juror_bonus pays for coverage separately, and the agent bench clears 25.00 USDC as it stands. A third option — a bigger bond — is the one this rules out.

Minimum volume a tag can sustain itself on

Holds — a verifier on a quiet tag can reach the gates the long-tail mechanisms sit behind

• verifiers sharing the tag: 12
• share of requests that seat a panel: 5%
• requests a quarter to reach the attestation gate, on panel service alone: 106 a quarter
• requests a quarter to reach the reduced-stake gate, the same way: 216 a quarter
• requests a quarter to reach the attestation gate while also answering 6: 1 a quarter
• a verifier at 0.9 events a quarter, after 10 years: 0 reputation — decay takes the point back

Hold. credit_proposer as the thing that makes a quiet tag survivable, and the reason to recruit depth-first. Panel service alone needs 106 a quarter on this tag before the attestation shortcut is reachable at all, because reputation only moves when somebody disputes and 5% of requests do. Answering six questions a quarter — which a tag produces whether or not anyone disputes — brings that to 1 a quarter. The number that matters to an operator is not the protocol's: it is that a tag under roughly one reputation event a quarter per verifier is pinned at zero forever, so a tag wants fewer verifiers with more draws each rather than a wide bench nobody fills.

Holds — the human bench an agent round escalates to can still earn the reputation it is drawn on

• requests a quarter on the tag: 180
• human panel draws per verifier, bench off: 5.25 a quarter
• the same with the bench on Round 1: 0.53 a quarter, at 10% of agent rounds appealed
• to the attestation gate, bench off: 6 quarters
• to the attestation gate, bench on, panel service only: never, inside 40 quarters
• the same while answering 6 a quarter: 5 quarters

Hold. credit_proposer again, and this time it is load-bearing for the agent bench rather than for the long tail. Turning the bench on takes a human verifier from 5.25 draws a quarter to 0.53, and on panel service alone the attestation gate goes from 6 quarters to never, inside 40 quarters. The bench does not remove the need for humans — they hold Round 2, the top two tiers and every appeal — so a bench that starves the people it escalates to has moved the supply problem rather than solved it. What keeps it survivable is that answering earns reputation whoever judges: at six answers a quarter the gate is 5 quarters either way. Governance should read agent_panels and the tag subsidy's proposer_bonus as one decision, not two.

Dispute storm against fund solvency

Holds — a wave of disputes cannot drain the insurance fund

• request: ambiguous question, T2
• fund's cut of one forfeited bond: 130.00 USDC
• fund's cut of one lost appeal bond: 780.00 USDC
• a 100-dispute storm moves the fund: +13000.00 USDC
• against a target of: 50000.00 USDC (100 bps (1.00%) of trailing OI)
• outflows a dispute triggers: none: settle() only ever pays the fund. The vault has two spenders, escalate_bounty and pay_compensation, and a dispute triggers neither

Hold. the 2000 bps (20.00%) residual on every slashed bond and the 3000 bps (30.00%) residual on every lost appeal bond. Disputes are the fund's second income, not its risk — a frivolous-dispute storm is a donation. The plan's scenario is worth keeping as a regression, and the real exposure is measured in the finding below.

Holds — each tier's premium covers the bounties that tier's unanswered requests will draw

• T0: premium 5 bps (0.05%): carries 40.000% unanswered, at the 4x premium ceiling
• T1: premium 5 bps (0.05%): carries 40.000% unanswered, at the 4x premium ceiling
• T2: premium 10 bps (0.10%): carries 80.000% unanswered, at the 4x premium ceiling
• T3: premium 20 bps (0.20%): carries 100.000% unanswered, at the 4x premium ceiling
• T4: premium 50 bps (0.50%): carries 100.000% unanswered, at the 4x premium ceiling
• reward assumed escrowed per request: 50 bps (0.50%)
• bounty ceiling the fund underwrites: 2x the reward, so 1x of it out of the fund
• fund sized against: a trailing book of 500 open T0 requests, so 25000.00 USDC
• 5000 T0 requests, 10.000% unanswered: 12500.00 USDC in, 12500.00 USDC out, fund 25000.00 USDC → 25000.00 USDC
• vault first fails to pay a bounty in full: never, in 5000

Hold. InsuranceParams::bounty_max_multiplier at 2 together with the 5 bps (0.05%) T0 premium. They are one decision, not two: the premium is charged as a share of open interest and the bounty paid as a multiple of the reward, so nothing in the tier table reconciles them and the pair has to be checked together. At the 8x ceiling the fund underwrote 5.710% of unanswered T0 requests before it drained, on the tier whose defining property is that nobody is watching. Capping the bounty leaves the escalation doing its actual job — signalling a rising reward to the bots that farm the long tail — without paying several times over for it. Both halves move with the 50 bps (0.50%) reward assumption above, so re-run this against real escrow sizes before trusting the margin.

Holds — no run of corrections empties the fund faster than the premiums can refill it

• fund at target for a 500-request book: 25000.00 USDC
• most one correction may take: 500.00 USDC (200 bps (2.00%) of the fund)
• consecutive corrections to empty it: 50, each on a different request
• what each one costs to bring: 20000.00 USDC of petition bond, forfeited unless the assembly agrees the answer was wrong
• what the cap does not do: make a market larger than the fund whole. A correction on a big market pays its participants a fraction of what the wrong answer cost them, and the report says so rather than implying otherwise

Hold. InsuranceParams::correction_cap_bps at 200 bps (2.00%). It is the only bound on an outflow whose size is named by the claimant rather than by the protocol: the oracle cannot audit what a market says its participants lost, so what limits the damage is the ceiling, not the claim. At 200 bps (2.00%) of the fund it takes 50 corrections in a row — each needing its own 20000.00 USDC petition and its own two-thirds assembly — to drain a fund at target.

Holds — the premium covers the randomness a missed quorum forces, many times over

• what one redraw costs the fund: 0.3000 USDC — one Switchboard commitment, set by governance rather than measured
• premium on one T0 request: 2.5000 USDC at the base rate
• redraws one such premium pays for: 8, before any discount for the requests that are never disputed and the panels that do turn up
• fund balance that reimburses one in full: 300.00 USDC — 10 bps (0.10%) of the fund is the ceiling, so a smaller fund pays a share
• fund at target for a 500-request book: 25000.00 USDC, which is 83x that

Hold. InsuranceParams::redraw_cap_bps at 10 bps (0.10%) and the fee at 0.3000 USDC. The cap is a backstop against a mis-set fee, not a constraint that binds: a fund holding 300.00 USDC or more reimburses in full, and a fund at target for a modest book holds 83x that. Below it the keeper is reimbursed in part, which is the same principle as the correction cap and the right behaviour for a fund that cannot afford what is asked of it. The reason to carry this cost at all is not its size — one T0 premium pays for 8 of them — but who would carry it otherwise: the keeper cranking the long tail, which is the party the long tail can least afford to discourage.

What these numbers assume

What they do not cover

Seven attacks, measured. Not the whole economy — and the difference matters most to whoever is reading this to sign something off.

The invariants the solver cannot reach

Five of the crate's invariants are machine-checked under kani rather than sampled — settlement conservation, the scorer's tier bounds, the supermajority denominator, the proven-stake discount, and the request lifecycle from any state under any action. The per-identity weight cap is not among them: it is a 128-bit divide, which bit-blasts into a formula the solver does not finish. It stays covered by property tests, which is sampling.

Where it stands: See crates/truth-core/src/proofs.rs. No cargo-fuzz: this crate forbids unsafe, has no dependencies and parses no bytes, so a fuzzer has no memory-safety surface to find here.

Reputation over time

Every scenario takes reputation as a fixed input. Reputation gates panel selection weight, the attestation shortcut and the reduced-stake path, and it decays 10% a quarter. Whether the accrual and decay rates produce a stable population of eligible verifiers is a multi-period question none of these single-request models can answer.

Where it stands: Wants an agent simulation over many requests, which this crate is not.

Source: docs/ECONOMICS.md in the axmc repo. Edit the file; the next deploy rebuilds this page.