Skip to main content

Settlement probability inequality

Q>11/MQ > 1 - 1/M is the system-level condition for finite expected escalation cost under proportional per-round costs.

Derivation

Assume some proportional cost C>0C > 0 per dispute round (e.g. a burn fee or capital cost). With multiplier MM and per-round settlement probability QQ, the dispute probability is P=1QP = 1 - Q. The total expected cost of the oracle game is:
n=0C(MP)n\sum_{n=0}^{\infty} C \cdot (M \cdot P)^n
For this geometric series to converge, MP<1M \cdot P < 1:
M(1Q)<1    Q>11MM \cdot (1 - Q) < 1 \implies Q > 1 - \frac{1}{M}
If QQ violates this inequality, the total cost of the oracle game diverges. Under any oracle parameterization, the equilibrium no-dispute band widens as needed to ensure the QQ inequality holds for the choice of MM. Since each round settles with probability QQ, expected rounds to settlement is 1/Q1/Q. The inequality bounds this:
Expected rounds<MM1\text{Expected rounds} < \frac{M}{M - 1}
Any committed oracle manipulation or delay strategy that loses money internally in each round blows up divergently if this condition is violated, even if the other participants are net profitable. Note that the escalation halt breaks the divergence by capping the oracle game size. However, as long as the escalation halt is high enough relative to external notional, the cost to manipulate through the geometric growth phase is economically similar — the manipulator still faces near-divergent costs before reaching the halt. The per-round cost CC is assumed positive in the derivation above, but in practice a given participant’s effective per-round cost can be net negative when external notional dynamics or continuation value subsidize the dispute. In these regimes, the divergence argument does not directly bind that participant, and the settlement probability inequality becomes a necessary but not sufficient condition for finite manipulation cost. See Attack Vectors for the full treatment.

Distribution-agnostic proof

From Oracle Accuracy & Cost, the disputer’s break-even is derived against the worst-case adversarial counter-dispute. Define:
C=maxA[(1Q(A))A]C = \max_A \left[(1 - Q(A)) \cdot A\right]
where Q(A)Q(A) is the double-no-touch probability at barriers ±A\pm A under whatever price process governs the settlement period. A dispute at distance DD is profitable when D>CMD > C \cdot M. When disputers are profitable, this implies Q(D)>11/MQ(D) > 1 - 1/M. Since CC is the maximum of (1Q(A))A(1 - Q(A)) \cdot A over all AA, evaluating at A=DA = D gives:
(1Q(D))DC<DM(1 - Q(D)) \cdot D \leq C < \frac{D}{M}
Dividing by DD:
(1Q(D))<1M    Q(D)>11M(1 - Q(D)) < \frac{1}{M} \implies Q(D) > 1 - \frac{1}{M}
This holds for any distribution — the only requirement is that CC is the maximum of (1Q(A))A(1 - Q(A)) \cdot A. The settlement probability inequality is a direct consequence of the definition of the adversarial optimum, not a property of any particular distributional family.

Minimum cost to delay

Assume a protocol fee FpF_p that is either burned on each dispute or routed to oracle game dependents. The oracle game liquidity at round nn is:
Ln=L0MnL_n = L_0 \cdot M^n

Total system burn

If NdN_d disputes occur (from any source), the total protocol fee burned across those rounds is:
Ctotal(Nd)=Fpn=0Nd1L0Mn=FpL0MNd1M1C_{\text{total}}(N_d) = F_p \cdot \sum_{n=0}^{N_d-1} L_0 \cdot M^n = F_p \cdot L_0 \cdot \frac{M^{N_d} - 1}{M - 1}
This closed form is pre-escalation halt; with halt the cost becomes piecewise (geometric growth then flat). The number of rounds required to delay for some target horizon XX given settlement time TT per round is:
Nd=XTN_d = \left\lceil \frac{X}{T} \right\rceil

Attacker-paid versus honest-paid split

Not all NdN_d rounds are paid for by the attacker. Honest market activity — arbitrageurs correcting price movements — also resets the settlement timer at no cost to the attacker. In the honest-only process, expected rounds to settlement is 1/Q1/Q, capped by M/(M1)M/(M-1). If the attacker only disputes when the game would otherwise settle (which happens with per-round probability QQ), the expected cost splits cleanly:
E[Catt]=QCtotal(Nd),E[Chonest]=(1Q)Ctotal(Nd)\mathbb{E}[C_{\text{att}}] = Q \cdot C_{\text{total}}(N_d), \quad \mathbb{E}[C_{\text{honest}}] = (1-Q) \cdot C_{\text{total}}(N_d)
Applying the settlement probability inequality Q>11/MQ > 1 - 1/M:
E[Catt]>(11M)Ctotal(Nd),E[Chonest]<1MCtotal(Nd)\mathbb{E}[C_{\text{att}}] > \left(1 - \frac{1}{M}\right) \cdot C_{\text{total}}(N_d), \quad \mathbb{E}[C_{\text{honest}}] < \frac{1}{M} \cdot C_{\text{total}}(N_d)
The attacker pays at least (11/M)(1 - 1/M) of the total burn and the honest network pays at most 1/M1/M. For small MM (e.g. M=1.1M = 1.1), the floor is only ~9.1% — most of the burn comes from honest activity. For M>2M > 2, the attacker bears the majority. For delay targets within the honest baseline of M/(M1)\sim M/(M-1) expected rounds, the attacker’s cost can be significantly lower than CtotalC_{\text{total}}. Any swap fee or protocol fee meaningfully higher than zero widens the no-dispute band (see Oracle Accuracy & Cost), which pushes QQ higher. Higher QQ means fewer honest rounds per attacker dispute and a larger share of the total burn falling on the attacker. Honest disputes also yield less delay per round than attacker disputes. Honest disputes fire as soon as the price moves past the dispute barrier, so their mean time per round is less than TT. An attacker maximizing delay would wait until the end of the settlement window, getting close to TT of delay per dispute.

Example

Assume Fp=1%F_p = 1\%, T=10T = 10 minutes, M=2M = 2, and L0=L_0 = $100k. An attacker tries to delay for 2 hours, requiring Nd=120/10=12N_d = \lceil 120 / 10 \rceil = 12 rounds.
Ctotal(12)=0.01100,000212121=1,0004,095=4,095,000C_{\text{total}}(12) = 0.01 \cdot 100{,}000 \cdot \frac{2^{12} - 1}{2 - 1} = 1{,}000 \cdot 4{,}095 = 4{,}095{,}000
Over $4 million in protocol fees are burned across 12 rounds. With M=2M = 2, Q>1/2Q > 1/2, so the attacker pays strictly more than half of the total burn in expectation.