How-to guide
Monitor security assumptions
Check that the economic and liveness assumptions behind a deadline-bearing or price-sensitive action still hold before you take it, and keep checking until its last deadline. The contracts cannot tell you when such an assumption has stopped holding.
Check an action's assumptions
- List the assumptions the action depends on. The security model lists which assumptions protect which mechanism.
- Find the rows for those assumptions in the table below.
- Take each row's reads for the same lineage, pool, and block as the action. Express the values in one numeraire and cover the action horizon.
- If a read is weak or unavailable, apply the row's response before proceeding.
- Repeat the reads on the row's cadence until the action's last deadline has passed.
Most on-chain reads are also indexed by augurScan under /operations/… (see the augurScan README). The liquidator and OpenOracle arbitrager bots in bots/ show live pool, vault, and report state in their dashboards.
Terms used in the table
- Numeraire
- The one unit of account, such as ETH, in which you express every value you compare.
- Action horizon
- The period until the action's last deadline.
- Corrector
- An account that disputes an incorrect OpenOracle report; see A17.
- Callback-recovery candidate
- A price coordinator whose pending report OpenOracle has already settled; see settlement recovery.
- Overflow operation
- A staged operation outside the next settlement callback's batch of four; see execution batches.
Reads, cadence, and response for each assumption
| Assumptions | What to read | Review cadence | Response when the boundary is weak or unknown |
|---|---|---|---|
| Executor incentives and participation — A01, A02, A03, A06 |
|
Continuously for deadline-bearing flows; before launch and after parameter or gas-regime changes | Fund or arrange independent executors, reduce exposed value, or disclose that the affected transition may stall |
| Fork lineage value and migration readiness — A05, A07, A09, A11 |
|
Before a fork-security claim and throughout migration and coordination windows | Do not claim fork deterrence, practical migration, or value concentration; narrow supported lineage and exposure |
| REP value and liquidity versus secured exposure — A08, A13, A14 |
|
At launch, continuously while open interest exists, and after material price, supply, liquidity, or exposure changes | Cap or stop new exposure in clients and disclosures; do not describe REP backing as economically sufficient |
| Outcome evidence and escalation funding — A04, A10 |
|
From question creation through local resolution and any fork window | Mark the market or action impaired, surface the deadline, and avoid asserting that honest local correction remains fundable |
| Collateral Repair Auction demand — A12 |
|
Before and during every repair auction | Disclose likely incomplete repair and plan operation of the child at only migrated collateral plus accepted auction ETH |
| Transaction inclusion and Ethereum execution — A16, A26 |
|
Continuously while a deadline or mandatory transition is live | Raise transaction fees where rational, use independent submission paths, and disclose missed-deadline or stranded-transition risk |
| REP/ETH price correction — A17, A18, A19 |
|
Continuously while a report is pending or a cached price can authorize operations | Block or discourage new price-sensitive operations and disclose that an incorrect report may settle |
| Token behavior and recipient compatibility — A21, A22 |
|
At deployment verification and before first use of a new recipient or integration | Reject the deployment or incompatible recipient; do not rely on redirected recovery |
| Deployments, clients, data, and keys — A20, A23, A24, A27, A28 |
|
At release, on every environment or account change, and continuously for indexers | Stop signing or operating, reject an unverifiable deployment, revoke compromised authority where possible, and re-establish canonical state from independent sources |
| Question selection — A15 |
|
Before pool selection | Reject or warn on the selection; do not represent an admitted question as relevant or resolvable |
| Immutable parameters — A25 |
|
Before deployment and after any change in external gas or market conditions used by the model | Treat the immutable deployment as unsupported; there is no administrative parameter repair |