How settlement actually works
On-chain architecture & trust covers the shape of this. This page walks through the actual mechanism, specifically enough that you could describe exactly how a cheating attempt would get caught, not just that it would.
The lifecycle of one settlement
A settlement moves through exactly four states, and money only ever moves in the last one:
- Active — the account is still trading.
- Provisional — a settlement has been proposed and its evidence committed on-chain. A window is now open during which anyone, not just the trader involved, can challenge it. No funds move yet.
- Faulted — someone proved the proposal doesn't match the real trade history. The settlement is void and the operator's collateral is seized.
- Final — the window closed clean. Only now can a payout actually happen.
Every money-moving instruction in the protocol checks that a settlement has actually reached Final before it will touch a single token. There is no path that pays out during the open challenge window.
Five specific proofs, each closing one specific way to cheat
This is the part worth understanding in detail, because it's the difference between "trust us" and "here's exactly how we'd catch you." A dishonest operator has a handful of ways they might try to falsify a result, and each one has a dedicated, permissionless proof built specifically to catch it:
| If a firm tried to... | This proof catches it |
|---|---|
| Fake the math so more profit shows up than the trades actually produced | Recomputes the single mis-stated step and shows the hash doesn't match |
| Fake the starting balance to manufacture extra room | Recomputes the very first committed state and shows it doesn't match the honest genesis |
| Invent a trade that never happened, at a time real trades did occur | Shows the claimed step doesn't match what was actually committed to that hour's real trade record |
| Backdate a trade to a period that was never recorded at all | Shows the claimed source period isn't one the settlement is even allowed to draw from |
| Simply lie about whether the account passed or failed | Recomputes the final result directly from the committed final state and shows it doesn't match the claim |
Any one of these can be triggered by anyone willing to do the work of checking, not just the affected trader, and a successful proof doesn't just cancel the bad settlement, it seizes the operator's posted collateral entirely. Getting caught costs real, immediate capital.
The evidence is bound to reality, not just internally consistent
The clever part isn't just that a settlement's own math has to check out, it's that the settlement is cryptographically bound to a separate, independent hourly record of every real trade. A firm can't just submit an internally-consistent story; that story has to match a trade ledger that was already locked in before the settlement was even proposed. This closes the sneakiest version of cheating: a transcript that's perfectly self-consistent but simply describes trades that didn't happen.
The math is proven identical on both sides of the chain boundary
The rules that decide pass or fail run in two places: once inside the settlement engine itself (off-chain, for speed) and once inside the on-chain program (for the actual fraud-proof check). These two implementations are written in different languages and proven, through a dedicated cross-language test suite, to produce byte-for-byte identical results on the same input, every time. If they ever diverged even slightly, that test would fail before anything shipped. A fuzz-testing pass across roughly seventeen thousand randomized scenarios once found a subtle overflow bug in this exact code that would have made a fraudulent settlement un-faultable; it was caught and fixed before it ever reached production.
An operator can't cheat by simply doing nothing
There's one more attack this closes that's easy to miss: what if an operator just never settles a passed evaluation at all, stalling forever rather than risking a provable lie? That doesn't work either. If a challenge sits unsettled long enough past its deadline, the trader can open a dispute with no batch root required, and if the operator still doesn't cure it in time, the trader is paid directly from the insurance fund. Silence isn't a safe alternative to honesty.
Where the evidence currently stands
The propose step and all five fault-proof gates have been exercised against real transactions on Solana's public devnet. The path from a clean, finalized settlement through to an actual delivered payout has been proven against a real validator and a real database, but not yet directly observed on devnet itself. Both are real, working code, verified at different levels, stated at the level each has actually earned, not rounded up.