Breach and challenge
What makes an attestation wrong, how anyone proves it without asking us, and why there is no dispute layer.
Argued in full in the whitepaper at §8, §9.
The breach condition#
An attestation is breached if a verified checkpoint exists inside the horizon window showing liquidity below the committed threshold:
observedAt < time(b) ≤ observedAt + horizonDays
L̃_P(b) < ( thresholdBps / 10⁴ ) · refLiquidityNo discretion, no vote, no interpretation of intent.
What is not a breach#
| Case | Breached? |
|---|---|
| Pool loses 50% while thresholdBps is 7000 | No — the claim was 70%, and 50% of the reference is above it |
| Pool breaches on day twelve of a nine-day horizon | No — outside the window |
| Attestation is stale and a consumer used it anyway | No — validUntil put that on the consumer |
| Pool is exploited and drained to zero | Yes |
Challenge resolution#
| Step | Behaviour |
|---|---|
| Submit | Attestation hash + checkpoint block + a small challenger stake |
| Verify | Checkpoint must exist and fall inside the horizon window |
| On breach | Bond slashed up to the cap; half to the challenger, half to an insurance reserve; challenger stake returned |
| On no breach | Challenger stake forfeited to the reserve |
| Window | None — a challenge may be submitted at any time a valid checkpoint exists |
The challenger stake exists only to make spam expensive; it is small relative to the reward. The reserve half is not burned — a system whose purpose is to protect allocators should accumulate a fund that can compensate them.
No dispute layer#
Conspicuously absent: an optimistic dispute game, a token-holder vote, a designated arbitrator. All of these have been tried for oracle disputes and all of them convert a measurement question into a political one, resolving by stake concentration rather than by fact.
Bond sizing#
The bond has to exceed the profit available from a knowingly false attestation — B ≥ π · E_a + c_op, where E_a is the capital gated by the attestation. But E_a is not knowable at attestation time, and the registry cannot observe how much capital moved because of a claim.
So the ceiling is enforced consumer-side by convention rather than by the registry. That is an honest limitation: the bond bounds losses only to the extent consumers respect it. Cleaton publishes bond / gatedExposure prominently, because a falling ratio is the leading indicator of the system becoming under-collateralised relative to its use.