axmc Threat model
What an attacker would go after in axmc, what stops them, and what does not. Read it before you hand a market over or bond money on an answer.
Short of time? Read What this does not defend against first. Each claim here is backed by a proof, a test or a simulation, listed in the last section.
What is worth attacking
- The answer. A market settles on what axmc says. Moving one answer on one large market wins the whole prize. A correct answer that arrives too late is worth the same to an attacker as a wrong one.
- Money in flight. Rewards, bonds and jurors' pay in request vaults, premiums in the insurance fund, and the subsidy and appeal vaults.
- Reputation. It cannot be bought or transferred, so it is worth stealing. It raises your odds of a seat, lets you co-sign answers, and cuts your stake on cheap tiers.
- Liveness. A question nobody answers ages out and the market refunds at par. Nobody is slashed for silence, so silence is the cheap attack.
Who is trusted, and how far
| who | can | cannot |
|---|---|---|
| Admin (multisig) | Pause. Set launch caps. Register and freeze venues. Retune parameters. Wire the court in, once. Set the randomness authority. Fund subsidies. | Rule once the court is wired, or re-point it. Change an answer. Spend a request vault or a venue's balance. Name a venue's keys. |
| The court | Rule, correct an answer, pay jurors, reimburse a redraw, move reputation and slash stake. | Pay more than the jurors' pot settlement set aside. Correct outside the window, or twice. Reimburse more than 0.1% of the fund. |
| Randomness authority | Seed a panel draw. | Anything else. Setting it to the empty key retires it for good. |
| Venue authority | Name the venue's keys, deposit, withdraw, hand the venue on in two steps. | List a market or open a question. Touch another venue. |
| Venue key | List the venue's markets and open questions, paying each question's own reward and premium from the balance. | Withdraw. Name keys. Act for a venue that did not name it. |
| Market creator | Open and close requests, claim correction compensation. | Decide anything. Close a request that can still be petitioned or still owes jurors. |
| Anyone | Propose, dispute, attest if eligible, finalize, settle, escalate a bounty, fund a subsidy, petition a correction, crank every court step. |
The oracle takes the court's word on the outcome, never on amounts. Every payout ceiling is enforced by the program that holds the money, so a compromised court could misdirect a payment but not mint one.
Attacks on the answer
| attack | what stops it | evidence |
|---|---|---|
| Buying a panel. Buy stake and hope to be drawn into a supermajority. | Seats are drawn by the square root of stake times a reputation multiplier, and each identity's weight is clipped at 5% of the pool before the draw. Deciding takes two thirds of the seats. One identity holding half of all stake captured none of 2,000 first panels. | Simulated |
| Splitting stake across wallets. | The square root alone does not stop this. The cap plus the ladder does: Round 1, then a grand panel of 15 jurors who did not sit on Round 1. 30% of stake over 20 wallets took 0.2% of first panels and no grand panel. | Simulated |
| Cornering a regional tag. Buy the dozen people who follow one local league. | Panels reserve 55% of seats for verifiers on the question's tags: 4 of 7, 7 of 11, 9 of 15. That is always one short of the votes that decide (5, 8, 10), so a cartel must also win open seats. Owning the whole tag pool carried 2.7% of seven-seat rounds and 3.8% of grand panels in simulation. Above the grand panel, the assembly draws on every staker, not the tag. | Simulated |
| Winning by absence. Carry a thin round when honest jurors stay home. | The threshold is two thirds of the seats, not of the ballots cast. | Proved (absence_cannot_discount_the_threshold, every panel size to 23) |
| Forcing an answer onto a question that has none. | Ruling Unresolvable pays the panel 40% of the 25% the proposer forfeits, at least what guessing pays. A grand panel without two thirds answers Unresolvable and the market refunds at par. |
Simulated |
| One model talking to itself. Seat seven copies of one AI model, or one operator's fleet, on Round 1. | An agent panel must seat at least 3 model families, with at most 2 seats per operator, or Round 1 goes to humans. Its ruling binds only on T0 to T2. On T3 and T4 it is advice and the question goes free to a human grand panel. Agents never sit above Round 1. | Tested |
| A market's own AI judge. A market commits a judge, then answers its own questions. | The judge is fixed once, before the market's first question: a hash of the model, prompt and sources, plus its signing key. Its answer is an ordinary bonded proposal and anyone can dispute it. The chain checks the key, not that the committed model actually ran. | Tested |
| Choosing who may be drawn. Offer the draw only your own wallets. | The draw is offered the whole pool, or the 24 members the revealed randomness picks when the pool is larger. If the roster changes between arming and drawing, the round is armed again. | Tested |
| Picking the seed after seeing the candidates. | A round commits to Switchboard randomness and the candidate set together, so neither can be chosen once the other is known. | Tested |
| Minting reputation. | Only the court writes reputation from juror verdicts, and the oracle from answers: +1 for an answer that stands, −2 for one the court overturns. Reputation cannot be transferred. The reduced stake applies only on the two cheapest tiers, and only with a record on the question's own tags. | Proved (the_proven_discount_only_ever_lowers_the_bar) |
| Leaving before the slash lands. Unstake while the ladder is still running. | A juror is only drawn if their lock outlasts the whole ladder: two rounds of 24 h commit, 12 h reveal and 24 h appeal, five days in all. | Tested |
| Buying a shorter window. Co-sign a wrong answer so the window closes early. | Up to 3 attesters with 20 reputation on the market's tags, never the proposer. Each stakes 10% of the proposer's bond and cuts 25% of the remaining window, never below 25% of it or 30 minutes; a seat that would cut nothing is refused. A seat pays less than it stakes on every tier, and the chain holds a seat's pay, tag subsidy included, to 80% of its stake, so co-signing a coin flip never pays. An overturned answer costs an attester all that stake. A deterrent, not a barrier. | Simulated, tested |
| Capturing a council. The venue picks its members. | That is the trade a council makes: named, bonded resolvers on a public record. An appealable council's ruling can go to the assembly; one that is not appealable is final. A dissenter keeps their bond, so members are not paid to agree. | Simulated |
Attacks on liveness
| attack | what stops it | evidence |
|---|---|---|
| Saying "too early" forever. Push a question to its 14-day expiry and take the refund on a market you were going to lose. | TooEarly is free, but one request takes at most 3. One proposer can delay a T0 question by about 12 hours, not 14 days. |
Simulated |
| A draw that never comes. A dead crank or an empty pool leaves a dispute stuck. | After five days without a draw, anyone can time the round out. The request ends Unresolvable, the market refunds at par, the bonds settle as for any Unresolvable answer, and an appeal bond goes back to its appellant. |
Tested |
| Jurors who never reveal. Push requests up the ladder by staying home. | Panel sizes are set so every panel reaches its 70% quorum 95% of the time at a 90% reveal rate. A round that misses quorum is drawn again. Not revealing costs 30% of stake, more than voting wrong (10%, or 20% on T3 and T4). Abstaining is free, so a juror who does not know should say so. | Simulated |
| Nobody paid to work the long tail. | Tag subsidies pay the answerer and the panel. Batched proposals cut the cost per question. A verifier with 50 reputation on a tag serves T0 and T1 on half the minimum stake. A bigger bond is not the fix: from the bond alone a person breaks even only at T2, an agent at T0. | Simulated |
| Agents starving the humans they escalate to. | Answers that stand earn reputation too. Six answers a quarter reach the co-signing threshold in about five quarters, agents or not. | Simulated |
| A tag runs out of qualified verifiers. | Reputation decays 10% a quarter, per tag, and is earned from panels and from answers. | Simulated, tested |
| Filling the 256-seat pool with sybils. | It costs 25,600 USDC of minimum stake, shows in the public roster, and delays answers without capturing them. | Tested |
Attacks on the money
| attack | what stops it | evidence |
|---|---|---|
| A storm of frivolous disputes. | The fund keeps 20% of every forfeited bond and 30% of every lost appeal bond, and settlement never spends from the fund. A dispute storm is a donation. | Simulated |
| A storm of silence. Leave questions unanswered so bounties drain the fund. | A bounty escalates to at most 2 times the reward, against a T0 premium of 0.05% of open interest. T0 survives 40% of questions going unanswered at the premium ceiling. | Simulated |
| Opening the fund on your own question. Ask, wait for the fund to raise the reward, then answer it yourself. | A request can never draw more from the fund than the premium it paid. At worst you pay yourself back, less the 5% fee. | Tested |
| Draining the fund through corrections. A market names its own loss, and the oracle cannot audit it. | The claim is cut to the open interest the question was priced on, then to 2% of the fund, once per request. Each correction needs a 20,000 USDC petition bond within 7 days and two thirds of the assembly. Emptying a fund at target takes 50 of them in a row. | Simulated, tested |
| Overdrawing a pot. | Juror pay stops at the pot settlement set aside, one claim per seat. Compensation pays once per request. A subsidy that cannot cover both its halves pays neither. | Tested |
| Farming redraw fees. | A redraw needs a disputer's bond and a panel that stays home, and stay-home jurors lose 30% of their stake. One claim per round. The payee is fixed when the round is armed. | Tested |
| Racing the accounting. | Settlement runs once and conserves value. The chain's transfers are checked against the core's numbers, transfer by transfer. | Proved (an_undisputed_settlement_with_no_seat_filled_conserves_value, an_undisputed_settlement_with_one_seat_filled_conserves_value, an_undisputed_settlement_with_two_seats_filled_conserves_value, an_undisputed_settlement_with_three_seats_filled_conserves_value, an_undisputed_settlement_with_more_attesters_than_seats_conserves_value, an_undisputed_settlement_from_before_seats_conserves_value, an_unresolvable_settlement_conserves_value; the three-seat cases up to 4,294.97 USDC per amount), tested |
| Growing faster than the fund. | Governance can cap open interest per question, cap the tier, and require vetted creators. These caps are off by default and are switched on for mainnet. Only governance can register a venue. | Tested |
If a venue's keys leak
A venue has an authority and listing keys. Keep them separate. A venue registered with one key in both roles loses this protection.
| stolen | can | cannot |
|---|---|---|
| A listing key | List markets and open questions, spending the balance one priced question at a time | Withdraw, name keys, or reach another venue |
| The authority | Withdraw the balance and replace every key | Decide an answer, touch a request vault, or touch your market's own collateral |
The oracle never controls your market program or debits your collateral. Rotate a leaked key in one instruction. A leaked authority is a governance matter: the venue can be paused meanwhile, without touching questions already paid for.
Attacks on the plumbing
| attack | what stops it | evidence |
|---|---|---|
| Signing as someone else. | Every privileged instruction binds its signer. Strangers cannot rule, retune, reinitialise or correct. | Tested |
| The admin overruling the court. | Once the court is wired in, the admin can no longer rule, and cannot re-point or unset the court. | Tested |
| Closing a request under its claimants. | A request cannot be closed until the correction window and the jurors' claims are over. | Tested |
| Under-reporting open interest. Open interest sets the tier, and a lower tier is a cheaper court. | A market picks once, at registration, between Vault and Reported. A Vault market is priced on its escrow balance, whatever it claims. A Reported market is taken at its word, but the choice is public on the market account, so you can price its answers accordingly. |
Tested |
| An illegal state change. | The request lifecycle cannot reach an illegal state, and a score always lands inside the tier it picks. | Proved (the_lifecycle_never_reaches_an_illegal_state, scoring_stays_inside_the_tier_it_picks) |
| A stale price preview. The app prices a question in the browser. | The preview is the same Rust compiled to wasm. It refuses to quote when the chain's risk config version differs from its own. It only scores. Every amount the app sends is read from the chain. | Tested |
Attacks on the spoke
On Base, BNB Chain and Arbitrum, the contract that settles on a receipt never saw the court. See The EVM spoke.
| attack | what stops it |
|---|---|
| A forged receipt. | The spoke believes Wormhole's guardians: 13 of 19 on mainnet, one key on testnet. A compromised guardian set could sign a fake receipt. The spoke's owner sets a value ceiling. A receipt for a market whose exposure is above it, or unknown, is stored but held until the owner releases it. Bonded attesters that turn forgery into a slash are not built yet. |
| A receipt from the wrong court. | The spoke checks the emitter chain and address against axmc's emitter before reading the payload. |
| Replaying a delivery. | Each message is consumed once. The same receipt re-sent under a new sequence is recognised and changes nothing, including a hold the owner already released. |
| Reviving an overturned answer. | A correction supersedes the receipt it replaces. Anything older, or a second correction, is refused as stale in either arrival order. A receipt is not final until the correction window has passed, so wait out the window before paying real value. |
| Settling on another question's answer. | The reference consumer only settles a market on a receipt for the market it was created against. A consumer you write yourself must do the same. |
| A code the consumer has never seen. | Cause codes can grow. The reference consumer treats anything it cannot pay on as void and refunds, rather than reverting. |
| Silence. | Anyone holding the attestation can deliver it. The quiet failure is your own service dying, so run the reference service with its heartbeat and low-balance alert. |
What this does not defend against
The honest list. Each item is accepted, not built yet, or out of scope.
- A correction cannot un-pay. Settlement runs once. A correction changes what markets read from then on and opens one capped claim on the fund. On a market larger than the fund, people are not made whole.
- The assembly appeal is not cheap. Above a captured regional grand panel sits the assembly, which every staker votes in and no tag cartel controls. Reaching it takes a bond of four times the question's bonds, at least 5,000 USDC, but never more than ten times the bonds: 600 USDC on a question with 60 USDC of bonds. A small regional question is protected less than a large one.
- Some councils are final. A council that is not marked appealable can only be overturned by a correction. You choose a council knowing that.
Reportedopen interest. It is believed. The defence is disclosure: you can decline to rely onReportedmarkets. Even the vault read is exact only for a fully collateralised market.- Governance. The admin can retune every parameter on this page, and can turn assembly appeals on or off. The defence is procedural: a multisig now, on-chain governance for parameters later. Until then, capturing the parameters is capturing the protocol.
- The randomness authority, before Switchboard. Whoever holds it chooses panel seeds.
- Self-declared agents. An agent's model family and operator are what it declares. An operator using several keys and claimed families gets around the per-operator cap. That is why agent panels never bind T3 and T4, and why one bonded dispute takes a question to humans.
- Off-chain services. The notifier, the indexer and RPC endpoints cannot change an answer, but they shape who hears a question is open. Anyone can run their own notifier from the indexer's events.
- A badly written question. Weak rules score into a higher tier, which prices the ambiguity but does not fix it.
Unresolvable, refunded at par, is the way out. - An unfunded long tail. The subsidy only works if someone funds it. An unfunded tag falls back to the bond, and the bond cannot pay a T0 panel.
- A young fund short-pays redraws. Redraw reimbursement is capped at 0.1% of the fund. Below about 300 USDC, the keeper who bought the randomness gets part of it back, not all.
- A guardian compromise on the spoke settles at most the owner's value ceiling without a person reviewing it.
- Settlement conservation is proved for two verdicts of four. The two slashing verdicts are too heavy for the solver. They are covered by property tests and by comparing the chain's transfers with the core's.
How each claim is backed
Three kinds of evidence, from strongest to weakest:
- Proved. A solver checks every input in a stated range. The proofs are
the_lifecycle_never_reaches_an_illegal_state,scoring_stays_inside_the_tier_it_picks,absence_cannot_discount_the_threshold,the_proven_discount_only_ever_lowers_the_bar,an_undisputed_settlement_with_no_seat_filled_conserves_value,an_undisputed_settlement_with_one_seat_filled_conserves_value,an_undisputed_settlement_with_two_seats_filled_conserves_value,an_undisputed_settlement_with_three_seats_filled_conserves_value,an_undisputed_settlement_with_more_attesters_than_seats_conserves_value,an_undisputed_settlement_from_before_seats_conserves_valueandan_unresolvable_settlement_conserves_value. - Tested. Property tests, tests against the real programs, and tests comparing the programs with the core on scores, bonds, settlements and tallies.
- Simulated. Measured against the core at default parameters, assumptions stated, in Economics. The weakest of the three, and most of the economics rests on it.
Every simulation scenario, and where this page covers it:
Source: docs/THREAT_MODEL.md in the axmc repo. Edit the file; the next deploy rebuilds this page.