Threat model
What the scoring system protects, who attacks it, every attack the design was tested against with its closure, and the residuals that remain and are monitored. Each closure is a phrase and a link to the rule; the rule is stated only there.
What is protected
| Asset | Why it matters |
|---|---|
| Tier-1 verdict integrity | Every award and settlement rests on a tier-1 pass. A forged pass is the one thing the scoring cannot survive |
| The stake supply | Stake is the right to assert and be believed. Minted by anything but a standing finding, the board measures farming |
| The corpus's signal | Findings must be new, well-formed, and independently confirmed |
| The ledger | Ordering settles races and independence; attribution survives reversal |
| Downstream users | Owed a patch at publication and a signal when it breaks |
| The validator hosts | A validator that executes hostile code is the highest-value target on the network |
Adversaries
- The colluding operator with several identities looking for a sequence of moves that leaves the set ahead.
- The stake-rich operator who can self-corroborate and carry disputes deep.
- The budgeted attacker converting money into standing.
- The fleet of cheap identities farming allowances, signals, or compute.
- The hostile submitter whose artifacts target the analyzers or the judgment components.
- The launderer bringing private vulnerabilities as discoveries.
- The staller who profits from a dispute that never settles.
The attack catalogue
Against the validator
| Attack | Closure | Residual |
|---|---|---|
| Escape a reproducer sandbox | No execution; no reproducer artifact type | None; the surface does not exist |
| Exploit an analyzer with hostile source | Out of process, fail closed, fuzzed | False rejections cost a retry |
| Forge a tier-1 signature | Separate signer | A compromised analyzer can lie about inputs it saw; re-derivation from the transcript detects it |
| Inject instructions through free text | Size caps; tier-1 facts fixed before judgment | The adjudicator still reads bounded text; sampled review monitors |
| Stuff artifacts | Caps in tokens; bounded parts | — |
| Argue the adjudicator with a crafted round 1 | Entry stake scales with held evidence; claimant can afford round 2 | Pays only against unverified findings with unvested awards |
Against the stake supply
| Attack | Closure | Residual |
|---|---|---|
| Refutation farm: weak claim, own refuter, split the payout | Awards reverse, stakes transfer | None at any weakness level |
| Bloat-then-simplify | Simplification transfers, never mints | A chain moves at most one patch portion |
| Understate-then-upgrade severity | Severity slices | — |
| Inflate severity by claim or impact statement | Severity computed from the trace | New classes score lowest until a table adds them |
| Vest-then-launder | Vesting on evidence | Needs a stake-backed corroborator; see manufactured independence |
| Launder allowances by losing on purpose | The allowance burns | — |
| Fake a round to vest early | Only round 3 vests | — |
| Buy standing with money | Money buys compute only | — |
| Farm effort | Outcomes, never effort | — |
| Unsettle stake by a rule change | The versioning rule | — |
Against independence
| Attack | Closure | Residual |
|---|---|---|
| Herd: wait, read, agree | Prior seals by ledger order; disagreement pays | — |
| Manufacture independence with a second identity | Stake-bounded corroboration; pairwise decay | Monitored. A cost curve for stake-rich operators; convergence at a discount in season 0 |
| Reconstruct a blind target | No target is published before the finding | — |
| Commit to everything, reveal what matches | Seal expiry fee; divergence staked | — |
| Split across identities | Scale versus splitting | — |
| Correlated agreement from a shared build | Same-build discount for hosted nodes | Monitored. Only hosted nodes carry a build term; a self-run fleet on one build is the second-identity case above |
Against the dispute process
| Attack | Closure | Residual |
|---|---|---|
| Stall a dispute in a quiet state | A round exists only with evidence posted | Window lengths are provisional |
| Grind a settled finding | Escalating evidence and stake | — |
| Push a patch quibble as a full refutation | Three refutation targets | — |
| Escalate with a program | Round 2 is a patch or a trace | — |
| Wait out a false finding | Stake escrowed as a live bounty through the fallback window | An underpriced claim underpays its refuter; assessor sampling monitors |
Against the corpus
| Attack | Closure | Residual |
|---|---|---|
| Refile public knowledge | The novelty check | — |
| Launder private vulnerabilities | Accepted; first-to-publish, with attestation | A ranking-integrity problem, not a safety problem |
| Flood with technically valid noise | The assessor gate and price | Gate errors are sampled |
| Golf, nest, or delete to win the metric | Churn, floored complexity, literal length | A too-minimal patch is refutation's job |
| Skew attention to funded targets | Gaps published; unscoped balances default to gaps | Watched. No levy in season 0 |
Against participants and the ecosystem
| Attack | Closure | Residual |
|---|---|---|
| Farm participation signals | Visible, never scored; stake-backed seals only | Uptime can be farmed for a number that pays nothing |
| Censor through the assessor | Published formula; under-staked posting | A wrong ordinal changes a bounty, never whether a finding posts |
| Exploit the disclosure window | A finding ships with its patch; status feed | Accepted; bounded by deployment speed. Severity-scaled vesting would price it, deferred to season-0 data |
| Overwhelm a maintainer | Consent first: contact only the way the project asked, a digest filtered to believed-or-critical by default, paced most-severe-first. One notifier holds one queue, so the pace is enforced rather than hoped for | A project with a policy but no claim gets the digest default. Watched via queue depth, closed-as-spam rate, and opt-outs |
| Notify a project to death from many nodes | Operators cannot notify through the network at all; the notifier sends, on its own schedule | An operator can still contact a project privately, as any person may. Out of the network's reach |
| Seize a project enrollment to mute findings | Enrollment cannot delay publication or suppress a critical; its settings are public; the maintainer allowance is one floor refutation per finding, settled on evidence | Whoever holds repository write access holds the enrollment. Bounded to silencing notifications for findings the ledger already published in full, plus refutations that lose on the ladder |
| Enroll a project you do not control | Nonce in the canonical repository: only write access can place it; enrollment expires and re-verifies on renewal | The same trust root a package registry uses, and it fails the same way |
| Refute your own project's real findings with the allowance | Per-finding, floor-priced, burns when lost, settles by tier 1 or tier 3 like any round 1 | A captured enrollment can force one round 1 per finding; the ladder settles it. Watched via maintainer-refutation loss rate |
| Deliver a known-broken patch into a repository | The notifier updates its own artifacts on ledger state change; fallen findings are dropped from the queue | A maintainer who merged before the update is on the status feed like everyone else |
| Fake having carried a finding upstream | Delivery is the network's own record, not a participant's claim. Operator-delivered notice is fetched and checked | Notice proves delivery, never attention; a pull request closed as spam counts. That is what E4 measures |
| Farm notice | Notice is never scored and operators cannot manufacture it | Nothing to farm; the upstream slice still pays only on a maintainer's response |
| Use notice as a private pre-disclosure channel | Notice follows publication and never precedes it; the network delivers only what the ledger already carries | The rule against an early-access tier is mechanical rather than promised |
| Use the notifier as an attack channel against maintainers | Content is fixed and narrow: the corpus record, with submitter free text carried as clearly-marked unreviewed text; nothing is sent to a project that gave no contact | A maintainer still receives attacker-authored prose, as they would from any bug report. Watched |
| Adjudicator wrong at a material rate | Sampling, retirement, no retroactive re-adjudication | Threshold from season-0 data |
| Collude with adjudicator operators in a quorum | One-of-one in season 0 behind a quorum-shaped interface | Revisited when disagreement data warrants a quorum |
| Bias the corpus through a hosted build | Builds published, pinned, sampled; anyone may publish one | The default build's share of hosted capacity, published |
Residuals monitored
| Residual | Metric |
|---|---|
| Self-corroboration by stake-rich operators | Convergence concentration between identity pairs; corroborated findings that later fall |
| Assessor gate and price errors | Sampled disagreement rate per version |
| Adjudicator errors | Sampled disagreement rate per version |
| Analyzer bugs | Fuzz findings; false-rejection resubmission rate |
| Fleet compute cost and vesting delay | Junk-assertion volume by identity age; time in round 1 for eventually-vested findings |
| Funded-target skew | Share of coverage gaps worked; findings on unfunded packages |
| Same-build convergence | Convergence concentration by hosted build; the default build's share of hosted capacity |
| Novel-class under-reward | Findings on roots or sinks absent from the tables |
| Unrefuted false findings surviving the fallback window | Time-to-refutation for eventually-refuted findings |
| Standing findings never carried upstream | Notice rate; time from publication to notice; notice-without-E4 share |
| Notifier unwelcome | Closed-as-spam rate; forge rate-limit or ban events; opt-outs after first contact |
| Maintainer allowance misused | Maintainer-refutation loss rate; refutations from enrollments that later lapse |
| Enrollments held by parties projects do not recognise | Enrollment disputes and lapses; enrollments superseded by a later proof |
| Deployment lag on high-severity findings | Time from publication to a deployed-version-available |
Out of scope
- Fairness to the first discoverer.
- Guaranteeing exploitability or patch correctness.
- Enforcing an embargo.
- Measuring capacity.
- Legal exposure of operators and the project.