Security and trust
This page states every assumption the market makes, in the order money depends on it.
1. Collateral
Every position locks its whole possible loss when it opens. A long at price P locks P − floor per unit, a short locks cap − P. A matched long and short together lock exactly cap − floor, and settlement pays exactly cap − floor back across both. The vault can always pay; nothing is ever borrowed, so the program has no liquidation path and no insurance fund.
2. The settlement value
Prices are off-chain, so settlement uses a bonded reporter: anyone may post the settlement value with a bond, a dispute window lets anyone challenge with the same public data, and a challenged value is recomputed by the arbiter set.
In program terms:
report(value)after expiry, with the market's bond. The value must already be clipped to the band.- During
dispute_window, anyone maydispute(value)with an equal bond and a different value. - If disputed, each arbiter calls
vote(value)with their own recomputation. When the votes reach the threshold, the market settles at the lower median of the votes. - Bonds go to whichever side was strictly closer to the arbiters' value. A tie keeps the report.
- Unchallenged, the report settles once the dispute window has passed. If arbiters leave a dispute unresolved past
arbitration_window, it settles at the midpoint of the two values and both bonds come back, so a silent arbiter set cannot freeze collateral.
Launch values: bond $100, dispute window 6 hours.
3. The price sources
| Risk | What limits it |
|---|---|
| One venue prints a false tick | the median of two venues and a 24-hour average; a disputer recomputes from both |
| Both venues are pushed | the attack cost below |
| ECB fix missing for the day | expiries fall on business days after the 15:00 UTC publication |
| API outage at report time | hourly closes are historical; the report can be posted later, nothing settles before a report |
4. Cost to bend the index
To move S, an attacker must hold both venues off fair for the whole 24-hour window while sellers keep filling the displaced price, then unwind at fair. Model (rerunnable as spike/safe_oi.py), from measured 24-hour volumes of 54.2B won on 
Upbit and 68.2B won on 
Bithumb (about $83M a day together):
| Hold the average off by | Loss, flow ×1 | Loss, flow ×3 |
|---|---|---|
| 0.5 pp | $0.45M | $1.28M |
| 1 pp | $0.90M | $2.57M |
| 2 pp | $1.80M | $5.13M |
Capital exposed: $90M to $257M. Trading fees on that flow are not counted and only add to the attacker's bill. With a 10× safety margin (an attacker's possible gain at most a tenth of the loss), safe open interest is $9M to $26M notional, enforced per market by oi_cap (OiCapExceeded).
5. Keys
- The authority opens markets and sets arbiters. It cannot move vault funds.
- Arbiters can only vote on disputed markets, inside the window, with an in-band value.
- No key can withdraw a user's margin.
6. What is outside the program
Korean exchanges could print false prices together. That is why S is public arithmetic: any watcher can see a wrong value and dispute it within six hours.