Summary
register freezes weight into resolution.eligible_total (the denominator W) regardless of whether the position ever reveals. Only revealed weight is added to resolution.agree_weight/disagree_weight (inside reveal), but non-revealed weight stays counted in W when checking the strict-majority threshold (side_weight > W - side_weight) and when the optimistic timeout default applies.
An actor can register substantial weight on the side that would help the asserter's claim stand, then simply never reveal it. This inflates W without adding to either tally, making it harder for a genuine, fully-revealed opposing majority to exceed half of W, and can push an otherwise-clear dispute into the optimistic timeout default (asserted outcome stands) instead of the outcome the real, revealed participants intended.
This is a documented, explicitly-acknowledged residual risk in docs/src/V2_RESOLUTION.md's threat table ("Abstention to block majority... A coalition with revealed addresses can recycle part of the forfeiture, so its net cost may be below the nominal bond"), not a silent oversight, but it's tracked here as an actionable issue since a mitigation was left open rather than decided.
Impact: the deterrent is that a non-revealed position's stake is forfeited (under both strict-majority and timeout settlement), but the cost of manipulating the outcome this way can be less than the value of the manipulation, and less than the forfeited amount if the attacker also holds revealed positions that recycle part of the forfeiture pool.
Scope
- Evaluate adding a minimum reveal quorum (a floor on
revealed_weight relative to eligible_total) before the optimistic default is allowed to apply, so a dispute with heavy non-reveal doesn't automatically default to the asserted outcome.
- This is a genuine economic design decision with trade-offs already discussed in
V2_RESOLUTION.md (a stricter quorum could itself be gamed by under-registering, or could increase how often a dispute times out with no resolution at all); the assignee should present the trade-off explicitly rather than picking a threshold unilaterally.
- Add property/economic tests modeling the attack (register-heavy, reveal-light) against any proposed mitigation.
Proposed approach
No single fix is prescribed here since V2_RESOLUTION.md itself left this open pending economic simulation (see docs/src/V2_BOND_SIZING.md for the sizing work already done in a related direction). The assignee's first deliverable should be a written analysis of the trade-off, confirmed with the maintainer, before any code change.
Summary
registerfreezes weight intoresolution.eligible_total(the denominatorW) regardless of whether the position ever reveals. Only revealed weight is added toresolution.agree_weight/disagree_weight(insidereveal), but non-revealed weight stays counted inWwhen checking the strict-majority threshold (side_weight > W - side_weight) and when the optimistic timeout default applies.An actor can register substantial weight on the side that would help the asserter's claim stand, then simply never reveal it. This inflates
Wwithout adding to either tally, making it harder for a genuine, fully-revealed opposing majority to exceed half ofW, and can push an otherwise-clear dispute into the optimistic timeout default (asserted outcome stands) instead of the outcome the real, revealed participants intended.This is a documented, explicitly-acknowledged residual risk in
docs/src/V2_RESOLUTION.md's threat table ("Abstention to block majority... A coalition with revealed addresses can recycle part of the forfeiture, so its net cost may be below the nominal bond"), not a silent oversight, but it's tracked here as an actionable issue since a mitigation was left open rather than decided.Impact: the deterrent is that a non-revealed position's stake is forfeited (under both strict-majority and timeout settlement), but the cost of manipulating the outcome this way can be less than the value of the manipulation, and less than the forfeited amount if the attacker also holds revealed positions that recycle part of the forfeiture pool.
Scope
revealed_weightrelative toeligible_total) before the optimistic default is allowed to apply, so a dispute with heavy non-reveal doesn't automatically default to the asserted outcome.V2_RESOLUTION.md(a stricter quorum could itself be gamed by under-registering, or could increase how often a dispute times out with no resolution at all); the assignee should present the trade-off explicitly rather than picking a threshold unilaterally.Proposed approach
No single fix is prescribed here since
V2_RESOLUTION.mditself left this open pending economic simulation (seedocs/src/V2_BOND_SIZING.mdfor the sizing work already done in a related direction). The assignee's first deliverable should be a written analysis of the trade-off, confirmed with the maintainer, before any code change.