Threat Model
Adversaries, failure modes, and the security boundary around economic settlement.
Assume every actor may be malicious or fail.
Designer threats
- malicious/buggy model;
- misleading scientific claims;
- dependency drift;
- hidden network/time/randomness;
- disappearing data.
Controls: pinned version, provenance, deterministic environment, data availability requirements, tests, explicit limitations.
Launcher threats
- unfair configuration;
- excessive fees;
- liquidity withdrawal;
- rule changes after players enter;
- underfunded runtime.
Controls: bounded configuration, fee templates/caps, protected liquidity, immutable Season rules, minimum runway requirements.
Player threats
- duplicate withdrawal;
- malformed inputs;
- front-running strategy reveals;
- Sybil participation;
- manipulation of predictable randomness.
Controls: nonces/position IDs, input validation, commit/reveal where required, World-level eligibility policies, explicit randomness class.
Runner threats
- fabricated state;
- stale state;
- wrong code/runtime;
- selective censorship;
- withholding data/output;
- submitting cheap hash spam for rewards.
Controls: bonds, exact job spec, independent replay, payment only after finality, replaceability/failover.
Verifier threats
- collusion;
- bribery;
- downtime;
- homogeneous infrastructure failure.
Controls: diversity, bonds, exposure caps, public replay, later stronger proofs.
Contract threats
- reentrancy;
- integer/rounding bugs;
- settlement overflow/underbacking;
- admin/key abuse;
- upgrade risk;
- token edge cases.
Controls: SafeERC20 patterns, checks-effects-interactions, formal invariants, staged caps, audit, narrow admin authority, testnet deployments.
Market threats
- token price collapse;
- wash trading;
- thin liquidity;
- MEV;
- manipulation of fee-driven runtime metrics.
Controls: do not equate liquidity lock with safety, measure real fees, separate runtime solvency from token price, cap dependencies on unverified market behavior.