Challenges & disputes
devnet preview — all data is replayAnyone can challenge settlement evidence by posting a bond. Money moves only on faults validators can verify deterministically — opinions and heuristics can never touch a balance, only reputation points.
How a challenge works
While a fill's challenge window is open, a challenger locks a bond and names the fault. The challenge must be admissible for that fill's policies — inadmissible combinations are rejected before any bond locks, so undecidable disputes cannot grief either side. Each challenge then has its own resolution window; while any challenge is pending, the provider's payment for that fill stays held back, and any benchmark print built on it stays pending.
What is challengeable, and how it is decided
| challenge | the deterministic verifier |
|---|---|
| invalid DA certificate | recheck the quorum signatures on the certificate |
| invalid execution receipt | recheck signatures and bindings |
| token overcount | recount with the book's tokenizer — public transcripts anyone can supply; private ones the user or delegate reveals |
| invalid delivery receipt | structural recheck against the delivery policy |
| missing delivery | blob absence during the retention window — public-output books only |
| price overcharge | recompute the tariff arithmetic |
| deadline miss | check the derived heights — against the completion deadline only |
| payload rejection fraud | recompute the commitment the rejection claimed was wrong |
Honest scope notes: auction- and book-state challenges are inadmissible in the MVP because consensus replay itself is their verifier — a bad clearing cannot happen without the chain halting on it. Schema challenges wait until a deterministic schema validator is registered. Model-mismatch challenges await a future verifier.
Verdicts and exactly what moves
| verdict | money effect |
|---|---|
| upheld | the challenger's bond returns plus a reward; the slash waterfall runs in fixed order — user made whole first, then the challenger's reward, then a treasury penalty; residual provider bond stays locked until the lease closes |
| upheld, zero cash harm | the state is corrected but nothing moves: no reward, no penalty, bond returned — and the provider still takes the reputation loss. This is deliberate anti-farming: you cannot mint rewards from technicalities that harmed no one |
| rejected | the challenger's bond is forfeited in full to the challenged provider, as compensation for the settlement delay |
| expired | past its resolution window: anyone can expire it; the bond returns, nothing else happens |
What a pending challenge holds
Two things freeze while a challenge is unresolved: the provider's withdrawable balance excludes every payment from the disputed fill (so restitution always has a funded source), and any index print built on the fill cannot become benchmark-eligible. A pending challenge never blocks the lease from closing — and if a challenge is upheld after close, recovery comes from the provider's available balance.