Proving a breach without a dispute layer
Every oracle dispute mechanism that has been tried converts a measurement question into a political one. Cleaton has no arbitrator, no vote, and no challenge window.
An attestation says a pool will hold for nine days. Nine days pass. Someone has to be able to establish, without asking us, whether that was true — and be paid for doing it.
Three things have to be settled before that works: what counts as the pool’s liquidity, how anyone proves what it was at a past block, and what exactly makes a claim wrong.
1. Canonical liquidity is a six-hour average
Instantaneous liquidity is never used. The canonical measure is a time-weighted average over a window spanning roughly six hours:
L̃_P(b) = (1/N) · Σⱼ₌₀…ₙ₋₁ L_P( b − j·δ )This defeats the cheapest attack on the system in both directions: a flash deposit that momentarily inflates a pool to invalidate a challenge, and a flash withdrawal that momentarily deflates it to manufacture one. Sustaining a six-hour manipulation is not flash-loan financeable.
What L_P reads is registered per pool at attestation time and signed into the payload as accountingId — totalAssets() for an ERC-4626 vault, reserves against a reference price for a constant-product pool, supplied minus borrowed for a lending market. Committing it in advance is what stops a pool with several plausible liquidity measures from contesting which one applies after a breach.
2. Anyone can checkpoint
A challenge submitted today must prove a fact about liquidity weeks ago. The EVM cannot read historical state directly, and recent-blockhash mechanisms cover a window far shorter than a ninety-day horizon.
So checkpointing is permissionless. Any party may submit a checkpoint asserting L̃_P(b) for a recent block, accompanied by a Merkle-Patricia storage proof against a blockhash still available on chain. The registry verifies the proof and stores the record permanently.
| Property | Mechanism |
|---|---|
| Anyone can checkpoint | No permissioning. Gas is the only barrier. |
| Checkpoints are verified | Storage proof against an available blockhash |
| Checkpoints are permanent | Written to registry storage, not derived on read |
| Cleaton self-checkpoints | At attestation time and daily thereafter |
| Challengers may checkpoint | Creating the evidence they later cite |
3. Breach is two numbers
An attestation is breached if a verified checkpoint exists inside the horizon window and shows liquidity below the committed threshold:
observedAt < time(b) ≤ observedAt + horizonDays
L̃_P(b) < ( thresholdBps / 10⁴ ) · refLiquidityNo discretion, no vote, no interpretation of intent. Notice what is not a breach: a pool that loses 50% while the threshold is 70%; a pool that breaches on day twelve of a nine-day horizon.
And notice what is: a pool that gets exploited and drained to zero, even though the cause has nothing to do with incentive dynamics. That is uncomfortable and it is correct. Carving out “causes we did not mean to predict” reintroduces exactly the discretion the design exists to eliminate. The attestation claimed liquidity would persist and it did not. The right response is to price that residual risk into the bond, not to litigate causation.
What we deliberately did not build
Conspicuously absent: an optimistic dispute game, a token-holder vote, a designated arbitrator. All of these have been tried for oracle disputes and all of them convert a measurement question into a political one, with the outcome correlating to stake concentration rather than to fact.
There is also no challenge window in the usual sense. A challenge may be submitted at any time after the breach, provided a valid checkpoint exists. There is no period Cleaton can outlast by waiting.
The cost of avoiding a dispute layer is that the breach definition bears the entire weight. If the accounting method turns out to be manipulable, or the TWAP window too short, or the threshold miscalibrated, there is no human backstop to catch it. This is the single highest-risk decision in the system, and it is the one that most needs adversarial review before anything is deployed.
Where the slashed bond goes
Half to the challenger, half to an insurance reserve — burned by neither. The challenger’s own stake exists only to make spam expensive; it is small relative to the reward. A system whose purpose is to protect allocators should accumulate a fund that can compensate them, rather than destroying the value it recovers.